Author Topic: Suspicious inline script found...  (Read 2764 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 34021
  • malware fighter
Suspicious inline script found...
« on: May 27, 2010, 09:46:11 PM »
Hi malware fighters,

Do not go here: wXw.villalesignana.com/index.php
1 suspicious inline script found, moreover the site now is listed as suspicious by unmasked parasites and
Norton Safe Web: 14 computer Threats for this Italian site:   
12 drive-by-downloads for a trojan and 2 for a virus all named Trojan.Malscript!html
i.e. HTML files that contain malicious JavaScript.
Re: http://www.google.com/support/forum/p/Webmasters/thread?tid=5c2a912ed61c9696&hl=en

Script see attached picture..for extensive info: http://pi1.informatik.uni-mannheim.de/filepool/theses/diplomarbeit-2009-dewald.pdf  (detention and detection of malicious websites),

@YoKenny  Not yet listed here: http://hosts-file.net/default.asp?s=villalesignana.com

polonus
« Last Edit: May 27, 2010, 10:33:02 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89490
  • No support PMs thanks
Re: Suspicious inline script found...
« Reply #1 on: May 27, 2010, 10:23:03 PM »
Pol, can you not crop your images as aside from taking up lots of space it makes the file size much larger. Also using the .gif image format generally produces a smaller file size (without having to optimize them) and without and major loss of quality. See my gif cropped example compared to yours.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.7.6124 (build 24.7.9311.855) UI 1.0.811/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 34021
  • malware fighter
Re: Suspicious inline script found...
« Reply #2 on: May 27, 2010, 10:36:57 PM »
Hi DavidR,

Now it is half yours, PicPicked it, but do you have any comment, because all the links Norton Safe Web serve up do not give any flags at VT.... and both NSW and Google's unmasked parasites flag it,

polonus

Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89490
  • No support PMs thanks
Re: Suspicious inline script found...
« Reply #3 on: May 28, 2010, 12:42:11 AM »
Not any more (but yours still take up a large amount of space) if I just snapshot the text ;D

I couldn't check it out as firefox lists it as an attack site image2 and the one thing I won't do is go playing with IE. Though I have downloaded the actual page and I see no suspect in-line script and I couldn't get anything out of this one AC-RunActiveContent.js (it just looks like an identical index.php file). The both had the same MD5 and no alerts on VT.


Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.7.6124 (build 24.7.9311.855) UI 1.0.811/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security