Fandom

Malware Wiki

Trojan.JS.NoClose.q

1,321pages on
this wiki
Add New Page
Comments0 Share

Trojan.JS.NoClose.q is a Russian JavaScript trojan based on Trojan.JS.Offiz.

Activation Edit

Servers can be compromised by installing infected chat scripts that also contain a file called "cool_crash.html" in the WWW directory. Installing the software then cause the server to also install the file to the main directory of the web server. Upon visting a compromised URL (Example: Legitforum.ru/cool_crash.html) the trojan will activate.

Payload Edit

If activated, the trojan will resize the browser window and display two banners with flashing colors with the YouAreAnIdiot flash animation in the middle. The window then begins to move around and resize violently. If the user tries to press Alt+F4 or Ctrl+Alt+Del a javascript alert pops up with a text that reads "You are an idiot!". When the user tries to close the page, it will spawn more popups. Trying to close the popups more then two or three times will most likely cause the computer to freeze or crash.

There are also modified versions of this trojan that will immediately spawn unlimited popups when the site loads causing the computer to freeze or crash after some seconds.

The trojan did not widely spread since antiviruses had their databases updated and began to detect the file, however there are still some compromised forums/chats online.

References Edit

Links:

http://workupload.com/file/z9RWDkH (Infected chat software containing the file, for research purposes only.)

http://5rub.ucoz.ru/cool_crash.html (Compromised Russian sports forum)

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.