Obfuscated Script.b

Obfuscated Script.b is a heuristic detection for web scripts that crafted to prevent inspection of its malicious content.

Often, these obfuscated scripts contain exploits that target the web browser. In the wild, they have been last found to be targeting at least the following vulnerabilities:

• Microsoft Data Access Components (MDAC) Code Execution Vulnerability (Exploit-MS06-014)
• Microsoft XMLHTTP 4.0 ActiveX Control Vulnerability (Exploit-XMLCoreSrvcs)

As this is a heuristic detection, variants may exploit other vulnerabilities. These exploits are often hosted on hijacked websites which are normally legitimate. When script scanning is enabled, this detection blocks execution of the potential exploits.

Execution of malicious web scripts which often link to malicious servers to download further malware. Sometimes, they can cause the web browser to crash when an exploit is used to target a buffer overflow vulnerability and fails.

These obfuscated scripts are often hosted on hijacked websites which are normally legitimate. Typically, they are crafted to exploit web browser vulnerabilities to download and install further malware.

All Users:

Please use the following instructions for all supported versions of Windows to remove threats and other potential risks:

1.Disable System Restore .

2.Update to current engine and DAT files for detection and removal.

3.Run a complete system scan.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

1. Please go to the Microsoft Recovery Console and restore a clean MBR.

On windows XP:

Insert the Windows XP CD into the CD-ROM drive and restart the computer.
When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
Select the Windows installation that is compromised and provide the administrator password
Issue 'fixmbr' command to restore the Master Boot Record
Follow onscreen instructions
Reset and remove the CD from CD-ROM drive.