Favicon.ico javascript trojan - what does it do?

Question

Nod32 just warned me about a trojan which is embedded into a favicon.

I've copied the content of the favicon.ico here: http://pastebin.com/BkD4tKNy

Unfortunately I'm not really experienced with Javascript and the code looks very cryptic to me. Can anyone say what harm this code doing?

Thanks & kind regards

Answer 1

It looks cryptic because the code is intentionally obfuscated.

The actual name of the trojan is W32/Lipler.Gen. It downloads and executes malicious code, which is whatever the person infecting you wants to execute on your machine.

You can read more about it here: http://www.f-secure.com/v-descs/trojan-downloader_w32_lipler_gen.shtml