[ale] javascript Virus

[Jim Popovitch]

On Fri, 2005-05-27 at 09:11 -0400, Dow Hurst wrote:
> I don't know Javascripting at all but how does this work?  I would like 
> to know how to see that this is dangerous but it looks like gobbledegook 
> to me.  There is no IP given nor filename to download?


WARNING: DO NOT VISIT THE SITES IDENTIFIED BELOW WITH A MICROSOFT
WINDOWS PC.

The gobbledegook is "ASCII encrypted" code that downloads an initial
java file from h--p://81.222.131.59/dl/adv737.php.  That file then
downloads Win32 files from h--p://69.50.177.102/x155/ind.php, and
ultimately h--p://69.50.177.102/x155/count5.htm.  In the end you have
(what I think is) Troj/Bumaf-F virus installed on your Windows PC
(http://www.sophos.com/virusinfo/analyses/trojbumaff.html)



-Jim P.