Avast WEBforum

Other => Viruses and worms => Topic started by: Shalimar on June 11, 2010, 06:03:39 AM

Title: Trojan Horse Blocked=HTML IFrame
Post by: Shalimar on June 11, 2010, 06:03:39 AM

FYI...
About 45 minutes ago, I was searching "Tryit Editor" and from the search page, I clicked on a URL and my Avast 5.0 home edition alerted me, saying:
 Trojan Horse Blocked
  Infection: HTML IFrame - EP [Trj]
  (C programsx86MozillaFirefox...etc)
The URL I tried to connect to was aborted by Avast, and the URL is:
  hXXp//wXw.onlinesupportcentre.com/tickets/upload/media/resource636.htm

I went to the Unmask Parasites website and it showed:
 This page seems to be <suspicious>
 1 suspicious inline script found. 
 Google:  not currently listed as suspicious* 
The long suspicious script:
var e = "editor tryit";   function X(hu,p){if(!p){p='&I$u_+H]{8Qicj4oJ6-MUZt)|BVvLSrE@Fg,dOfe/p[7Alh....

I wanted to report it here to the Avast forum...for my two cents worth!

Title: Re: Trojan Horse Blocked=HTML IFrame
Post by: Pondus on June 11, 2010, 06:13:26 AM

VirusTotal - resource636.htm - 10/41
http://www.virustotal.com/analisis/9e5309160378711d1836180c937e223df6495092a74cf28d95e0dde8eebee40a-1276229534

Title: Re: Trojan Horse Blocked=HTML IFrame
Post by: Sartigan on June 11, 2010, 05:36:28 PM

Web Of Trust™: Suspicious, see: http://www.mywot.com/en/scorecard/onlinesupportcentre.com

Title: Re: Trojan Horse Blocked=HTML IFrame
Post by: polonus on June 11, 2010, 11:18:29 PM

Hi malware fighters,

Also read about the threat of iFrame banner ads: http://www.secureworks.com/research/threats/iframeads/

example: as.adwave*com - URL: Forbidden
classified as dangerous: http://hosts-file.net/?s=64.135.77.110
malicious content: http://www.mywot.com/en/scorecard/as.adwave.com

polonus