If your weblog attacked by .htaccess virus/malware and your traffic from search engine redirected into this website baa-oas.ru or googlesgo.com then you must check this file
1. .htaccess
2. wp-settings.php
3. update.php this file location at wp-admin/includes/update.php
4. Check all php files which contain this word "base64", "c99", "r57","shell_exec" Do it from shell acces and type this command: find [path] -name *.php -exec grep -l "base64" {} \;
5. Disable this php functions: exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source
6. Change your password.
Malware code:
If you have a lot of websites infected with this malware and want me to clean it up please contact me via email: noc [@] nsa.im. [not free, give me a cup of coffee]
more code about google redirect virus can be found here
Tidak ada komentar:
Posting Komentar