This question:

Can Someone Tell Me Why This Is malicious..?

someone has pasted code that (at a minimum) makes my ESET AV shut down my connection. Can someone with an appropriate sandbox edit that out?

  • 3
    Do you mean... you actually ran that payload? – Frédéric Hamidi Nov 9 '12 at 18:12
  • 1
    No, just browsing to the page set off ESET. – Joe Nov 9 '12 at 18:17
  • 2
    Some antivirus software is particularly stupid when it comes to stuff like that; it doesn't realize that the code won't actually be executed, it just sees it coming in over the network and panics – Michael Mrozek Nov 9 '12 at 18:20
  • 1
    The angle brackets of the <script> tags are escaped, and the content resides in <pre><code>. Quite a paranoid tool indeed. – Frédéric Hamidi Nov 9 '12 at 18:21
  • 1
    Stupid NOD32. :( – Joe Nov 9 '12 at 18:26
  • @MichaelMrozek it's just trying to be there for you, man. What if you were running Opera? – Pops Nov 9 '12 at 19:15
  • @Pop, ah, sorry for my now defunct comment, those were indeed escaped <form> tags. Let's hope they at least handled escaped <script> tags in their unit tests. – Frédéric Hamidi Nov 9 '12 at 19:19