Encrypted javascript, or what?

[gaff]

Hello,

I downloaded a Wordpress theme. In the header.php document I ran across the following code:

<script language="JavaScript" type="text/javascript">var i,y,x="3c6469762069643d22777261707065722220636c6173733d2266697822203e0d0a093c64697620636c6173733d22706167656c696e6573706f73206e61762d69636f6e223e3c6120636c6173733d22706167656c696e65732220687265663d22687474703a2f2f7777772e7769636b65642d776f726470726573732d7468656d65732e636f6d223e3c3f706870206563686f20706167656c696e65732827637265647465787427293b3f3e3c2f613e3c2f6469763e0d0a202020203c6469762069643d226865616465722220636c6173733d22666978223e0d0a0909";y='';for(i=0;i<x.length;i+=2){y+=unescape('%'+x.substr(i,2));}document.write(y);
</script>

Is this some sort of encryption? If so, is there any way to encrypt the script and find out exactly what it says/means?


// gaff

[Dormilich]

sure, that "encoding" (well, rather an obfuscation) is percent escape stripped off the % signs, easily recognisable by the clear text code at the end.

[acoder]

Yep, change

document.write(y);

to

alert(y);

[gaff]

Thank you guys for your help. It worked fine.

[n00bies]

Hello, I have a similar problem - how do I go about fixing this? (sorry I'm new so any step by step directions would be greatly appreciated!)

Is this very malicious or just posts a link?

[Dormilich]

obfuscated code tends to be either annoying or malicious.