Avast community forum
Home
Help
Search
Login
Register
Avast WEBforum
»
Other
»
Viruses and worms
(Moderators:
Maxx_original
,
misak
) »
Webshell backdoor detection?
« previous
next »
Print
Pages: [
1
]
Go Down
Author
Topic: Webshell backdoor detection? (Read 2931 times)
0 Members and 1 Guest are viewing this topic.
polonus
Avast Überevangelist
Probably Bot
Posts: 33900
malware fighter
Webshell backdoor detection?
«
on:
August 04, 2014, 10:44:24 PM »
See:
https://www.virustotal.com/nl/url/b5999d13b5510d87149d6bbf5c184bd145df1b14ff14ad73215822cf3a8179dd/analysis/1407184353/
Detected by Cybercrime Tracker as backdoor.
Sucuri does not flag:
http://sitecheck.sucuri.net/results/www.aycz.net
BitDefender TrafficLight flags as malicious.
IP badness history:
https://www.virustotal.com/nl/ip-address/117.27.139.110/information/
Here it is found up as malicious:
http://urlquery.net/report.php?id=1407184679292
Virustracker classification: wXw.aycz.net,117.27.139.110,,Criminals,
Should be blockerd.
When in China, time for an asafaweb scan resulting in three warnings:
https://asafaweb.com/Scan?Url=www.aycz.net%2FHelp.asp
Excessive Headers, HTTP only cookies and Clickjacking Warning.
See also:
http://fetch.scritch.org/%2Bfetch/?url=http%3A%2F%2Fwww.aycz.net%2FHelp.asp&useragent=Fetch+useragent&accept_encoding=
And again it were the excternal links to js.users.51. dot a that were flagged!
polonus
«
Last Edit: August 04, 2014, 11:01:21 PM by polonus
»
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.
Use NoScript, a limited user account and a virtual machine and be safe(r)!
Pondus
Probably Bot
Posts: 37529
Not a avast user
Re: Webshell backdoor detection?
«
Reply #1 on:
August 05, 2014, 03:03:42 AM »
https://www.virustotal.com/en/file/1930ddeb8f265541d060a01390ee49777801df66e49d282529507487b51349cc/analysis/1407200502/
Logged
polonus
Avast Überevangelist
Probably Bot
Posts: 33900
malware fighter
Re: Webshell backdoor detection?
«
Reply #2 on:
August 05, 2014, 06:07:34 PM »
Read about this threat here:
http://www.antivirushelptool.com/viruses/Unclassified%20virus/avht88470/XPFox-2
&
http://support.clean-mx.com/clean-mx/md5.php?ClamAV=ASP.XPFox-2
polonus
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.
Use NoScript, a limited user account and a virtual machine and be safe(r)!
Print
Pages: [
1
]
Go Up
« previous
next »
Avast WEBforum
»
Other
»
Viruses and worms
(Moderators:
Maxx_original
,
misak
) »
Webshell backdoor detection?