How to search for malicious code without antiviruses and scanners. Logbook What to do If you failed to find a virus yourself
1. Unpack in the site folder.
2. Skip the link Your_Site / FSCure /
3. All
What can?
1. Automatic search for viruses by signatures.
2. Search string in files
3. Delete files
4. Malic Code Patch with regular expressions
The script will not make all the work for you and requires some minimal knowledge. Before work, it is recommended to make a backup site.
How does it work?
When you first start, the file index is. File FSCURE.LST in folder. Displays a list of files containing potentially malicious signatures. "Potentially malicious" it means that it is necessary to solve the virus or not the virus. The list of signatures is configured in the config.php file, the SCAN_SIGN constant. When default settings, the script does not check the JS files and does not contain signatures for them.
The most frequent problems
1. Does not create the fscure.lst index. It may happen if not enough rights. Put 777 to FSCURE folder
2. 5xx error. Most often "504 Gateway Time-Out". The script does not have time to work out and crashes along Taimaut. In this case, there are several ways to speed up its work. The speed primarily depends on the size of the index. It is in the FSCure.lst file. Usually the file up to 5MB in 90% of cases has time to process. If you do not have time, you can reduce the "greed" of the script forbing scanning * .jpg; *. PNG; *. CSS in the config.
In the config.php file.
// delimiter; Define ("Files_exClude", "*. js; *. jpg; *. PNG; *. CSS");
3. Hosting issues a prevention of the type
(Hex) base64.inject.unclassed.6: u56565656: /var/www/u65656565/data/www/34535335353.ru/fscure/index.php
There is no virus in the script and there was no. A (Hex) base64.inject.unclassed.6 This design of the form "Echo Base64_Decode (", which is often found and by itself quite harmless. Nevertheless, in the latest version, I replaced this code.
What to do if you can't find a virus yourself?
You can contact me for help. Rates I have modest. I give a guarantee of 6 months. Cost of 800 p. For 1 site. If the account has several sites the price is determined individually.
If you have done everything yourself, I will be grateful for the material reward or link to my site.
My requisites:
yandex
41001151597934
webMoney
Z959263622242.
R356304765617
E172301357329.
Malicious JavaScript.
My opinion, consisting in the fact that from the implemented malicious browser scripts (stored XSS attacks) is easier and efficiently protected by means of browsers, it was stated earlier :. Browser protection against JavaScript-A, consisting of the addition of the filter code to HTML pages, it is necessary to assume, it is reliable, however, the presence of such protection does not cancel the need to use another server filter. With regard to the same XSS attacks on the server, an additional defense line can be organized. It is necessary to remember about the possibility of introducing an attacker to an HTML message sent from the site, not browser, but server scripts (PHP), in which the browser will not be strong.
An attacker script, even a browser, at least a server is a program, it is necessary to think that the program will always have some symbolic differences from "pure" HTML. Let's try to find such differences and use them to build an HTML filter on the server. Below are examples of malicious JavaScript.
XSS:
Some text
Some text
Encrypted XSS:
Some text
Browsers restore text from symbolic primitives not only inside HTML containers (between the opening and closing tag), but also inside the tags themselves (between< и >). URL encoding is allowed in HTTP addresses. The specified complicates the recognition of a malicious code on the server side, since the same symbolic sequence can be represented in different ways.