Avast WEBforum

Other => Viruses and worms => Topic started by: REDACTED on July 16, 2018, 06:20:42 PM

Title: Infection JS Downloader FHY [Trj]
Post by: REDACTED on July 16, 2018, 06:20:42 PM

Visiting an online game site ( "probuilds dot net" if needed), I got a message saying that the site was blocked cause it was infected with JS Downloader - FHY [Trj].
Attached the screenshot of the infection.
I tried to scan immediatly with Avast and Malwarebytes resulting in no problems found.

Am I safe?

Title: Re: Infection JS Downloader FHY [Trj]
Post by: Pondus on July 16, 2018, 06:33:53 PM

Quote

Am I safe?

should be, avast blocked it    ;)

1 suspicious inline script found. >>  https://www.UnmaskParasites.com/security-report/?page=www.probuilds.net

It may also be a false positive
https://sitecheck.sucuri.net/results/www.probuilds.net/
https://www.virustotal.com/#/url/0dc163a48f86919162c9e18d1899c66d3c7b5cf19f68fb6404f8a571ae8151e0/detection

Title: Re: Infection JS Downloader FHY [Trj]
Post by: ccval77 on July 16, 2018, 06:41:49 PM

Having the same problem when i launch firefox pop up window is telling me program trying to access urls
moz-extension://08751000-378b-4e8d-87f8-6f8feb41f78d/applicatio.js
moz-extension://08751000-378b-4e8d-87f8-6f8feb41f78d/lib/core/avd-core.min.js
moz-extension://08751000-378b-4e8d-87f8-6f8feb41f78d/lib/core/avd-proto.min.js
Is AvastScv.exe

Title: Re: Infection JS Downloader FHY [Trj]
Post by: Hopper15 on July 16, 2018, 09:56:28 PM

Quote from: ccval77 on July 16, 2018, 06:41:49 PM

Having the same problem when i launch firefox pop up window is telling me program trying to access urls
moz-extension://08751000-378b-4e8d-87f8-6f8feb41f78d/applicatio.js
moz-extension://08751000-378b-4e8d-87f8-6f8feb41f78d/lib/core/avd-core.min.js
moz-extension://08751000-378b-4e8d-87f8-6f8feb41f78d/lib/core/avd-proto.min.js
Is AvastScv.exe

I use AVD as well and got the same alert as soon as I opened my browser.  I contacted AVD support they said they are aware of this situation.

Title: Re: Infection JS Downloader FHY [Trj]
Post by: Milos on July 17, 2018, 07:58:03 AM

Hello,
detection was disabled.

Milos

Title: Re: Infection JS Downloader FHY [Trj]
Post by: wolfgang.z on July 17, 2018, 09:28:54 AM

Hello,
i have the same problem when i log into my Online Banking mail box that this was detected, should i contact my Bank about this or is this mistake alarm?

Title: Re: Infection JS Downloader FHY [Trj]
Post by: Pondus on July 17, 2018, 10:20:22 AM

Quote from: wolfgang.z on July 17, 2018, 09:28:54 AM

Hello,
i have the same problem when i log into my Online Banking mail box that this was detected, should i contact my Bank about this or is this mistake alarm?

Try manual avast update and reboot .... still problem?

Title: Re: Infection JS Downloader FHY [Trj]
Post by: wolfgang.z on July 17, 2018, 11:42:58 AM

It suddenly stoped a little over an hour ago, so seems like its fixed.
Thanks

Title: Re: Infection JS Downloader FHY [Trj]
Post by: REDACTED on July 17, 2018, 04:00:16 PM

Quote from: Pondus on July 16, 2018, 06:33:53 PM

Quote

Am I safe?

should be, avast blocked it    ;)

1 suspicious inline script found. >>  https://www.UnmaskParasites.com/security-report/?page=www.probuilds.net

It may also be a false positive
https://sitecheck.sucuri.net/results/www.probuilds.net/
https://www.virustotal.com/#/url/0dc163a48f86919162c9e18d1899c66d3c7b5cf19f68fb6404f8a571ae8151e0/detection

Thanks for your help