Avast WEBforum

Other => Viruses and worms => Topic started by: true indian on May 15, 2012, 10:27:24 AM

Title: mcafee goes insane?
Post by: true indian on May 15, 2012, 10:27:24 AM

instance found here...avast alerted me on mcafee site:Link removed

http://zulu.zscaler.com/submission/show/1b7a973b6a1e11aa553ad7cca9ebdbd7-1337082116

Title: Re: mcafee goes insane?
Post by: true indian on May 15, 2012, 02:13:34 PM

Not reproducable....was able to do it once with IE  and and once with chrome

works only once i guess....go here first:
hxtp://home.mcafee.com/virusinfo/threat-activity

Then place your mouse on those virus names until the tooltip comes up for it and keep moving  on different ones and u will see a alert by avast for one of them

Title: Re: mcafee goes insane?
Post by: Pondus on May 15, 2012, 02:59:45 PM

So, your topic title is wrong then.......it is not McAfee that goes insane.  ::)

Title: Re: mcafee goes insane?
Post by: polonus on May 15, 2012, 04:09:57 PM

Have to go into some trouble trying to reconstruct from the conflicting scan results - bytesize do not match at all for the two...
The representation of this is completely wrong. As seen from the IP info for the Zscaler Zulu scan the IP concerned denotes an obscure searchengine result here: hxtp://www.kmle.co.kr/search.php?Search=mm+virus&SpecialSearch=HTMLWebHtdig&Page=3 IP = 161.69.12.12
The other to a site: htxp://reverseinternet.com/domain/clinic.mcafee.com  where the url resolves to an invalid IP address.
Wonder whether the two scan results really match?

polonus

Title: Re: mcafee goes insane?
Post by: true indian on May 15, 2012, 05:51:23 PM

hxtp://home.mcafee.com/virusinfo/threat-activity

The alert took place when i was on the above site....when i placed the mouse pointer on one of the list name i got the alert on tooltip of the link

Title: Re: mcafee goes insane?
Post by: true indian on May 15, 2012, 05:54:07 PM

Here is the info from avast web shield log from programdata folder:

15-05-2012 16:41:05   hxxp://home.mcafee.com/WebServices/VirusInfoWebSvc.asmx/GetVirusInfoTooltip [L] JS:ScriptSH-inf [Trj] (0)

Title: Re: mcafee goes insane?
Post by: true indian on May 15, 2012, 06:13:18 PM

i was able to re-produce it again..... I just went here:
[Link removed]
started placing my mouse pointer on each virus name from the bottom of list and i got the alert on one of them.

Title: Re: mcafee goes insane?
Post by: polonus on May 15, 2012, 07:37:43 PM

Break that link asap, there is a malcious iFrame there: : [iframe] home.mcafee dot com/ScriptResource.axd?d=LV-CfaVg0Uc9 etc. etc.  MD5 crack code,

polonus

Title: Re: mcafee goes insane?
Post by: true indian on May 16, 2012, 09:24:10 AM

Thanks! for the confirmation polonous!  ;D