The problem with that suggestion is that (a) the replacement isn't an executable file (i.e. it doesn't do anything, so a backdoor is impossible), and (b) in order to replace the file in the first place, the virus / hacker would have to have access to the system, which means there isn't any need for a backdoor.
I also assume this is a Linux server? If so, the chances of it being a virus are non-existent, and the chances of it being some sort of file execution is also unlikely. The only real explanation is that you had some externally accessible script that someone exploited...whether intentionally or not.
I also assume this is a Linux server? If so, the chances of it being a virus are non-existent, and the chances of it being some sort of file execution is also unlikely. The only real explanation is that you had some externally accessible script that someone exploited...whether intentionally or not.
