Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: wils1989 on June 22, 2012, 01:56:04 PM

Title: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: wils1989 on June 22, 2012, 01:56:04 PM
I'm new on here but would really appreciate anyone who is able to help/advise me. My Avast free anti-virus protection came up with a detection this morning when I went onto the John Lewis website, the details it gave me were that it had detected 'HTML:Iframe-QH [Trj]'

I don't have a clue what 'HTML:Iframe-QH [Trj]' is and have tried Googling it to no avail. Is my laptop infected? I'd appreciate any guidance. Thank you very much, Luke
Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: NuttyBoy on June 22, 2012, 02:13:06 PM
Getting the same error, now cannot order my 3DTV!!!!
Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: wils1989 on June 22, 2012, 02:21:20 PM
I can only assume that we may be infected by the same trojan virus or the John Lewis website may be infected? Hopefully someone will be able to help us both out, Luke
Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: True Indian on June 22, 2012, 02:54:47 PM
avast prevented u from accessing the site at a very early point and protected u :D

i find 2 things suspicious in HTML Data...
Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: wils1989 on June 22, 2012, 02:58:58 PM
Thanks very much for that reply true indian.. glad to know Avast is working. I obviously don't understand the screenshots, but I hope that you or the members you mention will be able to offer some more guidance.

Thanks again for the reply, much appreciated
Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: True Indian on June 22, 2012, 03:08:51 PM
I would recommend to scan your browser folders to ensure nothing was dropped
Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: wils1989 on June 22, 2012, 03:12:01 PM
OK, so I should do a full system scan using Avast? Or do you mean something different? Thanks again, Luke
Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: True Indian on June 22, 2012, 03:22:23 PM
A quick scan should do the trick
Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: wils1989 on June 22, 2012, 03:30:09 PM
Great I'll do one now, cheers
Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: True Indian on June 22, 2012, 03:31:40 PM
OK..tell  us if anything is found..Meanwhile,i have informed avast! virus analysts of this alert...lets see  :)
Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: wils1989 on June 22, 2012, 06:13:56 PM
The quick scan has finished and everything seems clear apart from some files which couldn't be scanned because they are 'password protected'... I also did a Malwarebytes Anti-Malware scan and no 'malicious items' were found..

I'm not sure how to get in contact with the avast! virus analysts? Thanks, Luke
Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: archtea on June 22, 2012, 06:52:07 PM
Hi
I have also had the Thomas Cook.com website blocked by Avast

Quick scan didn't reveal any infetion

Any advice anyone ?

Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: wils1989 on June 22, 2012, 06:54:41 PM
Same Trojan detected for you too mate?
Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: archtea on June 22, 2012, 06:57:56 PM
yep certainly is !
Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: True Indian on June 22, 2012, 07:10:22 PM
same malware on site..we are being protected!

wait until milos virus analyst gives further info
Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: archtea on June 22, 2012, 08:56:58 PM
Ran full scan and detected 1 infection - iframe-qh - moved to chest and current rebooting and scanning.

Strange thing is I have a works computer which i have just booted, the anti virus (micro trend) is blocking URL websites even though I am not connected to a search engine only via LAN.

Has someone hacked my network connection (it is Wpa secured) ?
Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: Atreides on June 23, 2012, 06:03:58 PM
Hi I have had the same notification when my wife tries to log on to the Boden site www.boden.co.uk Scanned the computer and havent found anything.

From the virus chest - C:\Users\Steven\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FCN4Z7YR\Login[1].htm   HTML:Iframe-QH[trj]

Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: wils1989 on June 23, 2012, 06:09:07 PM
Without wanting to alarm anyone, and it may be completely unrelated, but two fraudulent transactions were made online on my debit card two days ago. I received a call from Halifax who informed me both transactions had not gone through but it was best to cancel my card and get a new one. I've also done a full scan and found nothing. There are a couple of users on another forum, hotukdeals, who have advised their Avast also detected this Trojan when going onto shopping sites.
Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: polonus on June 23, 2012, 06:28:54 PM
@Atreides,

Break that link like hxtp or wXw.
There is supicious code there:
wXw.boden.co.uk/JavaScript/JQuery/jquery.fancybox-1.3.4.pack.js?v=27 benign
[nothing detected] (script) wXw.boden.co.uk/JavaScript/JQuery/jquery.fancybox-1.3.4.pack.js?v=27
     status: (referer=wXw.boden.co.uk/)saved 15624 bytes caeb31e930068ce5820b239d44d8415f95957138
     info: [embed] wXw.boden.co.uk/JavaScript/JQuery/
     info: [iframe] wXw.boden.co.uk/JavaScript/JQuery/
     info: [decodingLevel=0] found JavaScript
     error: undefined variable jQuery
     error: undefined variable Image
     suspicious,

polonus

Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: martdee on June 23, 2012, 10:17:08 PM
New to this site and trying to find a solution to this message. I have  done a quick scan and all is clear. The web shield log tell me it has page blocked. There were no alerts while browsing the Debenham's site but as soon as I tried to "add to basket" Avast sent the Trojan detected message.
What action is recommended now?
Please consider that I am not the most computer literate person but I am trying  :-[
Thanks for reading this post
Title: Re: Trojan Detected - HTML: THOMASCOOK.COM
Post by: asenden on June 25, 2012, 11:16:05 AM
Hi,

we (thomascook.com IT team) have received lots of feedback from our site visitor.

First of all thank you very much for your feedback

We can assure you that this is a FALSE POSITIVE caused by a JavaScript of one of our 3rd party tracking tools. Using the thomascook.com and any other Thomascook website is absoloutly safe.

We are working very hard with our vendor to solve this as soon as possible and keep you updated

Regards
A. Senden
Thomascook Online
Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: True Indian on June 25, 2012, 11:21:55 AM
@asenden

though i would consider waiting for a reply from the avast! team  :)
Title: Re: Trojan Detected - HTML:Iframe-QH [Trj]
Post by: Milos on June 25, 2012, 11:25:45 AM
Hello,
it looks it was false positive (detection is now disabled).

Milos
Title: Re: Trojan Detected - HTML: THOMASCOOK.COM
Post by: Asyn on June 25, 2012, 11:25:55 AM
We can assure you that this is a FALSE POSITIVE caused by a JavaScript of one of our 3rd party tracking tools. Using the thomascook.com and any other Thomascook website is absoloutly safe.

Well...
http://sitecheck.sucuri.net/results/thomascook.com
http://labs.sucuri.net/db/malware/malware-entry-mwjs150