Found the first PHP virus Php.pirus

Php. Pirus is the first discovered virus written in PHP that looks for files with the. php and. htm extensions and inserts code to call itself. This virus can only be on a server with PHP as interpreter. Accessing a Web page that is infected with it does not infect the virus.

Type: Virus
Infection Length: 718 bytes
Virus Discovery Time: 2000-11-13
Degree of harm: Madness degree: low;
Degree of damage: low;
Spread: Low
Madness degree:
Infected computers: 0-49
Infected sites: 0-2
Geographical distribution: Low
Precaution: Easy
Elimination: Easy

Technical Description:
This virus is written in PHP with a length of 718 bytes.
When the attack occurs, it looks for files in the current directory that end with. php and. htm, and if a writable file is found, it first determines whether the file is infected and, if not, it inserts a row into the file, giving priority to executing the virus file
Eliminate:
The virus file name may be changed, so completely eliminate it, you must:
1. Delete original virus file
2. Remove virus code from all infected PHP and HTM files
If the virus file name is assumed to be virus.php, then the following statement in all infected files must delete the include "virus.php"
/php>