网页中的未知代码
我在我们的实时网页中发现未知代码。 我们还注意到我们共享网络托管空间上托管的几个网站被神秘地删除了。
我们发现的未知代码以图像格式显示在下面。请告诉我们这是什么类型的代码以及我们如何避免这些代码被添加到我们的网页中。
Im finding unknown code in our live webpages.
We also noticed couple of websites hosted on our shared web hosting space are mysteriously getting deleted.
The unknown code we found is displayedd below in image format. Kindly update us what kind of code is this and how can we avoid these code from getting added to our webpages.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
是的，它看起来像一个与这个相同的后门。我认为这是一篇有趣的文章，它详细介绍了解码过程，并介绍了如何清理系统。
Yep it looks like a backdoor identical to this one. I think thats an interesting post, it goes over the process of decoding it and bit on how to clean up your system.
看看这是否对您有帮助：http://forum.joomla.org/viewtopic.php? p=2360137
See if this helps you any: http://forum.joomla.org/viewtopic.php?p=2360137
您的服务器上的其他地方可能存在相同或相似的代码/特洛伊木马/病毒，甚至在您的用户帐户之外也是如此。请参阅下面的建议#3。
这可疑看起来像一个RAT，因为它通过调用执行解码后的base64_decode
eval(base64_decode(“whole_bunch_of_obfuscated_stuff”));由于您没有将该文件放在那里，因此请立即压缩它！
进一步建议：
[~] grep -r "base64_decode" .。有关更多详细信息，请参阅下面提到的文章。thegothicparty.com 上有一篇专门介绍 RAT 和服务器 RAT 感染的文章。
您可以在这里阅读：
http://thegothicparty.com/dev/article/server-side-virus-老鼠/
You are likely to have the same or similar code/trojan/virus duplicated elsewhere on your server, even outside of your user account. See advice #3 below.
This is suspiciously looking like a RAT, since it executes the decoded base64_decode by invoking
eval(base64_decode( "whole_bunch_of_obfuscated_stuff"));As you did not put that file there, zip it immediately!
Further advice:
[~] grep -r "base64_decode" .as high up the directory tree as you can. See the article mentioned below for more details.An article dedicated to RAT and Server RAT Infection is located on thegothicparty.com.
You can read it here:
http://thegothicparty.com/dev/article/server-side-virus-rat/