Avast WEBforum

Other => Viruses and worms => Topic started by: gyoung86 on May 20, 2010, 10:37:36 AM

Title: JS:Pdfka-gen problem
Post by: gyoung86 on May 20, 2010, 10:37:36 AM

I have page on a site that is displaying a warning for malware

hxxp://www.proni.gov.uk/introduction__templehouse_papers_mic597.pdf

Could anyone else give it a look and see if they are getting the same warning?

Thanks

Title: Re: JS:Pdfka-gen problem
Post by: JuninhoSlo on May 20, 2010, 10:46:53 AM

Quote from: gyoung86 on May 20, 2010, 10:37:36 AM

I have page on a site that is displaying a warning for malware

hxxp://www.proni.gov.uk/introduction__templehouse_papers_mic597.pdf

Could anyone else give it a look and see if they are getting the same warning?

Thanks

Yes I get the same warning Plz change http:// to hxxp://

Title: Re: JS:Pdfka-gen problem
Post by: Asyn on May 20, 2010, 11:26:51 AM

Quote from: JuninhoSlo on May 20, 2010, 10:46:53 AM

Yes I get the same warning Plz change http:// to hxxp://

You also, please..!! (in the quotation)
asyn

Title: Re: JS:Pdfka-gen problem
Post by: gyoung86 on May 20, 2010, 11:36:53 AM

An solutions on how to remove this?

I'm the website hoster for them

Title: Re: JS:Pdfka-gen problem
Post by: Yanto.Chiang on May 20, 2010, 12:44:45 PM

Quote from: gyoung86 on May 20, 2010, 10:37:36 AM

I have page on a site that is displaying a warning for malware

hxxp://www.proni.gov.uk/introduction__templehouse_papers_mic597.pdf

Could anyone else give it a look and see if they are getting the same warning?

Thanks

Hi,

From the result this link is safe referenced to :

http://safeweb.norton.com/report/show?url=http://www.proni.gov.uk/introduction__templehouse_papers_mic597.pdf&x=0&y=0

http://www.unmaskparasites.com/security-report/

http://www.mywot.com/en/scorecard/www.proni.gov.uk

But from avast scanner got :

avast! [User]: File "http://www.proni.gov.uk/introduction__templehouse_papers_mic597.pdf" is infected by "JS:Pdfka-gen [Expl]" virus.
"%3" task used
Version of current VPS file is 100520-0, 05/20/2010

Need to revealer the script is it real infected or FP?

cheers,

Title: Re: JS:Pdfka-gen problem
Post by: polonus on May 20, 2010, 02:35:06 PM

Hi Yanto.Chiang,

Can you make the last link in your posting non-clickable, putting hxtp://etc. for people that visit without protection could get infected....
Re: http://scanner.novirusthanks.org/file/f36a62c9f20a9b327cbf4c40c8bda205/aW50cm9kdWN0aW9uX190ZW1wbGVob3VzZV9w/    does not give a detection...
Linkscanner dtects: Congratulations!
 LinkScanner® Online did not find any exploits.
 Scanned: Thursday, May 20, 2010
Scanning with DrWeb url checker:
Checking: htxp://www.proni.gov.uk/introduction__templehouse_papers_mic597.pdf
Engine version: 5.0.2.3300
Total virus-finding records: 1339409
File size: 220.39 KB
File MD5: f36a62c9f20a9b327cbf4c40c8bda205

hxtp://www.proni.gov.uk/introduction__templehouse_papers_mic597.pdf - archive PDF
hxtp://www.proni.gov.uk/introduction__templehouse_papers_mic597.pdf - Ok
 
polonus

 

Title: Re: JS:Pdfka-gen problem
Post by: Pondus on May 20, 2010, 02:46:31 PM

Quote

Can you make the last link in your posting non-clickable, putting hxtp://etc. for people that visit without protection could get infected....

You mean the same link you also posted clickable......Polonus... ;D.......

Title: Re: JS:Pdfka-gen problem
Post by: DavidR on May 20, 2010, 03:20:14 PM

Downloaded and scanned hxxp://wxw.proni.gov.uk/introduction__templehouse_papers_mic597.pdf using avast right click scan and no alert.

Title: Re: JS:Pdfka-gen problem
Post by: polonus on May 20, 2010, 03:35:18 PM

Hi Pondus,

Yes, as it now appears clean, but I corrected...

polonus