|
Posted by Ant on November 22, 2009, 10:20 am
If you were Registered and logged in, you could reply and use other advanced thread options
"nobody >" wrote:
> hxxp:/**/myguestbook.h1.ru/jeopardized.html
> I'm no js expert, all I know is how to spot it. Anyone here want to
> tackle it?
The script in the head element starts like this:
evf1=[112,99,97,99,116,...
All that does is set the window.location to kecacbt.cn which is a fake
pills site. No malware involved as far as I can tell. The rest of the
page is just ad-click stuff.
|