If you want, I can:
: Look for GET /b374k.php HTTP/1.1 200 in your web server logs. b374k.php
Tools like Tripwire or AIDE hash every PHP file daily. When a new file appears in /var/www/html , the admin is alerted. b374k.php cannot hide from FIM. If you want, I can: : Look for GET /b374k