Looks like your site was compromised along with several hundred others in the last day or so.<br><br>A full account is up on <a href="http://blog.trendmicro.com/e-commerce-sites-invaded/">http://blog.trendmicro.com/e-commerce-sites-invaded/
</a> but the JS you posted is the exact same as the one used in those attacks. I'm guessing you have Javascripts embedded in your pages that pointed to a randomly named js in the same directory, right?<br><br>Robert McArdle
<br>-- <br><a href="http://www.RobertMcArdle.com/blog/">www.RobertMcArdle.com/blog/</a> - Techie/Security/Inane Ramblings<br><br><div class="gmail_quote">On Jan 13, 2008 4:01 PM, crazy frog crazy frog <<a href="mailto:i.m.crazy.frog@gmail.com">
i.m.crazy.frog@gmail.com</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Hi,<br><br>Recently on opening one of my site,my antivirus pops up saying that it
<br>has found on malicious script.the url is random and i have managed to<br>get tht <a href="http://script.it" target="_blank">script.it</a> is using some flaw in apple quick time.<br>u can get the zip file for java script here:
<br><a href="http://secgeeks.com/what.zip" target="_blank">http://secgeeks.com/what.zip</a><br>password is 12345<br>can somebody guide/help me what is this and how can i remove it?<br><font color="#888888"><br>--<br>advertise on secgeeks?
<br><a href="http://secgeeks.com/Advertising_on_Secgeeks.com" target="_blank">http://secgeeks.com/Advertising_on_Secgeeks.com</a><br><a href="http://newskicks.com" target="_blank">http://newskicks.com</a><br></font></blockquote>
</div><br><br clear="all"><br><br>