[ale] javascript Virus

[Dow Hurst]

Thanks for the enlightenment!  Makes sense now that you've explained the 
encrypted ASCII!  Thanks for the careful explanation.
Dow


Jim Popovitch wrote:

>On Fri, 2005-05-27 at 09:11 -0400, Dow Hurst wrote:
>  
>
>>I don't know Javascripting at all but how does this work?  I would like 
>>to know how to see that this is dangerous but it looks like gobbledegook 
>>to me.  There is no IP given nor filename to download?
>>    
>>
>
>
>WARNING: DO NOT VISIT THE SITES IDENTIFIED BELOW WITH A MICROSOFT
>WINDOWS PC.
>
>The gobbledegook is "ASCII encrypted" code that downloads an initial
>java file from h--p://81.222.131.59/dl/adv737.php.  That file then
>downloads Win32 files from h--p://69.50.177.102/x155/ind.php, and
>ultimately h--p://69.50.177.102/x155/count5.htm.  In the end you have
>(what I think is) Troj/Bumaf-F virus installed on your Windows PC
>(http://www.sophos.com/virusinfo/analyses/trojbumaff.html)
>
>
>
>-Jim P.
>
>
>_______________________________________________
>Ale mailing list
>Ale at ale.org
>http://www.ale.org/mailman/listinfo/ale
>
>  
>