FP on CyanogenMod forum?

[RejZoR]

http://forum.cyanogenmod.com/topic/39846-malware-warning-when-visiting-this-site
http://forum.cyanogenmod.com/topic/39873-trojan-in-forum
http://forum.cyanogenmod.com/topic/39973-does-this-forum-have-a-virus

Can you please verify the links mentioned in these threads? The administrator is assuring me that there was a malicious code there but it's not anymore. But i'm not sure if he is correct. Detections are not from Network Shield but they are coming from Script Shield and Web Shield.
Though detected files are a bit strange. PNG's can't be malware...

[Asyn]

Sucuri says: Domain blacklisted on the Opera browser (via AVG): forum.cyanogenmod.com

[Pondus]

Though detected files are a bit strange. PNG's can't be malware...

http://www.cyberesi.com/2011/05/10/malware-obfuscated-within-png-files/
http://www.tgdaily.com/security-features/51056-embedded-malware-hidden-in-image-files

Jotti
http://virusscan.jotti.org/en/scanresult/a8fee23756ef5c97e1a1eaa71d75fc4527b2f4c0

VirusTotal
https://new.virustotal.com/file/9462e8f48f9b96b0452da06c5775e9803587eaa2ccdef3510ffd66e4a01a9c49/analysis/1326399511/

[RejZoR]

Well, if you look at detection name it's not anything related to PNG malware. It's JS:redirector. That can't be right or i'm just missing something here.

[Asyn]

Well, if you look at detection name it's not anything related to PNG malware. It's JS:redirector. That can't be right or i'm just missing something here.

All your links give no alert here. So which alert do you get..??

[Pondus]

Well, if you look at detection name it's not anything related to PNG malware. It's JS:redirector. That can't be right or i'm just missing something here.

from link posted above

"Users may follow the instructions in the .PNG and save the file as a bitmap (.BMP) with the .HTA extension.
It is [now clear that the] decompressed file contains an image, some JavaScript and one or more executable files."

[RejZoR]

I'm currently on a system with Kaspersky, but it's also giving me alerts.

So basically if i understand this right, there is malicious data encoded inside PNG. The administrator there is saying to me that avast! is detecting files that aren't there anymore. I find that impossible. Web Shield cannot scan and detect non existant files. They have to be there to be scanned and detected.

[Asyn]

I'm currently on a system with Kaspersky, but it's also giving me alerts.

What do you mean with also..??
As said, avast! doesn't alert on your links. (See Reply #4)

[Pondus]

Though detected files are a bit strange. PNG's can't be malware...

 


Sophos lab

Hello,

 Thank you for contacting Sophos Technical Support.

The file(s) submitted were malicious in nature and detection will be available on the Sophos Databank shortly.

av-206846.png -- identity created/updated (New detection Troj/ObfJs-AV)

Norman lab

av-206846.png : Processed - JS/Redir.GO

Avira lab

The file 'av-206846.png' has been determined to be 'MALWARE'.Our analysts named the threat JS/IFrame.IM.The term "JS/" denotes a Java scriptvirus.Detection will be added to our virus definition file (VDF) with one of the next updates.