Bitdefender's official site hacked with unknown Iframe infection!!!

Viruses and worms
1

see here: http://sitecheck.sucuri.net/results/bitdefender.com

Also here: http://forums.malwarebytes.org/index.php?showtopic=128196

Does avast detect this infection in any way?

2

The only detection is from Sucuri, others do not detect: urlquery, Quttera’s etc.
The iFrame source redirect is flagged here: http://hosts-file.net/?s=servedby.flashtalking.com
See: http://webmincer.com/domains/bitdefender.com
The webrep of this url is bad: http://www.mywot.com/en/scorecard/servedby.flashtalking.com?utm_source=addon&utm_content=popup-donuts
Also see: http://vurldissect.co.uk/default.asp?url=http%3A%2F%2Fservedby.flashtalking.com%2Fcontainer%2F2249%3B9850%3B1226%3Biframe%2F%3FspotName%3DHPage%26cachebuster%3D&btnvURL=Dissect&selUAStr=1&selServer=1&ref=&cbxSource=on&cbxBlacklist=on

polonus

3

Hi true indian,

There is another iFrame redirect there: http://support.clean-mx.de/clean-mx/viruses.php?domain=rfihub.net&sort=domain%20desc first detction
src=‘htxp://c1.rfihub.net/js/bcP.js’ see: http://jsunpack.jeek.org/?report=a7cc1076f0935bec9ec15f744fed59dd9d443313 (open link with script blocking active and in a VM) - also with a questionable web rep: http://www.mywot.com/en/scorecard/c1.rfihub.net?utm_source=addon&utm_content=popup-donuts
No address associated with hostname - spyware: http://www.threatexpert.com/report.aspx?md5=a494367b0f6700b30d9a22942c6bcc79

polonus

4

Thanks for the feedback Pol,you deeper analysis is worthy,I now learn that the Iframe isnt really worth detecting,Nothing nefarious here. This particular script is for reporting and site analytics.