Evil Cookie

[xakep]

After visiting a site on hosted by Tripod, I noticed that the browser frame tried to change its color or blink. I back out of the site, and kept hearing my PC clicking as if someone was hitting "Enter" to execute a program.

CPU was being used to 100% capacity. Task manager showed only "LUBID" and the usual IE icon. I terminated the process (which was no longer a window).

(Next time I opened an IE window, I got hit with a non-control popup, and that it despite the Yahoo Blocker)

The CPU stopped working overtime. I do string search using "LUBID" and find this cookie with this evil-reading code. What does it do?

language="JavaScript">
<!--
// Cache-busting LUBID bug.
var ran = Math.round(Math.random() * 899999) + 100000;
var lubid_string = "<img src=\"http://hb.lycos.com/header?VID=5905&LHIG=1&ord=" + ran + "\" height=\"1\" width=\"1\">";
document.write(lubid_string);
//-->
</script>

<noscript><img src="http://hb.lycos.com/header?VID=5905&LHIG=1" height="1" width="1"></noscript>


<!--insite and popunder-->
<script language="javascript" type="text/javascript">
function showUnder(scale) {
	var expdate = new Date ();
	var surveyCookieName = "TRIPODPOPUNDER";
  var percentOfferedSurvey = 100;
  var surveyLocation = "/adm/popunder/tripod_popunder.html?"+"member_name=spookgroup&path=00/id8.html&client_ip=62.219.71.124&ts=1059380896&ad_type=EMBED&search_string=spooks+pearl+harbor&id=ddad408ede487bdda4481e767726eb37";
  var popupNewWindow = true;

 	 expdate.setTime (expdate.getTime() + (12 * 60 * 60 * 1000));
	var stored_value = GetCookie(surveyCookieName);
	if (stored_value == null){
  SetCookie(surveyCookieName, "under", expdate, "/", ".tripod.com");
  trUnder = window.open(surveyLocation,'under','height=300,width=720,toolbar=no,directories=no,status=no,menubar=no,scrollba
rs=no,resizable=no');
  trUnder.blur();
 	 }
}

function showInsite(){
	var expdate = new Date ();
	var surveyCookieName = "TRIPODINSITE";
  var percentOfferedSurvey = 100;
  var surveyLocation = "http://www.lycos.com/redir.asp?r=tp";
  var popupNewWindow = true;

 	 expdate.setTime (expdate.getTime() + (24 * 60 * 60 * 1000));
	var stored_value = GetCookie(surveyCookieName);
	if (stored_value == null){
  SetCookie(surveyCookieName, "insite", expdate, "/", ".tripod.com");
  trInsite = window.open(surveyLocation,'insite','height=340,width=790,toolbar=no,directories=no,status=no,menubar=no,scrollba
rs=yes,resizable=yes');
  trInsite.blur();
 	 }
}


function SetCookie (name,value,expires,path,domain,secure){
	document.cookie = name + "=" + escape (value) +
  ((expires) ? "; expires=" + expires.toGMTString() : "") +
  ((path) ? "; path=" + path : "") +
  ((domain) ? "; domain=" + domain : "") +
  ((secure) ? "; secure" : "");
}

function getCookieVal (offset){
	var endstr = document.cookie.indexOf (";", offset);
	if (endstr == -1)
  endstr = document.cookie.length;
	return unescape(document.cookie.substring(offset, endstr));
  }

function GetCookie (name){
	var arg = name + "=";
	var alen = arg.length;
	var clen = document.cookie.length;
	if( (document.cookie == null) || (document.cookie.length == null)){
  return null;
	}
	var i = 0;
	while (i < clen){
  var j = i + alen;
  if (document.cookie.substring(i, j) == arg)
 	 return getCookieVal (j);
  i = document.cookie.indexOf(" ", i) + 1