Unknown Files in Hosting Account

[system]

My business was recently hacked and a large chunk of spam porn links were added to the bottom of our website. We found and removed them, and changed all our passwords, etc. Today, we found two php files in our directory and we don’t know what they do (I’m a web designer and I do a little light coding, but I don’t understand this one). I was hoping someone here might be able to explain this code to me so I know it’s it’s something normal or something malicious that I should delete.

The file is named wp-nbw.php, and this is the contents:

code removed by moderator due to the nature of the code.

Any help is much appreciated!!

[benanamen]

This is a VERY naughty script. Get rid of it immediately! It will allow someone to do most anything they want to your hosting account.

Not a good idea to post that code. Malicious people can use it and continue creating problems like you had. I highly recommend deleting the code from your post and your server.

[JimL]

Yeah this is unwanted code. I always recommend people to remove everything when a site has been compromised. The files are usually easily replacable, and you will keep your data in the database.

Back doors can be a lot more hidden than this one…