asked on

What's <script language=3D"JScript.Encode"> ?

Hi,

I have encountered a particular spammer's email today (among thousands...), which ends with an encoded script:

<script language=3D"JScript.Encode">#@~^owAAAA=3D=3D~@#@&[Km!:+ YcADbYn`E@=
!(o"bHA~?"Z'r4OYa)JzdtC.=7FNRtKdYbxL (ky&sbxVR4OsVE,=7F&fK_'W*!,C3qVCPxWc!=
,oIzH2~6]fAI{!~?/]}SJqg!'rxGE,/Yzs=7F'ENbdaVCH) Wx=7Fir@*@!JqoIzH3@*E#i@#@=
&EC8AAA=3D=3D^#~@</script>

I have seen MS Jscript encoding <script language="JScript.Encode"> many times, but never <script language=3D"JScript.Encode">. I couldn't decode the script using scrdec15.exe or zwdecode.exe; thus won't risk running the codes. Could anyone enlighten me with what kind of encoding scheme this is and how could I decode it please?

Thanks.

ASKER CERTIFIED SOLUTION

ahoffmann

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

iuhh

ASKER

Many thanks ahoffmann, that makes perfect sense. But as I replaced all '=3D' to '=', and removed '=7F' along with the character immediately follows (as I understand, 7F is delete), I am still unable to decode this script fully - Incorrect checksum error from scrdec15. With zwdecode, I am just able to make out 'document.write', 'http://' and 'html' from the gibberish, so I'm guessing, it'll download an evil script from somewhere else and will save it to harddisk, possibly then execute the script.

I really want to get the bottom of this. Anything else I can do to straight this encoded text up? Thanks.

ahoffmann

} =7F
?

iuhh

ASKER

Thanks ahoffmann. I've tried replacing =7F with ' ', '', '?', '}' but still can't decode the script. What exactly does 'DEL' map to?

Cheers.

ahoffmann

sorry, I'm no M$ guru, you need to check your docs (they should be perfect, telling you all you need, I was told once ...)

What's &lt;script language=3D&quot;JScript.Encode&quot;&gt; ?

What's <script language=3D"JScript.Encode"> ?