Yesterday i received email, that my cpanel password changed, and contact my Provider and they send me new pass, but today same thing happened. Then i realized something went wrong. so i decided to reset pass and monitor whats going on, after few minutes i see there were 5 new php files added some day ago and the one with encrypted Php code executed on specific time, and i noticed at that time password was changed.
I tired to read other codes written in php, and checked many times how it might possible to upload code in public domain folder, there is no option to upload any files on public domain, so how it could be possible.
This is how it started “.base64_decode(“JXNsMmh3bjBrLQolZzh………………6000 plus then ended k7ID8+”)); ?> like this.