# Trojan Attacks

**URL:** <https://www.phphelp.com/t/trojan-attacks/22454>\
**Category:** General PHP Help\
**Created:** [April 4, 2014, 10:10am UTC](https://www.phphelp.com/t/trojan-attacks/22454 "2014-04-04T10:10:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![system](https://www.phphelp.com/uploads/default/original/2X/2/243e9ed5d93c5653ce3186f18df16e019ce38445.png) [@system](https://www.phphelp.com/u/system)\
**Post date:** [April 4, 2014, 10:10am UTC](https://www.phphelp.com/t/trojan-attacks/22454/1 "2014-04-04T10:10:43Z")

</div>

Dear All,

i am running wordpress (latest) on windows 2003 with MySql server as usual. lately some one is trying to drop a trojan into my server. the message below i get in the eventviewer:

Name: Backdoor:PHP/SimpleShell.A  
ID: 2147684280  
Severity: Severe  
Category: Backdoor  
Path: file:\_C:\WINDOWS\Temp\phpF0.tmp-\>[PHP];file:\_C:\WINDOWS\Temp\phpF2.tmp-\>[PHP];file:\_C:\WINDOWS\Temp\phpF4.tmp-\>[PHP];file:\_C:\WINDOWS\Temp\phpF6.tmp-\>[PHP];file:\_C:\WINDOWS\Temp\phpF8.tmp-\>[PHP];file:\_C:\WINDOWS\Temp\phpFA.tmp-\>[PHP]  
Detection Origin: Local machine  
Detection Type: Concrete  
Detection Source: Real-Time Protection  
User: servername\IUSR\_servername  
Process Name: C:\Program Files\PHP\php-cgi.exe

disabling File\_Upload on php.ini solves the problem but i need the upload to be enables so my students will be able to upload files to the wordpress.

am running 5.2.13

any help is appreciated

---

<div class="post-metadata">

**Author:** ![astonecipher](https://www.phphelp.com/user_avatar/www.phphelp.com/astonecipher/32/2797_2.png) [@astonecipher](https://www.phphelp.com/u/astonecipher)\
**Post date:** [April 4, 2014, 11:28am UTC](https://www.phphelp.com/t/trojan-attacks/22454/2 "2014-04-04T11:28:15Z")

</div>

It’s a very short term solution, but record the ip address and block it. Your anti virus did it’s job.

---

<div class="post-metadata">

**Author:** ![richei](https://www.phphelp.com/letter_avatar_proxy/v4/letter/r/e5b9ba/32.png) [@richei](https://www.phphelp.com/u/richei)\
**Post date:** [April 4, 2014, 3:09pm UTC](https://www.phphelp.com/t/trojan-attacks/22454/3 "2014-04-04T15:09:56Z")

</div>

You can also filter out the uploaded files by only allowing specific file types.