Read the complete post at http://www.sophos.com/security/analyses/viruses-and-spyware/trojphpshells.html?_log_from=rss