Author Topic: Help decode strange script file  (Read 3180 times)

0 Members and 1 Guest are viewing this topic.

October 22, 2009, 07:07:03 pm
Read 3180 times

securefire

  • Newbie

  • Offline
  • *

  • 1
I ran across this and have no idea what it is.
Can anybody tell me how to decode this?  Is it malicious?

hxxp://www.killerstartups.com/inc/adsensev2.js

 ???

October 22, 2009, 07:30:03 pm
Reply #1

y0liny

  • Newbie

  • Offline
  • *

  • 5
ROD, BLESS!

October 22, 2009, 07:37:16 pm
Reply #2

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
It's not malicious, but highly obfuscated.

Find decoded script attached. PW: "infected".

Explaining in detail how to decode might take a bit long.

Here are the steps:

-put it into Malzilla's decoder window
-click on "Templates" and choose any browser (navigator)
-run script
-choose the second eval result
-copy the output (bottom window) into clipboard
-replace "____    (O000);" with content of clipboard in top window
-replace "eval  (O0O0)" by "var naa=true;"
-run script
-that's it.  ;D
Ruining the bad guy's day