Author Topic: JS virus in one of threatexpert reports?  (Read 2882 times)

0 Members and 1 Guest are viewing this topic.

Altarir.

  • Guest
JS virus in one of threatexpert reports?
« on: February 24, 2010, 06:29:28 PM »
hxxp://www.threatexpert.com/report.aspx?md5=57d98acbec13e2744775f4467361206a

upon visiting this threat report page, avast5 alerts about JS trojan(JS:ScriptSH-inf).

Just wondering how on earth this particular report is infected.(note: threatexpert main page or reports page are clean. Other threat reports seem to be clean, too)
« Last Edit: February 24, 2010, 06:31:38 PM by Altarir. »

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89145
  • No support PMs thanks
Re: JS virus in one of threatexpert reports?
« Reply #1 on: February 24, 2010, 07:17:34 PM »
It may be that there are examples of javascript exploits or though only avast and GData detect it so it is possible it could be a false detection.

I uploaded the page to VT for checking, http://www.virustotal.com/analisis/f5ebb017e10fee7df6a8192c835f8f74aa678af90ce130b3611a3dc155b0c0eb-1267034790 only avast 4&5 plus GData detecting.

I have uploaded this for analysis by avast.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.4.6112 (build 24.4.9067.762) UI 1.0.803/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

spg SCOTT

  • Guest
Re: JS virus in one of threatexpert reports?
« Reply #2 on: February 25, 2010, 08:29:47 PM »
I am not too sure this is it, but it could be one of the registry keys mentioned...

There is obfucated code as part of a key, that de-obfucates to be a link to a malicious site...

http://www.mywot.com/en/scorecard/89.119.67.154
http://www.mywot.com/en/scorecard/kukutrustnet777.info
http://www.mywot.com/en/scorecard/kukutrustnet888.info

This could be setting avast! off as it exists pretty much as is in the source code...

-Scott-