False alarm or? (vkontakte.ru)

Viruses and worms
1

Hello, I have encountered a problem while using avast!. When I use vkontakte.ru (very popular social network in Russia, Ukraine, and Belarus) avast! warns me (but only when I’m due to visit some user profile or group) about the trojan JS:ScriptPE-inf [Trj] located on address like http://vkontakte.ru/al_profile.php?__query=[b][ID of user/group][/b]al=-1al_id=[my own ID]|>{gzip}.

The message about the trojan appears only when I am going to visit some groups, and some user profiles, and only when I’m opening them in the same tab. If I try to open the pages in new tab, nothing appears. There are also several messages regarding this problem on Twitter, and this problem appeared, like, 2 days ago.

What can it be?

2

Site has scripting exploits, see: http://www.google.com/safebrowsing/diagnostic?site=vkontakte.ru

Trojanized Flash-player found there: http://www.virustotal.com/file-scan/report.html?id=05fe5d2f3fceefd53bff06dc4f1b407e99e723ffd73553471ddeb0482a6d6000-1305276217

For a write-up on mentioned Trojan.Hosts.4548 malware, read this blog article: http://blogs.paretologic.com/malwarediaries/index.php/2011/05/12/trojanized-flash-player-haunts-vkontakte-users/ author of article = Jerome Segura

polonus

3

Actually, that information applies for some applications (domains provided are external sites). I am talking about some regular user profiles which are maintained by the website itself.