购买 网站:

(CA) http://lotterball.com/ticket/powerball

(NY) http://thelotter.com/

/var/www/html/joomla3, chmod -R 755 *

log 检测到哪些文件被感染:

grep -i POST  stormqloud.ca-access_log-20151227 |grep 200 |grep templa

find . -mtime -1 -print

64.22.89.202 – - [08/Dec/2015:23:06:34 -0500] “POST /templates/rt_hexeris/admin/tips/gallery.php HTTP/1.1″ 200 92 “-” “Mozilla/5.0 (X11; U; Linux i686; en-US) U2/1.0.0 UCBrowser/9.3.1.344″

Continue reading →