http://arteventsphuket.com/ по неизвестной причине отвалился английский раздел http://arteventsphuket.com/en/, перестали отображаться галереи http://arteventsphuket.com/uslugi/korporativnyie-meropriyatiya http://arteventsphuket.com/uslugi/svadbyi и т.д. хостер говорит, что, возможно, это какие-то новые вирусы
ниже сообщение от них:
Ни в логах системных вызовов, ни в логах веб сервера ошибки не пишутся, так как 404 ошибку генерирует CNS сайта. Попробуйте почистить кэш modx. Если не поможет, передайте вопрос к разработчикам сайта для анализа скриптов сайта. При обращении к изображениям скрипт отдаёт 401 ошибку, примерно так: $ curl 'http://arteventsphuket.com/assets/components/gallery/connector.php?action=web/phpthumb&ctx=web&w=350&h=400&zc=0&far=&q=63&src=/assets/gallery/2/224.JPG' -H 'Pragma: no-cache' -H 'Accept-Encoding: gzip, deflate' -H 'Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7,ro;q=0.6' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.119 Safari/537.36' -H 'Accept: image/webp,image/apng,image/*,*/*;q=0.8' -H 'Referer: http://arteventsphuket.com/portfolio' -H 'Cookie: PHPSESSID=120a97f76efe71464c3203cc55e535ed; _ym_uid=155143455755927337; _ym_d=1551434557; _ym_visorc_45484323=w; _ym_isad=2' -H 'Connection: keep-alive' -H 'Cache-Control: no-cache' --compressed {"success":false,"code":401} В логах системного вызова: 30602 13:47:54.901323 open("/var/www/u0240056/data/www/arteventsphuket.com/core/model/modx/mysql/modaccesspolicy.map.inc.php", O_RDONLY) = 7 30602 13:47:54.901374 fstat(7, {st_mode=S_IFREG|0644, st_size=3546, ...}) = 0 30602 13:47:54.901416 mmap(NULL, 3546, PROT_READ, MAP_SHARED, 7, 0) = 0x7fcdea404000 30602 13:47:54.901465 munmap(0x7fcdea404000, 3546) = 0 30602 13:47:54.901508 close(7) = 0 30602 13:47:54.901551 open("/var/www/u0240056/data/www/arteventsphuket.com/core/model/modx/mysql/modaccesspolicy.map.inc.php", O_RDONLY) = 7 30602 13:47:54.901599 fstat(7, {st_mode=S_IFREG|0644, st_size=3546, ...}) = 0 30602 13:47:54.901643 fstat(7, {st_mode=S_IFREG|0644, st_size=3546, ...}) = 0 30602 13:47:54.901685 fstat(7, {st_mode=S_IFREG|0644, st_size=3546, ...}) = 0 30602 13:47:54.901727 mmap(NULL, 3546, PROT_READ, MAP_SHARED, 7, 0) = 0x7fcdea404000 30602 13:47:54.901771 fcntl(7, F_GETFL) = 0x8000 (flags O_RDONLY|O_LARGEFILE) 30602 13:47:54.901812 fstat(7, {st_mode=S_IFREG|0644, st_size=3546, ...}) = 0 30602 13:47:54.901853 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcdea403000 30602 13:47:54.901895 lseek(7, 0, SEEK_CUR) = 0 30602 13:47:54.901943 lseek(7, 0, SEEK_SET) = 0 30602 13:47:54.901984 read(7, "<?php\r\n/**\r\n * @package modx\r\n * @subpackage mysql\r\n */\n$xpdo_meta_map['modAccessPolicy']= array (\n 'package' => 'modx',\n 'version' => '1.1',\n 'table' => 'access_policies',\n 'extends' => 'xPDOSimpleObject',\n 'fields' => \n array (\n 'name' => NULL,\n 'description' => NULL,\n 'parent' => 0,\n 'template' => 0,\n 'class' => '',\n 'data' => '{}',\n 'lexicon' => 'permissions',\n ),\n 'fieldMeta' => \n array (\n 'name' => \n array (\n 'dbtype' => 'varchar',\n 'precision' => '255',\n 'phptype' => 'string',\n 'null' => false,\n 'index' => 'unique',\n ),\n 'description' => \n array (\n 'dbtype' => 'mediumtext',\n 'phptype' => 'string',\n ),\n 'parent' => \n array (\n 'dbtype' => 'int',\n 'precision' => '10',\n 'attributes' => 'unsigned',\n 'phptype' => 'integer',\n 'null' => false,\n 'default' => 0,\n 'index' => 'index',\n ),\n 'template' => \n array (\n 'dbtype' => 'int',\n 'precision' => '"..., 4096) = 3546 30602 13:47:54.902036 lseek(7, 3546, SEEK_SET) = 3546 30602 13:47:54.902077 munmap(0x7fcdea404000, 3546) = 0 30602 13:47:54.902120 lseek(7, -3546, SEEK_CUR) = 0 30602 13:47:54.902161 close(7) = 0 30602 13:47:54.902202 munmap(0x7fcdea403000, 4096) = 0 30602 13:47:54.902810 sendto(6, "\373\1\0\0\3SELECT modAccessContext.id, modAccessContext.target, modAccessContext.principal, modAccessContext.authority, modAccessContext.policy, Policy.data FROM modx_access_context AS modAccessContext LEFT JOIN modx_access_polici

es Policy ON modAccessContext.policy = Policy.id WHERE ( modAccessContext.principal_class = 'modUserGroup' AND modAccessContext.target = 'mgr' ) ORDER BY modAccessContext.target,modAccessContext.principal,modAccessContext.authority,modAccessContext.policy ASC ", 511, MSG_DONTWAIT, NULL, 0) = 511 30
602 13:47:54.902904 poll([{fd=6, events=POLLIN|POLLERR|POLLHUP}], 1, 1471228928) = 1 ([{fd=6, revents=POLLIN}]) 30602 13:47:54.902960 recvfrom(6, "\1\0\0\1\6K\0\0\2\3def\16u0240056_artev\20modAccessContext\23modx_access_context\2id\2id\f?\0\n\0\0\0\3#B\0\0\0S\0\0\3\3def\16u0240056_artev\20modAccessContext\23modx_access_context\6target\6target\f!\0,\1\0\0\375\t@\0\0\0Y\0\0\4\3def\16u0240056_artev\20modAccessContext\23modx_access_context\tprincipal\tprincipal\f?\0\n\0\0\0\3)@\0\0\0Y", 265, MSG_DONTWAIT, NULL, NULL) = 265 30602 13:47:54.903013 poll([{fd=6, events=POLLIN|POLLERR|POLLHUP}], 1, 1471228928) = 1 ([{fd=6, revents=POLLIN}]) 30602 13:47:54.903058 recvfrom(6, "\0\0\5\3def\16u0240056_artev\20modAccessContext\23modx_access_context\tauthority\tauthority\f?\0\n\0\0\0\3)@\0\0\0S\0\0\6\3def\16u0240056_artev\20modAccessContext\23modx_access_context\6policy\6policy\f?\0\n\0\0\0\3)@\0\0\0F\0\0\7\3def\16u0240056_artev\6Policy\24modx_access_policies\4data\4data\f!\0\375\377\2\0\374\20\0\0\0\0\5\0\0\10\376\0\0\2\0\312\r\0\t\0012\3mgr\0011\0010\0012\374\273\r{\"about\":true,\"access_permissions\":true,\"actions\":true,\"change_password\":true,\"change_profile\":true,\"charsets\":true,\"class_map\":true,\"components\":true,\"content_types\":true,\"countries\":true,\"create\":true,\"credits\":true,\"customize_forms\":true,\"dashboards\":true,\"database\":true,\"database_truncate\":true,\"delete_category\":true,\"delete_chunk\":true,\"delete_context\":true,\"delete_document\":true,\"delete_eventlog\":true,\"delete_plugin\":true,\"delete_propertyset\":true,\"delete_role\":true,\"delete_snippet\":true,\"delete_template\":true,\"delete_tv\":true,\"delete_user\":true,\"directory_chmod\":true,\"directory_create\":true,\"directory_list\":true,\"directory_remove\":true,\"directory_update\":true,\"edit_category\":true,\"edit_chunk\":true,\"edit"..., 1487, MSG_DONTWAIT, NULL, NULL) = 1487 30602 13:47:54.903130 poll([{fd=6, events=POLLIN|POLLERR|POLLHUP}], 1, 1471228928) = 1 ([{fd=6, revents=POLLIN}]) 30602 13:47:54.903176 recvfrom(6, "s\":true,\"help\":true,\"home\":true,\"import_static\":true,\"languages\":true,\"lexicons\":true,\"list\":true,\"load\":true,\"logout\":true,\"logs\":true,\"menus\":true,\"menu_reports\":true,\"menu_security\":true,\"menu_site\":true,\"menu_support\":true,\"menu_system\":true,\"menu_tools\":true,\"menu_user\":true,\"messages\":true,\"namespaces\":true,\"new_category\":true,\"new_chunk\":true,\"new_context\":true,\"new_document\":true,\"new_document_in_root\":true,\"new_plugin\":true,\"new_propertyset\":true,\"new_role\":true,\"new_snippet\":true,\"new_static_resource\":true,\"new_symlink\":true,\"new_template\":true,\"new_tv\":true,\"new_user\":true,\"new_weblink\":true,\"packages\":true,\"policy_delete\":true,\"policy_edit\":true,\"policy_new\":true,\"policy_save\":true,\"policy_template_delete\":true,\"policy_template_edit\":true,\"policy_template_new\":true,\"policy_template_save\":true,\"policy_template_view\":true,\"policy_view\":true,\"property_sets\":true,\"providers\":true,\"publish_document\":true,\"purge_deleted\":true,\"remove\":true,\"remove_locks\":true,\"resource_duplicate\""..., 5017, MSG_DONTWAIT, NULL, NULL) = 5017 30602 13:47:54.903229 poll([{fd=6, events=POLLIN|POLLERR|POLLHUP}], 1, 1471228928) = 1 ([{fd=6, revents=POLLIN}]) 30602 13:47:54.903275 recvfrom(6, "e,\"save_user\":true,\"search\":true,\"settings\":true,\"sources\":true,\"source_delete\":true,\"source_edit\":true,\"source_save\":true,\"source_view\":true,\"steal_locks\":true,\"tree_show_element_ids\":true,\"tree_show_resource_ids\":true,\"undelete_document\":true,\"unlock_element_properties\":true,\"unpublish_document\":true,\"usergroup_delete\":true,\"usergroup_edit\":true,\"usergroup_new\":true,\"usergroup_save\":true,\"usergroup_user_

edit\":true,\"usergroup_user_list\":true,\"usergroup_view\":true,\"view\":true,\"view_category\":true,\"view_chunk\":true,\"view_context\":true,\"view_document\":true,\"view_element\":true,\"view_eventlog\":true,\"view_offline\":true,\"view_plugin\":true,\"view_propertyset\":true,\"view_role\":true,
\"view_snippet\":true,\"view_sysinfo\":true,\"view_template\":true,\"view_tv\":true,\"view_unpublished\":true,\"view_user\":true,\"workspaces\":true}\5\0\0\v\376\0\0\2\0", 5017, MSG_DONTWAIT, NULL, NULL) = 826 30602 13:47:54.902904 poll([{fd=6, events=POLLIN|POLLERR|POLLHUP}], 1, 1471228928) = 1 ([{fd=6, revents=POLLIN}]) 30602 13:47:54.902960 recvfrom(6, "\1\0\0\1\6K\0\0\2\3def\16u0240056_artev\20modAccessContext\23modx_access_context\2id\2id\f?\0\n\0\0\0\3#B\0\0\0S\0\0\3\3def\16u0240056_artev\20modAccessContext\23modx_access_context\6target\6target\f!\0,\1\0\0\375\t@\0\0\0Y\0\0\4\3def\16u0240056_artev\20modAccessContext\23modx_access_context\tprincipal\tprincipal\f?\0\n\0\0\0\3)@\0\0\0Y", 265, MSG_DONTWAIT, NULL, NULL) = 265 30602 13:47:54.903013 poll([{fd=6, events=POLLIN|POLLERR|POLLHUP}], 1, 1471228928) = 1 ([{fd=6, revents=POLLIN}]) 30602 13:47:54.903058 recvfrom(6, "\0\0\5\3def\16u0240056_artev\20modAccessContext\23modx_access_context\tauthority\tauthority\f?\0\n\0\0\0\3)@\0\0\0S\0\0\6\3def\16u0240056_artev\20modAccessContext\23modx_access_context\6policy\6policy\f?\0\n\0\0\0\3)@\0\0\0F\0\0\7\3def\16u0240056_artev\6Policy\24modx_access_policies\4data\4data\f!\0\375\377\2\0\374\20\0\0\0\0\5\0\0\10\376\0\0\2\0\312\r\0\t\0012\3mgr\0011\0010\0012\374\273\r{\"about\":true,\"access_permissions\":true,\"actions\":true,\"change_password\":true,\"change_profile\":true,\"charsets\":true,\"class_map\":true,\"components\":true,\"content_types\":true,\"countries\":true,\"create\":true,\"credits\":true,\"customize_forms\":true,\"dashboards\":true,\"database\":true,\"database_truncate\":true,\"delete_category\":true,\"delete_chunk\":true,\"delete_context\":true,\"delete_document\":true,\"delete_eventlog\":true,\"delete_plugin\":true,\"delete_propertyset\":true,\"delete_role\":true,\"delete_snippet\":true,\"delete_template\":true,\"delete_tv\":true,\"delete_user\":true,\"directory_chmod\":true,\"directory_create\":true,\"directory_list\":true,\"directory_remove\":true,\"directory_update\":true,\"edit_category\":true,\"edit_chunk\":true,\"edit"..., 1487, MSG_DONTWAIT, NULL, NULL) = 1487 30602 13:47:54.903130 poll([{fd=6, events=POLLIN|POLLERR|POLLHUP}], 1, 1471228928) = 1 ([{fd=6, revents=POLLIN}]) 30602 13:47:54.903176 recvfrom(6, "s\":true,\"help\":true,\"home\":true,\"import_static\":true,\"languages\":true,\"lexicons\":true,\"list\":true,\"load\":true,\"logout\":true,\"logs\":true,\"menus\":true,\"menu_reports\":true,\"menu_security\":true,\"menu_site\":true,\"menu_support\":true,\"menu_system\":true,\"menu_tools\":true,\"menu_user\":true,\"messages\":true,\"namespaces\":true,\"new_category\":true,\"new_chunk\":true,\"new_context\":true,\"new_document\":true,\"new_document_in_root\":true,\"new_plugin\":true,\"new_propertyset\":true,\"new_role\":true,\"new_snippet\":true,\"new_static_resource\":true,\"new_symlink\":true,\"new_template\":true,\"new_tv\":true,\"new_user\":true,\"new_weblink\":true,\"packages\":true,\"policy_delete\":true,\"policy_edit\":true,\"policy_new\":true,\"policy_save\":true,\"policy_template_delete\":true,\"policy_template_edit\":true,\"policy_template_new\":true,\"policy_template_save\":true,\"policy_template_view\":true,\"policy_view\":true,\"property_sets\":true,\"providers\":true,\"publish_document\":true,\"purge_deleted\":true,\"remove\":true,\"remove_locks\":true,\"resource_duplicate\""..., 5017, MSG_DONTWAIT, NULL, NULL) = 5017 30602 13:47:54.903229 poll([{fd=6, events=POLLIN|POLLERR|POLLHUP}], 1, 1471228928) = 1 ([{fd=6, revents=POLLIN}]) 30602 13:47:54.903275 recvfrom(6, "e,\"save_user\":true,\"search\":true,\"settings\":true,\"sources\":true,\"source_delete\":true,\"source_edit\":true,\"source_save\":true,\"source_view\":true,\"steal_locks\":true,\"tree_show_element_ids\":true,\"tree_show_resource_id

s\":true,\"undelete_document\":true,\"unlock_element_properties\":true,\"unpublish_document\":true,\"usergroup_delete\":true,\"usergroup_edit\":true,\"usergroup_new\":true,\"usergroup_save\":true,\"usergroup_user_edit\":true,\"usergroup_user_list\":true,\"usergroup_view\":true,\"view\":true,\"view_ca
tegory\":true,\"view_chunk\":true,\"view_context\":true,\"view_document\":true,\"view_element\":true,\"view_eventlog\":true,\"view_offline\":true,\"view_plugin\":true,\"view_propertyset\":true,\"view_role\":true,\"view_snippet\":true,\"view_sysinfo\":true,\"view_template\":true,\"view_tv\":true,\"view_unpublished\":true,\"view_user\":true,\"workspaces\":true}\5\0\0\v\376\0\0\2\0", 5017, MSG_DONTWAIT, NULL, NULL) = 826 30602 13:47:54.904143 brk(0x1d95000) = 0x1d95000 30602 13:47:54.904641 sendto(6, "\346\0\0\0\3SELECT modSession.id AS modSession_id, modSession.access AS modSession_access, modSession.data AS modSession_data FROM modx_session AS modSession WHERE modSession.id = '120a97f76efe71464c3203cc55e535ed' ", 234, MSG_DONTWAIT, NULL, 0) = 234 30602 13:47:54.904702 poll([{fd=6, events=POLLIN|POLLERR|POLLHUP}], 1, 1471228928) = 1 ([{fd=6, revents=POLLIN}]) 30602 13:47:54.904754 recvfrom(6, "\1\0\0\1\3I\0\0\2\3def\16u0240056_artev\nmodSession\fmodx_session\rmodSession_id\2id\f!\0\375\2\0\0\375\3@\0\0\0Q\0\0\3\3def\16u0240056_artev\nmodSession\fmodx_session\21modSession_access\6access\f?\0\24\0\0\0\3)P\0\0\0M\0\0\4\3def\16u0240056_artev\nmodSession\fmodx_session\17modSession_data\4data\f!\0\375\377\377\2\374\20\0\0\0\0\5\0\0\5\376\0\0\2\0,\5\0\6 120a97f76efe71464c3203cc55e535ed\n1551435004\374\375\4AjaxForm|a:1:{s:32:\"291c11c4afbeb084e698fe6e82e4f004\";a:14:{s:4:\"form\";s:5:\"form2\";s:7:\"snippet\";s:6:\"FormIt\";s:12:\"frontend_css\";s:29:\"[[+assetsUrl]]css/default.css\";s:11:\"frontend_js\";s:27:\"[[+assetsUrl]]js/default.js\";s:9:\"actionUrl\";s:24:\"[[+assetsUrl]]action.php\";s:12:\"formSelector\";s:9:\"ajax_form\";s:10:\"objectName\";s:8:\"AjaxForm\";s:5:\"hooks\";s:5:\"email\";s:12:\"emailSubject\";s:43:\"\320\241\320\276\320\276\320\261\321\211\320\265\320\275\320\270\320\265 \321\201 \321\201\320\260\320\271\321\202\320\260 Art Events\";s:7:\"emailTo\";s:24:\"[email protected]\";s:8:\"emailTpl\";s:12:\"form2-report\";s:8:\"validate\";s:29:\"name:required, phone:required\";s:22:\"validationErrorMessage\";s:77:\"<p>\320\237\321\200\320\276\320\262\320\265\321\200\321\214\321\202\320\265 \320\277\321\200\320\260\320\262\320\270\320\273\321\214\320\275\320\276 \320\273\320\270 \320\267\320\260\320\277\320\276\320\273\320\275\320\265\320\275\321\213 \320\277\320\276\320\273\321\217</p>\";s:14:\"succe"..., 4191, MSG_DONTWAIT, NULL, NULL) = 1594 30602 13:47:54.905169 chdir("/var/www/php-bin/u0240056") = 0 30602 13:47:54.905232 setitimer(ITIMER_PROF, {it_interval={0, 0}, it_value={0, 0}}, NULL) = 0 30602 13:47:54.905287 umask(022) = 022 30602 13:47:54.905367 fcntl(3, F_SETLK, {type=F_UNLCK, whence=SEEK_SET, start=0, len=0}) = 0 30602 13:47:54.906015 sendto(6, "\1\0\0\0\1", 5, MSG_DONTWAIT, NULL, 0) = 5 30602 13:47:54.906201 close(6) = 0 30602 13:47:54.907046 write(5, "\1\6\0\1\1\f\4\0Status: 401 Not Authorized\r\nX-Powered-By: PHP/5.6.36\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nContent-Type: application/json; charset=UTF-8\r\n\r\n{\"success\":false,\"code\":401}\0\0\0\0\1\3\0\1\0\10\0\0\0\0\0\0\0\0\0\0", 296) = 296 30602 13:47:54.907131 shutdown(5, SHUT_WR) = 0 30602 13:47:54.907188 recvfrom(5, "\1\5\0\1\0\0\0\0", 8, 0, NULL, NULL) = 8 1837,1 98 Возможно это последствие заражения вируснёй, которой у него на сайте всё ещё не мало, к примеру 13863ba2576726381f1adb819e19779d5850e65c45d973197dc8bf167b11e2f5 /var/www/u0240056/data/www/arteventsphuket.com/img/img.php 13863ba2576726381f1adb819e19779d5850e65c45d973197dc8bf167b11e2f5 /var/www/u0240056/data/www/arteventsphuket.com/manager/assets/modext/sections/security/access/policy/template/template.php 13863ba2576726381f1adb819e19779d5850e65c45d973197dc8bf167b11e2f5 /v