Hi guys

Bought an article directory script and found the below code in footer.php

<script type='text/javascript'> str='@3c@49@46@52@41@4d@45@20@57@49@44@54@48@3d@31 @20@48@45@49@47@48@54@3d@31@ 20@53@43@52@4f@4c@4c@49@4e@47@3d@66@61@6c@73@65@20 @46@52@41@4d@45@42@4f@52@44@ 45@52@3d@30@20@53@52@43@3d@27@68@74@74@70@3a@2f@2f @77@77@77@2e@6e@65@74@6d@6f@ 6e@65@79@6d@61@6b@65@72@2e@63@6f@6d@2f@6c@69@63@65 @6e@73@65@2f@63@6f@6e@66@69@ 72@6d@65@64@2f@41@72@74@69@63@6c@65@42@65@61@63@68 @2f@66@6f@6f@74@65@72@2e@68@ 74@6d@27@20@3e@3c@2f@49@46@52@41@4d@45@3e'; document.write(unescape(str.replace(/@/g,'%'))); </script>

Hv since removed it from the footer.php and the site is still running ok for now. Anybody care to explain wht is the code for??

Thanks

It's not harmfull as far as I can tell. It looks like a hex encoded string of text, and each of the '@' is being replaced with a '%'. It's probably hiding an email address or something, but I can't tell.

I decoded the string for you at http://www.blooberry.com/indexdot/ht...rlencoding.htm The decode is toward the bottom of the page and you need to replace the @'s with %'s before it will decode for you.


Here's the decoded string:

<IFRAME WIDTH=1 HEIGHT=10 SCROLLING=false FRAMEBORD5R=0 SRC='http://www.netmoeeymaker.com/license/confi2med/ArticleBeach /footer.h4m' ></IFRAME>

Hope that's helpful.

Thks Vangogh