(Script files attached.)
I'm running the latest Drupal 6.11 and have kept my mods up to date.
I became suspicious that I had been hacked upon looking at my AdSense revenue, which was ridiculously low. First I looked at my page's source code and this popped out immediately:
<script type="text/javascript" src="/files/js/90afcd67b58d11e5db8ece85b39ac672.js"></script>
So I poked around and what I found in /files/js were a bunch of encrypted jquery.js files instead of one jquery.js file. (Are these generated on the fly somehow?) When I look at the files, some of them have the p.a.c.k.e.r. function (see attached) which I guess is supposed to be there.
and some have this weird thing (see attached)
I have no idea what that's all about but it doesn't look right.
Not sure if Drupal allowed this or if I have some kind of ftp sniffer on my computer. Clamscan didn't turn up anything.
| Comment | File | Size | Author |
|---|---|---|---|
| packer.txt | 30.11 KB | CharlieHipHop | |
| weird_script.txt | 54.29 KB | CharlieHipHop |
Comments
Comment #1
dawehnerits a feature, its called javascript aggregation and can be changed at admin/settings/performance
its good that its packed like this.
the p.a.c.k.e.r is the default jquery.js of drupal wihtout comments
Comment #2
stevenpatz