İlk mesajımdaki virüse ait kodlar nerede nasıl arayacağız. Bütün dosyaları aradım maalesef yok.
yalnız şu dosyalara rastlamştım (plugins,tema, uploads, upgrade klasörlerinin olduğu yerdeydi) ve onlarıda sildim. Dosya isimleri ve içeriklerini aşağıda veriyorum. Bilgisi olan arkadaşım yardımcı olursa sevinirim.
fuck.php adında bir köaslr ve içeriği aynen böyle.
</div>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head><link href='' rel='shortcut icon'/>
<title>./sanimorphic_tux</title><SCRIPT>/*
*/
TypingText = function(element, interval, cursor, finishedCallback) {
if((typeof document.getElementById == "undefined") || (typeof element.innerHTML == "undefined")) {
this.running = true; // Never run.
return;
}
this.element = element;
this.finishedCallback = (finishedCallback ? finishedCallback : function() { return; });
this.interval = (typeof interval == "undefined" ? 100 : interval);
this.origText = this.element.innerHTML;
this.unparsedOrigText = this.origText;
this.cursor = (cursor ? cursor : "");
this.currentText = "";
this.currentChar = 0;
this.element.typingText = this;
if(this.element.id == "") this.element.id = "typingtext" + TypingText.currentIndex++;
TypingText.all.push(this);
this.running = false;
this.inTag = false;
this.tagBuffer = "";
this.inHTMLEntity = false;
this.HTMLEntityBuffer = "";
}
TypingText.all = new Array();
TypingText.currentIndex = 0;
TypingText.runAll = function() {
for(var i = 0; i < TypingText.all.length; i++) TypingText.all[i].run();
}
TypingText.prototype.run = function() {
if(this.running) return;
if(typeof this.origText == "undefined") {
setTimeout("document.getElementById('" + this.element.id + "').typingText.run()", this.interval); // We haven't finished loading yet. Have patience.
return;
}
if(this.currentText == "") this.element.innerHTML = "";
// this.origText = this.origText.replace(/<([^<])*>/, ""); // Strip HTML from text.
if(this.currentChar < this.origText.length) {
if(this.origText.charAt(this.currentChar) == "<" && !this.inTag) {
this.tagBuffer = "<";
this.inTag = true;
this.currentChar++;
this.run();
return;
} else if(this.origText.charAt(this.currentChar) == ">" && this.inTag) {
this.tagBuffer += ">";
this.inTag = false;
this.currentText += this.tagBuffer;
this.currentChar++;
this.run();
return;
} else if(this.inTag) {
this.tagBuffer += this.origText.charAt(this.currentChar);
this.currentChar++;
this.run();
return;
} else if(this.origText.charAt(this.currentChar) == "&" && !this.inHTMLEntity) {
this.HTMLEntityBuffer = "&";
this.inHTMLEntity = true;
this.currentChar++;
this.run();
return;
} else if(this.origText.charAt(this.currentChar) == ";" && this.inHTMLEntity) {
this.HTMLEntityBuffer += ";";
this.inHTMLEntity = false;
this.currentText += this.HTMLEntityBuffer;
this.currentChar++;
this.run();
return;
} else if(this.inHTMLEntity) {
this.HTMLEntityBuffer += this.origText.charAt(this.currentChar);
this.currentChar++;
this.run();
return;
} else {
this.currentText += this.origText.charAt(this.currentChar);
}
this.element.innerHTML = this.currentText;
this.element.innerHTML += (this.currentChar < this.origText.length - 1 ? (typeof this.cursor == "function" ? this.cursor(this.currentText) : this.cursor) : "");
this.currentChar++;
setTimeout("document.getElementById('" + this.element.id + "').typingText.run()", this.interval);
} else {
this.currentText = "";
this.currentChar = 0;
this.running = false;
this.finishedCallback();
}
}</script><style>body {body {
background: #000000 url(http://a8.sphotos.ak.fbcdn.net/hphotos-ak-ash2/34801_180202535340490_100000522330258_577845_3665055_n.jpg) no-repeat top center;
color: #ff0000;
font-family: Courier New;
font-size: 12px;
}
td{font-family: verdana; font-size: 9pt; color: #ffffff}
a{font-family: verdana; font-size: 12pt; color: #ffffff}
/* REMOVE HORIZONTAL SCROLLBAR*/
body {
overflow-x: hidden;
}
/* REMOVE VERTICAL SCROLLBAR*/
body {
overflow-y: hidden;
}</style>
<body bgcolor="#000000"><center><div style="background-image:url(''); width="1040" height="710" class="shakeimage" onMouseOver="init(this);rattleimage()" onMouseOut="stoprattle(this);top.focus()" onClick="top.focus()" alt="" border="0"><br><div
id="example1"></div><p id="example2"><font face="Papyrus"; color="red"; size="8"><br>./sanimorphic_tux cooming // d(^_^)b \\
</font></b>
<br><br><br>
<font face="Comic Sans Ms"; color="white"; size="5"><b>No Deleted Date , No Change Password
<br><br><br></b></font></b><b>
<font face="Verdana"; color="white"; size="5">me : sanimorphic@blacknewbieteam.org</font><br><br>
<font face="Verdana"; color="white"; size="3"></font><br><br>
<font face="Verdana"; color="white"; size="2"></font><br><br>
<font face="Verdana"; color="red"; size="3"> </font> <font face="Verdana"; color="green"; size="3"></font> <font face="Verdana"; color="white"; size="3"></font>
</style><body bgcolor="#000000"><center></p></b>
<br><br><br><br><br><br><br><br><br><br><br><br><br><br>
<br><br><br><br><br><br><br><br><br><br><br><br><br><br>
<div align="center"><style>.shakeimage{position:relative}</style>
<script language="JavaScript1.2">var stopit=0
var rector=3
var a=1
function init(which){
stopit=0
shake=which
shake.style.left=0
shake.style.top=0
}
function rattleimage(){
if ((!document.all&&!document.getElementById)||stopit==1)
return
if (a==1){
shake.style.top=parseInt(shake.style.top)+rector
}
else if (a==2){
shake.style.left=parseInt(shake.style.left)+rector
}
else if (a==3){
shake.style.top=parseInt(shake.style.top)-rector
}
else{
shake.style.left=parseInt(shake.style.left)-rector
}
if (a<4)
a++
else
a=1
setTimeout("rattleimage()",50)
}
function stoprattle(which){
stopit=1
which.style.left=0
which.style.top=0
}</script><script type="text/javascript">//Define first typing example:
new TypingText(document.getElementById("example1"));
//Define second typing example (use "slashing" cursor at the end):
new TypingText(document.getElementById("example2"), 100, function(i){
var ar = new Array("_", "_", "_", "_"); return " " + ar[i.length %
ar.length]; });
//Type out examples:
TypingText.runAll();</script>
<</div>
<a class="style1" href="/">
</Script>
<object data="http://flash-mp3-player.net/medias/player_mp3.swf" width="0" height="0" type="application/x-shockwave-flash">
<param value="#ffffff" name="bgcolor"><br />
<param value="mp3=http://xover2.jkt.3d.x.indowebster.com/download/64/p167da3jcefh11p0019ks17f3o745.mp3&loop=1&autoplay=1&volume=125" name="FlashVars">
</object>
</body></html>Diğer dosyanın adı bnt.php içerik karakter olarak yetmedi isteyen olursa onuda eklerim bir sonraki mesajıma.