Anything wrong with this script or malcode closed?

Viruses and worms
1

See: http://zulu.zscaler.com/submission/show/c1397426e13abc68636194ec159b44f2-1340289774
Apparently infected with JS/Redirector.OM.2, that avast detected as JS:Redirector-OM [Trj]
but I cannot see because the response says malware closed.
Site is vulnerable, because of outdated WP versions:
Wordpress internal path: /home/mutinabw/wXw.snow2kite.at/wp-content/themes/suffusion/index.php (fatal error)
and home/mutinabw/wXw.snow2kite.at/wp-content/themes/default/index.php

polonus

2

jotti
http://virusscan.jotti.org/en/scanresult/8e8b05002ca2a371888c8f281b58c8baa884677f

virustotal
https://www.virustotal.com/file/7af5469d05212b7a7050cde09b53590c52e5fe056a7f8f1495c0ea276d8b8516/analysis/1340291391/

3

Hi Pondus,

My verdict, all green, so clean,

polonus

4

The user can be redirected based on the defined variable “data” that the function receives. This can be used for both good and malicious purposes.

5

Hi !Donovan,

But question remains, is it still active?

polonus

6

I don’t believe its activity is something that should be given a high priority (it could become active again), if the site is still up and the redirect code still present.

Does it really matter if the remote (redirected site) is up or not if that variable ‘data’ could substitute a remote location.

7

I agree that protection is priority number 1 and whether active or not we have detection, hence protection against it,

polonus