{"draftJsState":{"blocks":[{"data":{"image":{"id":"62d1a8f173d68b4415d36cbf"}},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"atomic:image","key":"1kkjo"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Столкнулся с такой проблемой - вирус на сайте клиента.","type":"unstyled","key":"9fus7"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"У сайта клиента была такая проблема как \"Редирект\" на поддельный сайт озон. Перерыв пол сайта, выяснилось что вирус занес вредоносный код в такие файлы как:","type":"unstyled","key":"4dusd"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":27,"offset":0,"style":"BOLD"}],"text":"bitrix/js/main/core/core.js - скриптик \"s=document.createElement(script)\" ... удаляем его.","type":"ordered-list-item","key":"b698l"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":38,"offset":0,"style":"BOLD"}],"text":"bitrix/modules/main/include/prolog.php - Тоже в самом низу \"\" , удаляем.","type":"ordered-list-item","key":"dit9j"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Ура... мы победили, но не тут то было, через примерно неделю вредоносный код появляется вновь. Роем дальше...","type":"unstyled","key":"amrun"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Немного покопавшись по папкам и форумам, находим такую информацию, что вирус создает файлы, с виду нужные, но оказывается что их изначально у не зараженных сайтов нет:","type":"unstyled","key":"olrg"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":51,"offset":0,"style":"BOLD"}],"text":"/bitrix/components/bitrix/main.file.input/main.php - удаляем.","type":"ordered-list-item","key":"8ipos"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":55,"offset":0,"style":"BOLD"}],"text":"/bitrix/components/bitrix/main.file.input/set_list.php - тоже удаляем, но его может и не быть.","type":"ordered-list-item","key":"c62hf"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Чистим весь кеш и наблюдаем за результатом.","type":"unstyled","key":"3fggl"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Так же покопавшись по форумам, есть еще вирусы более подлые.","type":"header-two","key":"1en20"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"заменяют index.php в корне сайта,","type":"unordered-list-item","key":"198h7"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"удаляют файл /bitrix/.settings.php,","type":"unordered-list-item","key":"cugk8"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"создают скрипты Агенты с вредоносным кодом, создаются подобные агенты: ","type":"unordered-list-item","key":"fg6qc"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":101,"offset":0,"style":"BOLD"}],"text":"$arAgent[\"NAME\"];eval(urldecode(strrev('b3%92%92%22%73%b6%34%a5%b6%76%34%26%86%a5%85%a5%73%b6%96%....","type":"ordered-list-item","key":"aboen"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":334,"offset":0,"style":"BOLD"}],"text":"$fName = str_replace('/modules/main/classes/mysql', '', dirname(__FILE__)).'/admin/composite_seminarians.php'; $files = scandir(dirname($fName)); file_put_contents($fName, ' '); touch($fName, filemtime(dirname($fName).'/'.$files[2]));","type":"ordered-list-item","key":"d2v6i"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"создают файл /bitrix/tools/putin_***lo.php с кодом для удаленного доступа","type":"unordered-list-item","key":"4omhs"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"удаляют данные из таблиц базы данных b_iblock, b_iblock_element, b_iblock_element_property","type":"unordered-list-item","key":"f34et"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":70,"offset":0,"style":"BOLD"}],"text":"Для предотвращения заражения дальше, стоит выполнить немного действий.","type":"unstyled","key":"fbta1"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Перевести работу сайта на актуальную версию php 7.4 (если это еще не сделано)","type":"unordered-list-item","key":"3159j"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Обновить Битрикс до актуальной версии (Не всегда это помогает)","type":"unordered-list-item","key":"egtq8"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Если на сайте есть модуль \"Проактивная защита\" /bitrix/admin/security_panel.php - выполнить настройки по рекомендациям модуля","type":"unordered-list-item","key":"7k1tu"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Проверить сайт инструментом Битрикс \"Сканер безопасности\" /bitrix/admin/security_scanner.php","type":"unordered-list-item","key":"4m6d7"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":8,"offset":43,"style":"BOLD"}],"text":"Закрыть доступ к файлам на уровне сервера, временно (например в .htaccess)","type":"unordered-list-item","key":"fu3hm"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"/bitrix/tools/upload.php","type":"ordered-list-item","key":"bva4j"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"/bitrix/tools/mail_entry.php","type":"ordered-list-item","key":"de84d"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"/bitrix/modules/main/include/virtual_file_system.php","type":"ordered-list-item","key":"59por"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"/bitrix/components/bitrix/sender.mail.editor/ajax.php","type":"ordered-list-item","key":"1nm5n"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"/bitrix/tools/vote/uf.php","type":"ordered-list-item","key":"d0s1"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"/bitrix/tools/html_editor_action.php","type":"ordered-list-item","key":"45lra"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"/bitrix/admin/site_checker.php","type":"ordered-list-item","key":"cahg9"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":36,"offset":0,"style":"BOLD"}],"text":"Пример как можно ограничить доступы:","type":"unstyled","key":"2lubr"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"/home/bitrix/www/bitrix/admin/.htaccess","type":"unstyled","key":"csmjb"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Добавляем в файле правило. Если файла нет - создаем.","type":"unstyled","key":"av991"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"deny from all","type":"blockquote","key":"8mt0d"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"/home/bitrix/www/bitrix/tools/.htaccess","type":"unstyled","key":"b38pu"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Добавляем в файле правило. Если файла нет - создаем.","type":"unstyled","key":"62lnt"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":" deny from all","type":"blockquote","key":"vdli"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"/home/bitrix/www/bitrix/modules/main/include/.htaccess","type":"unstyled","key":"3ej32"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Добавляем в файле правило. Если файла нет - создаем.","type":"unstyled","key":"4rfbr"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":" deny from all","type":"blockquote","key":"6krs3"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"/home/bitrix/www/bitrix/components/bitrix/sender.mail.editor/.htaccess","type":"unstyled","key":"3peq8"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Добавляем в файле правило. Если файла нет - создаем.","type":"unstyled","key":"fpfbn"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":" deny from all","type":"blockquote","key":"eh99c"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"/bitrix/tools/vote/.htaccess","type":"unstyled","key":"am14h"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":" deny from all","type":"blockquote","key":"c6r0q"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"b1fee"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":127,"offset":0,"style":"BOLD"}],"text":"В старых версиях битрикс уязвимым местом оказался модуль vote , это модуль опросник. Для того что бы обезопасить себя, в файле:","type":"unstyled","key":"9nknd"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"/bitrix/tools/vote/uf.php над вызовом модуля вписываем:","type":"unstyled","key":"bu22b"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"if ($_SERVER['REQUEST_METHOD'] === 'POST') ","type":"blockquote","key":"fnq9a"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"{ ","type":"blockquote","key":"7qb39"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":" header(\"Status: 404 Not Found\");","type":"blockquote","key":"6ar9l"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":" die();","type":"blockquote","key":"794v1"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"}","type":"blockquote","key":"9bt47"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Тоже самое и в файле /bitrix/tools/html_editor_action.php","type":"unstyled","key":"6vr3m"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"На данную минуту все. Если что, пишите...","type":"unstyled","key":"deoro"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"marker","key":"NuhEE6B8dxhUjiK8hRXQ"}],"entityMap":{}},"mentions":[]}