Again avast! Webshield right on top JS:Iframe-DKG[Trj]

Viruses and worms
1

https://www.virustotal.com/nl/url/d7d5b44657d2d2f1c63f41879100a70a170b773449ea837e6d54bd1e9025312a/analysis/1413156677/
and https://www.virustotal.com/nl/file/510f51f831936fd4e6415ab0e3be64c678d874162851a6e4c5d93909ded7093d/analysis/1413065992/
Quttera does not get any further as a blacklisting: http://quttera.com/detailed_report/rhinotransportation.net
2 domains blacklisted - rhinotransporter dot com & rhinotransportation dot net
VirusTracker classification: rhinotransporter.com,97.74.55.1,ns49.domaincontrol.com,Criminals,
rhinotransportation.net,97.74.55.1,ns49.domaincontrol.com,Criminals,

Damian

2

Important additional info for webmaster has been found here on /js/jquery-1.3.2.min.js
can be found here: http://www.solvusoft.com/en/files/error-missing-download/js/windows/microsoft/msdn-disc-5003-02/jquery-1-3-2-min-js/ link article by Jay Geater, IT expert.

The necessity of extended scanning has been demonstrated here again.

Now the errors “our scanned code” encountered as flagged by jsunpack:
nothing detected] rhinotransportation dot net/contact/js/jquery-1.3.2.min.js
status: (referer=htxp:/wXw.ask.com/web?q=puppies)saved 65312 bytes cecd8fb127b0f1ec48585eebcf4b845e1dd749f5
info: ActiveXDataObjectsMDAC detected Microsoft.XMLHTTP
info: [decodingLevel=0] found JavaScript
error: line:3: SyntaxError: invalid flag after regular expression:
error: line:3: filter(function(){return this.name&&!this.disabled&&(this.checked||/select|textarea/i.test(this.nodeName)||/text|hidden|password|search/i.test(this.type))}).map(function(E,F){var G=o(this).val();return G==null?null:o.isArray(G)?o.map(G,function(I,H){retur
error: line:3: ^
error: undefined function T.insertBefore
error: undefined variable T
info: Decoding option navigator.systemLanguage=en and navigator.systemLanguage=zh-cn and browser=IE7/XP and browser=IE8/Vista and browser=Opera and browser=Firefox, 0 bytes
info: Decoding option navigator.systemLanguage=en and navigator.systemLanguage=zh-cn and browser=IE7/XP and browser=IE8/Vista and browser=Opera and browser=Firefox, 73 bytes
info: [element] URL=rhinotransportation dot net/contact/js/undefined
info: [1] no JavaScript
file: cecd8fb127b0f1ec48585eebcf4b845e1dd749f5: 65312 bytes
file: 39a80018ecfa38a1d406eb36b0b58906a77b7db3: 73 bytes

Re: http://jsunpack.jeek.org/?report=25193b04553c4b413505bb0222b55d3cbb3a63e5
For security researchers only, open above link with NoScript active and in a VM (sandbox).

polonus

3

The errors and insecurities and the "Invalid Regular Expression-error here are browser dependent, a browser coding JavaScript for a particular browser engine could encounter insecurities in other browsers.
The ins and outs of this are treated here by Tom McFarlin in this article on that subject: https://tommcfarlin.com/invalid-regular-expression-flag/

If regular expressions are the argument accepted in a function signature, then that’s the one you’ve gotta use
We already encounter a lot of cross browser scripting that kicks up no source and sinks with an XSS scan or produces invalid code even. In main coding things may be OK rather than in third party coded plug-ins and themes. Coding with security in mind should have a first priority.

polonus