Jump to content

robertutzu

Active Members
  • Posts

    1493
  • Joined

  • Last visited

  • Days Won

    5

Everything posted by robertutzu

  1. Down For Everyone Or Just Me -> Check if your website is down or up? https://isitup.org/ https://downdetector.com/status/facebook
  2. trebuie dat wipe cache si wipe dalwick cache
  3. @PingLord Nu mai minti lumea. De ce ai pacalit bietul om? Cred ca se putea in 3 minute sa fie gata...
  4. @awnly3jhc2g Cod deja utilizat..pfff se poate unul pe pm, ms anticipat
  5. nu merge fiserul e busit are 452bytes
  6. At the time of removal, this was the explanation for this listing: The host at this IP address is infected with the CryptPHP PHP malware. CryptoPHP is a threat that uses backdoored Joomla, WordPress andn Drupal themes and plug-ins to compromise webservers on a large scale. More information about this threat can be found on the referenced link below. Fox-IT: CryptoPHP - Analysis of a hidden threat inside popular content management systems Attackers Using Compromised Web Plug-Ins in CryptoPHP Blackhat SEO Campaign This infection almost certainly means that the infected web site has used pirated plugins from the nulledstylez.com, dailynulled.com sites or some other site that specializes in providing "nulled" (pirated) software. Fox-IT's research has shown that every pirated theme or plug-in on these two sites has been infested with the cryptophp malware. This was detected by a TCP connection from xxx.xxx.xxx.xxx on port 45235 going to IP address 192.42.116.41 (the sinkhole) on port 80. The botnet command and control domain for this connection was "ergofilling.com". Behind a NAT, you should be able to find the infected machine by looking for attempted connections to IP address 192.42.116.41 or host name ergofilling.com on any port with a network sniffer such as wireshark or by configuring the router to block and log such connections. Equivalently, you can examine your DNS server or proxy server logs to references to 192.42.116.41 or ergofilling.com. See Advanced Techniques for more detail on how to use wireshark - ignore the references to port 25/SMTP traffic - the identifying activity is NOT on port 25. This detection corresponds to a connection at 2014-11-23 18:02:13 (GMT - this timestamp is believed accurate to within one second). Fox-IT has a blog item on finding and fixing CryptoPHP infections here. Based on suggestions found there, we recommend one of the following two *NIX command lines to find the current version of CryptoPHP. The first command is usually very fast, but will not find copies of CryptoPHP installed after the last time "updatedb" has run (usually once per day). The second command will find all existing copies, but may take hours to run. find -L / -type f -name 'social.png' | xargs file locate -b '\social.png' | xargs file If either script returns something like "../images/social.png: PHP script, ASCII text", then you have found one infection - there may be more than one. Note that the "locate" subsystem or "file" command are not always installed by default. On Debian or Ubuntu, you can install these two commands by "sudo apt-get install locate" and "sudo apt-get install file" respectively. If you have to install locate, it won't locate anything until "updatedb" (part of locate package) has run at least once. You can run it manually via "sudo update". Update takes a long time to run the first time. Fox-IT recommends that you should NOT try to "repair" the infection. The infected account should be reinstalled from scratch. I shall repeat the previous paragraph: removing the "social.png" file DOES NOT remove the infection. "social.png" is only just one small piece of it. The infected account should be reinstalled from scratch. NEW! There's a new version of findbot that should find CryptoPHP faster and simpler - try the -c option. There are a number of scanners that can be used on web servers to try to find malicious PHP and Perl scripts, such as rkhunter etc. With the assistance of others, we've written a simple perl script called findbot.pl that searches for such things as r57shell, cryptphp etc. It will search your system can find potentially dangerous scripts. As it's very simple-minded you will have to carefully inspect the files it finds to verify whether what it finds is malicious or not. Be aware of the file types - finding executable code fragments within ".png" or ".jpg" files is clearly demonstrates that the file is malicious. In order to use findbot.pl, you will need Perl installed. Install perl if necessary Download findbot.pl Follow the instructions at the beginning of the findbot.pl file
  7. preluat de aici plm: Cataloage Reduceri Black Friday: Domo, Altex, Clickshop, Elefant, AVStore, eMAG, F64, PCGarage, evoMAG, Flanco | zoso blog
  8. @daatdraqq http://i.imgur.com/WRACxd4.png
  9. sa lamurim treaba... doar string datele, ma mir daca primiti actualmente ceva Studio Twelve SRL Tipul de activitate: PRELUCRAREA DATELOR, ADMINISTRAREA PAGINILOR WEB SI ACTIVITATI CONEXE
  10. incearca urmatoarele comenzi: -ishit -icoailii
  11. SEO " 2-3 saptamani sa ajunga pe prima pozitie" priceless daca nu vrei sa iei teapa, rezultate concrete ai sa vezi cum a zis si @M4T3!
  12. robertutzu

    Wildchild

    La multi ani, @wildchild!
  13. la 187k de rezultate cu revslider this is big shit
  14. @GarryOne am dat like ca omul si-a expus parerea care parea legitima. Si ca idee las-o asa! Chiar nu am chef sa intind discutia si crede-ma ca nici tu nu vrei cand te stii cu musca pe caciula. Za end.
  15. e ok 45, acu vreo 2 ani un intel quad q6600 il tineam in 85-90 grade(overcloked) si nu a murit merge bine mersi si acum
  16. dat fiind ca sunt multi cu vbulletin neplatit pana vor lua/aparea patch-ul pentru toti va fain disclosure-ul
  17. numele trebuie sa corespunda clasei careia te adresezi si tipului de vin vandut, oricum vad pe aici nume din ce in ce mai bune asa ca mai astept
  18. cand dati nume va rog ganditi-va in primul rand daca voi ati cumpara brandu ala cu numele dat de voi
×
×
  • Create New...