One of my websites was affected by this. I'm currently doing some work to de-obfuscate the php code. https://github.com/shiragami/japanese-backdoor/blob/master

One of my websites was affected by this. I'm currently doing some work to de-obfuscate the php code. https://github.com/shiragami/japanese-backdoor/blob/master/obs.php https://github.com/shiragami/japanese-backdoor/blob/master/o... Basically what it did: Create a htaccess file to redirect request. Respond differently if client is web-crawlers i.e. seo cloaking. Download a php backdoor. Rewrite sitemap.xml and robots.txt I'm still not sure what exploit that it uses to gain access.