Avast and HTML Protector

Viruses and worms
1

I use a program called HTML Protector by http://www.antssoft.com/htmlprotector/index.htm to encypt my web pages. I recently am getting a virus alert when going to my website. This only happens when I load the protected pages. With unprotected pages, I get no virus alert. As stated this is a new issue and I believe avast is the problem as I’ve been using avast and my protected pages with success for a couple of years now. The only variable that changes are the avast updates. Any help would be appreciated. FYI - I am using hte lastest version of HTML Protector and avast updates daily. Thanks!

2

Hi junk847,

Can you provide us with a link to one, use hxtp for http, please. Like to see why that obfuscation/encryption is being detected,

polonus

3

Would you please attach a screenshot of what avast! is alerting?

4

Thanks polonus and !Donovan,

Here is the link to an HTML Protector protected page on my site, http://m7graphics.com/1themes000a-prot.htm. The rest of the pages on my site are unprotected and do not produce an alert from avast. I’m not sure how to get a screen shot here but here are two attachments…

5

Interesting method, using unescape hexadecimal code. After I finish decrypting it I’ll report what I found and if it is malicious or not.

6

Hi !Donovan,

Avast and GData are the only ones to flag this. Interesting what your analysis will bring,

polonus

7

Hi !Donovan,

See: that te escaped characters above (, %3C, %25, %7F, %7F, %22, %22, %3C, %…) decodes to something like → < %""< “< %< %"%”%%%\\\%< “”%%%%%<
It is clearly encoded JS malware,

polonus