Avast WEBforum

Other => Viruses and worms => Topic started by: stephenr on August 04, 2011, 05:17:42 PM

Title: Trojan Horse Blocked :-JS:IFrame-CG [Trj]
Post by: stephenr on August 04, 2011, 05:17:42 PM

Hi,

I have just came back from holiday to find my websites with the above problem so I cannot see the websites I have. The main url, hxxp://www.izzy-wizzy.com has the directory listing but none of the folders off it load in either Firefox or IE. My wife's PC can see them perfectly well but she uses AVG Anti Virus. I have no problem with other websites.

Any suggestions?

thanks and regards,

Stephen

Title: Re: Trojan Horse Blocked :-JS:IFrame-CG [Trj]
Post by: Pondus on August 04, 2011, 05:22:22 PM

sorry but your website is hacked....
Sucuri sitecheck   http://sitecheck.sucuri.net/scanner/

See Sceenshot (click to enlarge)


malware info: http://sucuri.net/malware/malware-entry-mwiframehd203


VirusTotal - URL scan
http://www.virustotal.com/url-scan/report.html?id=585a07dc6927dfe20f29297d31f7843a-1312463291

Title: Re: Trojan Horse Blocked :-JS:IFrame-CG [Trj]
Post by: stephenr on August 04, 2011, 06:31:28 PM

Thanks for the reply. I don't understand the results of what was posted. What can I do to identify what exactly the problem is and how do I fix the problem?

thanks,
 
Stephen

Title: Re: Trojan Horse Blocked :-JS:IFrame-CG [Trj]
Post by: Pondus on August 04, 2011, 06:38:44 PM

Not sure......well...the sucuri scanner say Malware found in the URL:

hxxp://wxw.broadfieldbkp.co.uk/404testpage4525d2fdc
hxxp://wxw.broadfieldbkp.co.uk/www.broadfieldbkp.co.uk
hxxp://wxw.broadfieldbkp.co.uk/404.shtml

did you put those urls there ?

Title: Re: Trojan Horse Blocked :-JS:IFrame-CG [Trj]
Post by: Pondus on August 04, 2011, 06:53:01 PM

Information for Website Owners  http://stopbadware.org/home/webmasters

Tips for Cleaning & Securing Your Website http://stopbadware.org/home/security

Have a single site with malware?, Do you need to have a website quickly cleaned and removed from blacklists? We have you covered. http://sucuri.net/signup

Title: Re: Trojan Horse Blocked :-JS:IFrame-CG [Trj]
Post by: polonus on August 04, 2011, 08:03:14 PM

SOSWebscan gives the site clean, DrWeb gives it cleanm because it does not scan all
the deeper links Malware found in the URL:
-http://www.broadfieldbkp.co.uk/404testpage4525d2fdc

Malware found in the URL:
-http://www.broadfieldbkp.co.uk/www.broadfieldbkp.co.uk

Malware found in the URL:
-http://www.broadfieldbkp.co.uk/404.shtml - HTTP Error 404: Not Found
:
Checking: -http://www.izzy-wizzy.com/
Engine version: 5.0.2.3300
Total virus-finding records: 2447191
File size: 365 bytes
File MD5: df8cee1987fcf67e8abf4042b9c3c52f

-http://www.izzy-wizzy.com/ - Ok

Anubis report: http://anubis.iseclab.org/?action=result&task_id=1b4fff480d16db6a4b94f4ad6f4b150c9&format=html   

But there was a malicious script found through the redirect link to
http://www.google.com/safebrowsing/diagnostic?site=www.broadfieldbkp.co.uk
See for malicious activities: http://sitevet.com/db/asn/AS11798
Malware found in the URL e.g.:
-http://www.broadfieldbkp.co.uk/404testpage4525d2fdc
See: http://sucuri.net/malware/malware-entry-mwiframehd203

polonus

Title: Re: Trojan Horse Blocked :-JS:IFrame-CG [Trj]
Post by: stephenr on August 04, 2011, 09:01:53 PM

Thanks for the pointers. I'll start with a full scan tonight and work through my sites.

cheers,

Stephen

Title: Re: Trojan Horse Blocked :-JS:IFrame-CG [Trj]
Post by: stephenr on August 05, 2011, 10:27:54 AM

The scan revealed 4 adware/malware gen things that Avast moved to the chest.

Another threat Ricsi-831 is identified with d:\pagefile.sys which can't be repaired. I tried to move to chest but the isn't enough space; it's 786 Meg. Any ideas how I can sort this?

My websites seem to be working correctly now and given clean status by Sucuri.

thanks and regards,

Stephen

Title: Re: Trojan Horse Blocked :-JS:IFrame-CG [Trj]
Post by: polonus on August 05, 2011, 01:56:37 PM

Delete all files that are detected as Ricsi.806. Deleted files will have to be either replaced from a clean backup or reinstalled. How to delete the Pagefile.sys File can be read here:
http://support.microsoft.com/kb/255205/en

polonus