How a website Trojan disguises itself
What a Website Trojan Script may look like
<SCRIPT>
<!--
// NOTE I have replaced the jumbled string below with a harmless one
var a='';var b='wweeew323 oeDISABLED5b54o4o3boo3o3o3oi34oji34oji34o3jio3o3';for(var i=0;i<15;i++) for(var j=0;j<10;j++) a+=b.charAt((parseInt(c.charAt(j))*15)+i);document.writeln(unescape(a)); -->
</SCRIPT>
You will most likely find it at the bottom of your page eg index.html,index.php
It uses JavaScript to decode the encrypted string which contains the URL of the trojan. What is doubly clever is that when you try and search for the Trojan by looking for the url of the Trojan which has been revealed by your virus detector either by viewing the source or downloading by FTP you will not find it.
What's more when you try and virus check the downloaded site your virus checker will be unable to spot the Trojan!
Labels: trojan, trojan detection, trojan encryption
