got a false alarm in a well known web site (University one)

Viruses and worms
1

Hello! I started having this alert 3 months ago more or less. It reads:

A virus has been found!
name: http://aulaweb.etsii.upm.es/webaula/cgi-b … etc
name of the malware HTML:frame
Tipe of bad software: Virus/worm
VPS version: 080313-0

Sorry for the English it is a translation from Spanish
Everytime I open it the message appears. I’ve tried to exclude it, but it didn’t work
Thank you very much in advance

2

Probably it is NOT false alarm. After the body of the page some iframe really present (XXYY is substituted instead original content)

So probably site is hacked

3

Dr. Web says http://aulaweb.etsii.upm.es is clean… but it does not scan the iframes of second/third level into the webpage.

4

I looked at this site content using curl :slight_smile:

5

But that page don’t make any alarm. it sounds when I enter my pasword and I get into the content. Try do this if you want to enter, but I don’t want any of you to get infected.

Do click in: “Visualizar AulaWeb sin pop-ups (ventanas emergentes)”, (you’ll see it marked).
then, next to “Alumno invitado” select for example the first one “electrotecnia” and finally, “entrar”.

By the way, I can try to talk with the administrator.

Thank you

6

Thanks for reporting. Hope that avast improve its detection with this page.

7

It would be nice. Output from the reference in your 1st message really contains invisible frame refering to another hacker site.
Probably it is not dangerous in this particular case but due to good will of hacker only (I didn’t found any malicious code in this case)

8

Hello,

http://aulaweb.etsii.upm.es/webaula/cgi-b

page doesnt exist for me, so server returns “404” page that contains iframe at the end of the code. This infection should be repaired on all “server made” pages.

This is not a false positive.

Best Regards

PS: Thanks psw and Tech :slight_smile:

9

Here’s what I get when I go to that page. There is something bad there.

Click the picture below to enlarge it.

10

… someting bad there. Thank you very much all of you. Here in Spain today start “semana santa” so I can’t talk to any administrator in a week.

I’ll tell you what they told me as soon as posible. Hope someone else has noticed it.

thanks

11

A belated welcome to the forums, clara. :slight_smile:

Yes, please post again when you have more information about this.