</head>
<body><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Net Search</title>
<meta name="keywords" content="net.net,search,web,search web,web search,engine,search engine">
<meta name="description" content="Search the Web">
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body>
<table cellpadding="0" cellspacing="0" border="0" align="center">
<tr>
<td>
<a href="[b]http://www.jdoqocy.com/tj82cy63y5LNSNPVVQLOOMOSQN"[/b] target="_top" onmouseover="window.status=[b]'http://affiliates.ebay.com[/b]';return true;" onmouseout="window.status=' ';return true;">
<img src="[b]http://www.yceml.net/0536/10369560-1.gif[/b]" width="800" height="600" alt="" border="0">
</a>
</td>
</tr>
</table>
</body>
</html><div id="container">
Most intresting parts highlighted.
1. This thing is probably supposed to replace a webpage, not get added into one.
2. It is remote code.
3. It makes it look like the link will lead to eBay, but it'll go to another domain.
4. Both those domains lead to one page:
http://www.cj.com/qksrv.jsp, the privacy policy of some add company. The WHOIS's also look similar.
5. The rest of the source ought to give the admins some idea what to look for and where, if this is done by HLP, and not by the host. It seems rather unlikely this is not within the SMF code, though, since there is definently SMF stuff above it.
