CryptoPHP is nasty little shit! A while ago I had a problem with spam on one of our hosting servers. When we ended on several RBL lists, one of them stated that there is a possible way that our machine is infected with CryptoPHP. Hacked files can be very hard to find. PHP code was hidden in false .png files! This pngs were then included in some legit php files, like index.php. So every time index.php was loaded, hacked code inside included png file was loaded too.
Here is how you can find if there are false png files on your system. Just scan your directory with this line:
find -L /path/to/dir/ -type f -name "*.png" -exec file {} + | grep PHP
You could also scan your system for other types of files. Just replace *.png with something elese, for example *.jpg.
Output for legit files will look something like this:
./wp-includes/js/tinymce/skins/wordpress/images/more-2x.png: PNG image data, 3800 x 40, 4-bit colormap, non-interlaced
Output for script that pretends to be regular PNG file – hacks – will look something like this:
./test.png: PHP script, ASCII text