Blocked Google search result for "browser games"

[2ma2]

Hi,

Found this interesting effect when googling the terms "browser games":

Infection Details

URL:   htXp://liamkincaid.com.sapo.pt/template/feathead.jpg
Process:   C:\Documents and Settings\riotamot\Local... (Chrome)
Infection:   URL:Mal

Running Win XP 32-bit with avast! Free:

Def: 120722-0
Prg: 7.0.1456

With avast! WebRep (allowed in incognito mode)

Have tested to google "browser" and "games" by themselves, and a couple of random queries as well. Have replicated googling for "browser games" four times, and avast! blocks the .JPG above every search. Dunno if it's a false positive or not. Would be horrible if it's a true positive :O

Best wishes,
Linus

[!Donovan]

If you would, please change http:// to hXtp:// in your post to avoid accidental clicks.

See: http://urlvoid.com/scan/liamkincaid.com.sapo.pt/
IP has hosted various malware in the past (over 100), thus avast! alerts.

Because avast! blocked the website, no harm was done to your computer.

[polonus]

Could have been an IP block, from that IP TR/Spy.Banker.Gen was being launched, so break that live link using hxtp,

polonus

[2ma2]

Thanks for instructing me to disable the URL.

[!Donovan]

Also See: http://urlquery.net/report.php?id=99405
And this alert: FILEMAGIC windows executable

I get 270336 bytes of executable.

File scan: https://www.virustotal.com/file/6a7f0a9637ce260b8e2786a0d4659a0fd13ea2bf34d981dfdbea630ac5406be3/analysis/1342980116/

[2ma2]

I apologise, I'm not experienced with these things, and cannot interpret these results thoroughly. A previous .JPG within this domain was infected with executable code. Dependant on what engine reading this .JPG, the machine might or might not execute it, thus being infected.

But does this effectually mean that Google search results (and syndicated feeds) may infect a client, if they retrieve the image file directly from the malware site (ie. not creating a thumbnail or equivalent of said image)?

[polonus]

You can a virus from what you believe to be a jpg file. All it needs is a double click to activate whenever you have been infected by a virus that attach itself to jpg files to make them executable, and you also have a doubtful viewer executable from that malware,

polonus