Trojan.JS.NoClose.q is a Russian JavaScript trojan based on Trojan.JS.Offiz.


Servers can be compromised by installing infected chat scripts that also contain a file called "cool_crash.html" in the WWW directory. Installing the software then cause the server to also install the file to the main directory of the web server. Upon visting a compromised URL the trojan will activate.


If activated, the trojan will resize the browser window and display two banners with flashing colors with the YouAreAnIdiot flash animation in the middle. The window then begins to move around and resize violently. If the user tries to press Alt+F4 or Ctrl+Alt+Del a javascript alert pops up with a text that reads "You are an idiot!". When the user tries to close the page, it will spawn more popups. Trying to close the popups more then two or three times will most likely cause the computer to freeze or crash.

There are also modified versions of this trojan that will immediately spawn unlimited popups when the site loads causing the computer to freeze or crash after some seconds.

The trojan did not widely spread since antiviruses had their databases updated and began to detect the file, however there are still some compromised forums/chats online.


Links: (Infected chat software containing the file, for research purposes only.) (Compromised Russian sports forum)