A neat Malicious Javascript Sniffer

[John K.]

I had a problem after I installed an MP3 and a WAV sound file into a couple of my Navigation Bars. Also I C&P's a tiny .ico file to use as my "top of page" marker. I got it off a GOOGLE search on their images engine.

I used these in my website and uploaded them to my public folder.

Suddenly, about 24 hours later, I was being warned by Kaspersky that Firefox and IE contained a link that steals passwords, etc. It told me that the item was a "pantscow.ru:8080/Readme.js" file.

So I did some research and stumbled upon this website:

http://jsunpack.jeek.org/dec/go?

All you have to do is enter your website URL and it will sniff out any bad code. I quote, "All Malicious or Suspicious Elements of Submission".

You can also download a .zip file that contains all the code in your website, and there is included, a decoded log in that .zip.

That is how I found out that the .ico was suspicious, as well as the two "button click" sound files. All three I had gotten off the Internet from free sites.

I found the files and right clicked on them and selected properties and down at the bottom, the security info said, "This file came from another computer and might be blocked to help protect this computer."

So I deleted these three items at all locations, and instantly no more popup warnings and everything is honky dory.

I guess that means I have to do a 100% check on any foreign item I add to my website. Please do not be harsh on me. It is so easy to use pictures and such by doing a simple C&P.

I would never have thought that malicious code would be written into the simplest things!

So, the malicious code that Kaspersky was warning me of is:
pantscow.ru:8080/Readme.js

The jsunpack tool ID'd them for me.

[zuriatman]

Re: A neat Malicious Javascript Sniffer

Thanks for sharing John K.

[John K.]

Re: A neat Malicious Javascript Sniffer

Thank you. I must have been sitting under the lucky star to make such a find, and experience that moment of awareness to this issue.

Another thing; I will now modify my web page build processes by doing the following:

Any Image I want, I will put into a separate folder.

Then, I will convert that image back into the same format, using any image viewer. This seems to erase any script from the original image once it is rewritten in the conversion process.

I did the right click, select properties thingy, and the original had the "protection" sentence; but after converting it to a new .jpg format, the warning was gone when I selected properties again.

Does that make sense?

Also, I will use the jsunpack for any images or animated GIF that may lose clarity or function. If it shows up "iffy" or worse, I will trash it and move on.

Paranoid? Heck yes! After having GOOGLE ban my site because of one of those "pain-in-the-neck" .ru scripts, I learned my lesson; Be careful and double check every foreign thing you add; even the tools you use to manipulate those foreign things". Scan them and verify their authenticity before putting them in that precious thing called your public html folder.