In a hurry, I used the PHP web program and got the code down. I couldn't find it for 2 days. let's see why! Thanks & nbsp; my website has been poisoned. I have never been able to find it with PHPWEB. could you please help me? ------ solution ------------------ if your website does not exist, it may be & nbsp; & nbsp; other websites on this server are infected. you have been scanned and matched. ------ solution -------------- Urgent. I am using the PHP web program. now I am down to the code and cannot find it after 2 days, let's see why! Thank you.
My website is poisoned. I can't find my website using PHPWEB. could you please help me,
------ Solution ----------------------
If your website does not exist, it may be because other websites on the server are infected.
------ Solution ----------------------
Grep xargs sed is directly replaced. if it is still automatically added, a program will monitor the file read/write status.
------ Solution ----------------------
Reference:
Quote: reference:
It's okay to check where the data comes from.
You wrote the website yourself...
Too many tables.
Use FTP to view the file modification date, download the IIS log of the current day, and then you can see what he has done at that time?
Generally, you can update the patch and observe IIS logs for several consecutive days to quickly find out the problem.
------ Solution ----------------------
Mysql
Reference:
Quote: reference:
It's okay to check where the data comes from.
You wrote the website yourself...
Too many tables.
Mysqldump converts the content in the database to a text file, and then searches for grep.
------ Solution ----------------------
1. since it is suspected that the database is suspended, let's look at the corresponding table, first from the program to see which table the link is read... If there are too many tables, you won't open data from one table .. Find and check whether there are any vulnerabilities in the management code. if not, clear the vulnerabilities first.
2. after clearing the logs, open the logs and check if they are again mounted. check the logs at the corresponding time to find the clues.
------ Solution ----------------------
I have encountered this problem before. do you write the program yourself or cms? if it is cms, I suggest you check whether the files in the data file are usually injected into the program.
