Author Topic: JS:Cruzer-B [Trj] in homepage?  (Read 21690 times)

0 Members and 1 Guest are viewing this topic.

Offline !Donovan

  • Web Analyst
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2219
    • The WAR Against Malware
Re: JS:Cruzer-B [Trj] in homepage?
« Reply #15 on: May 30, 2009, 03:42:56 PM »
I clicked all the forum categorys in Internet Explorer 7 and didn't get any warning. What exact place are you talking about? (Starts clicking more links)
Familiarize Yourself! | Educate Yourself! | Beautify Yourself! | Scan Yourself!
"People who say it cannot be done should not interrupt those who are doing it."

Offline !Donovan

  • Web Analyst
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2219
    • The WAR Against Malware
Re: JS:Cruzer-B [Trj] in homepage?
« Reply #16 on: May 30, 2009, 03:46:35 PM »
Scratch that, I found a problem. When you exit the Lezingen in Nederland en Belgiƫ place, it alearts the site has malware and has to be aborted.
Familiarize Yourself! | Educate Yourself! | Beautify Yourself! | Scan Yourself!
"People who say it cannot be done should not interrupt those who are doing it."

SekhemAkassha

  • Guest
Re: JS:Cruzer-B [Trj] in homepage?
« Reply #17 on: May 30, 2009, 03:54:59 PM »
@Tech:
Yes, I have the latest version of Avast.

I don't know if the site is hacked.

Last weekend (may 23) there was a current down in the datacentra and sunday (may 24) the server (where my site is host) crashed and totally died. The hoster has put all the sites on another server, but the file for the ftp, the emails and the directadmin was corrupt and the hoster makes all new one for us.
This weekend the hoster will move all the sites to a new server.

I have mail the hoster about this.

Thank you for help.

@Igor:
empty pages ?? Which empty pages?? I don't understand this. Sorry  :-[

@Donovansrb10:
It's everywhere on the forums, not only there where you found it. It is also there when I post e reply there. :(
« Last Edit: May 30, 2009, 03:58:08 PM by SekhemAkassha »

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: JS:Cruzer-B [Trj] in homepage?
« Reply #18 on: May 30, 2009, 04:02:16 PM »
I downloaded the mentioned webpage. It looks "clean" (I mean the source code) - but if you notice that there are a lot of empty lines there and scroll to the real end, there's an appended malicious script there.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: JS:Cruzer-B [Trj] in homepage?
« Reply #19 on: May 30, 2009, 04:04:39 PM »
If you scroll down a few empty pages, you'll see the encrypted script.

???
I can't see them with http://www.selfseo.com/html_source_view.php after
</body>
</html>
The best things in life are free.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: JS:Cruzer-B [Trj] in homepage?
« Reply #20 on: May 30, 2009, 04:08:05 PM »
I can... when I scroll 15 pages "down".

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: JS:Cruzer-B [Trj] in homepage?
« Reply #21 on: May 30, 2009, 04:08:45 PM »
I can... when I scroll 15 pages "down".
How do you do that?
The best things in life are free.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: JS:Cruzer-B [Trj] in homepage?
« Reply #22 on: May 30, 2009, 04:09:33 PM »
Click into the control and press PageDown 15 times? ;)

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: JS:Cruzer-B [Trj] in homepage?
« Reply #23 on: May 30, 2009, 04:39:22 PM »
Click into the control
Control ???
The best things in life are free.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: JS:Cruzer-B [Trj] in homepage?
« Reply #24 on: May 30, 2009, 04:40:54 PM »
The box where selfseo shows you the page source.

SekhemAkassha

  • Guest
Re: JS:Cruzer-B [Trj] in homepage?
« Reply #25 on: May 30, 2009, 05:04:56 PM »
I have try the "15 pages down" like you said (in the box where selfseo shows the page source) but I can't see that script.  :-[

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: JS:Cruzer-B [Trj] in homepage?
« Reply #26 on: May 30, 2009, 05:14:31 PM »
The box where selfseo shows you the page source.

Tested, from the beginning, 15 pages after that... I see nothing... can you post a screenshot?
Tried going to the end, click page down 15 times... of course, the cursor stays there where it is in the 'bottom' of the page code.
The best things in life are free.

SekhemAkassha

  • Guest
Re: JS:Cruzer-B [Trj] in homepage?
« Reply #27 on: May 30, 2009, 05:19:45 PM »
I have looking in my DirectAdmin,and the index.php is clean.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: JS:Cruzer-B [Trj] in homepage?
« Reply #28 on: May 30, 2009, 05:24:01 PM »
Erm, I guess there's a confusion here - I was referring to the original post URL (nilsandreas), not to the follow-up.
You see, it's better to create a new thread for a new problem.

Anyway, I don't get any detection on the other one (oudeegypte)... somebody else does?

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: JS:Cruzer-B [Trj] in homepage?
« Reply #29 on: May 30, 2009, 05:34:29 PM »
Erm, I guess there's a confusion here - I was referring to the original post URL (nilsandreas), not to the follow-up.
You see, it's better to create a new thread for a new problem.
I see... it's easy, it's there.

Anyway, I don't get any detection on the other one (oudeegypte)... somebody else does?
No, I don't get anything... it's a forum, seems ok for avast... aren't the links at the bottom?
The best things in life are free.