I’m not sure if this is a false positive or a real malware due to malware name. It could be a hijacked part of webpage.
QOLabs itself is trusted and reliable software vendor.
I’m not going to post the link but it can be googled…
Webpage is detected as: JS:Packed-Z [trj]
DrWeb link scanner doesn’t seem to detect anything.
The main page is just one huge bunch of encrypted javascript, which triggers the detection. There is no content except for a redirect.
Quite fishy, if you ask me. (On the vacations right now, have no time to dissect the beast).
Do you have any contact of them, so you can ask if the stuff is legitimate?
It’s not a false positive. I tried opening the page in VirtualPC with AVIRA installed and it also jumped on it.
Plus avast! Network Shield detected a malicious address while i was testing it (Web Shield was disabled during this test).
It seems their webpage got hijacked badly.
I’ve also reported the incident to one of QOLabs staff and suggested that they take webpage offline and investigate the problem asap.
Hi RejZoR,
That means, my friend, that people have to scan their links real time (finjan, WOT etc), and I have installed firekeeper with a couple of Snort malware aggressive lists inserted in the browser. Websites that people have trusted are now being infected by malcreants grand time and grand scale (the recently found zero-day M$ SQL server hole still unpatched, also is an infecting factor). So the saying “I only used the browser on safe sites” won’t help you always,
polonus
Just got a reply from QOLabs staff. They’ve solved the problem and are now investigating how this happened.
It’s safe again to visit their webpage.
I’m thinking if they will acknowledge the security hole…