Membership is FREE – with unlimited access to all features, tools, and discussions. Premium accounts get benefits like banner ads and newsletter exposure. ✅ Signature links are now free for all. 🚫 No AI-generated (LLM) posts allowed. Share your own thoughts and experience — accounts may be terminated for violations.

Help Needed

Status
Not open for further replies.
Joined
Mar 23, 2005
Posts
1,128
Reaction score
19
My computer has been playing up for a few weeks and today I found that all web pages have the following, in the source code:

<script language='javascript' src='http://127.0.0.1:1025/js.cgi?pca&r=18598'></script>

has anyone come across this before?



Paul




Breakdown Cover
 
Last edited:
Port 1025 is Microsoft Remote Procedure Call (RPC) service.
Currently inbound scans are likely RPC and LSA exploit attempts against the Windows, which by default should be blocked by your firewall. Ensure that your systems have the latest patches installed from Microsoft.

Outbound scans if occurring in volume should be considered an indication of a possible worm infection on the source computer and should be investigated.
 
Just guessing, but perhaps look for and delete (rename) anything called js.cgi on your machine, and check periodically if it pops up again?

-aqls-
 
Thanks all for the replies.

FisherMan I think you are right it started about the time I installed zonealarm, and the link you posted describes exactly what I am seeing.

Anyone else hear using zonealarm? and if so, do you see the same thing when you view the source of any web page?

Thanks

Paul
 
Hi Grant

yes does seem strange, I can only guess it's a problem with my machine. Here's the first few lines of source code from DomainPrices.co.uk as I see it:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<title>Domain Name Sales Prices from DomainPrices.co.uk</title>
<meta name="description" content="Domain Sales values for UK Domain Names. Domain Prices lists all publically know domain sales in the UK market. Use this information to find out how much your website address is worth.">
<meta name="keywords" content="Domain Name Sales Prices, domain sales, domain name sales, co uk, internet address, internet addresses, company names, domain value, domain appraisal, sedo, sedopro, namedrive, domain name parking">
<link rel="stylesheet" type="text/css" href="acorndomains.css" />



<script language='javascript' src='http://127.0.0.1:1025/js.cgi?pca&r=25734'></script>

<script>
<!--
function land(ref, target).....................



and the last few lines

........................</div>
</body>
</html>
<script language='javascript'>postamble();</script>


I guess you see the same but without the highlighted bit?
 
Did you see the link I posted above. The code links to the file on your pc that zonealarm uses to filter out advertising etc. on web pages so I assume you must have some of the ad blocking options turned on.

Grant
 
turned mine off now and rebooted my machine.

Still seeing the code at the top of the page but the code at the bottom has now gone.

I guess it must be to do with another setting and nothing too much to worry about

Thanks for your help Grant. :)
 
Status
Not open for further replies.

Rule #1: Be Respectful

Do not insult any other member. Be polite and do business. Thank you!

Premium Members

New Threads

Domain Forum Friends

Lastest Listings

Our Mods' Businesses

*the exceptional businesses of our esteemed moderators
General chit-chat
Help Users
  • No one is chatting at the moment.
  • Siusaidh AcornBot:
    Siusaidh has left the room.
      Siusaidh AcornBot: Siusaidh has left the room.
      Top Bottom