Hijack website

Viruses and worms
1

This website came from a google search. It spoofs microsoft programs

casa4sale.biz/agocl/prmdp/oxnard.php

It is very dangerous and Avast did not warn me

2

Visited it.

Isn’t it a villa reservation website?

3

It wasn’t spoofing anything when I visited it and there is nothing suspect in that page source you gave the link for.

So what is telling you it is dangerous ?

4

Hi guys,

Since this came from a google search, could it be one of those browser/google hijacks?
You know, when a google link redirects to somewhere else?

-Scott-

5

Quite possible, as there is no way to access the casa4sale.biz/agocl/prmdp/oxnard.php link from the home page on the main site.

6

Hello,

some more information can be seen here: http://blog.avast.com/2009/05/21/rogue-malware-ranking-2/

All the php files stored on this server doesn’t contain name and path of the linked javascipt as shown in next ‘CODE’ box (you can see the empty src attribute):

<head><title> according: (states ranked according to education -- bible trivia according to mark)</title>
<script 
src="">
</script>

But if I expect same structure as described in the blog post, the redirection javascript is there - it is just not linked. Redirector script is detected as JS:Redirector-I - this is same redirector as the one from blog post. The question is “Why it is not linked?” Edited by admin/owner?

Regards

7

little explanation to my previous post. All those php files are inactive without linked redirection script - only if your browser will try to load that script avast! will alert.

Regards

8

Hi folks,

WOT also give it two reds, finjan gives a brown meaning that it cannot scan it (cannot connect to the site in question), Exploit Prevention Labs Link Scanner misses it completely as does Wepawet scanner. That also does not flag a thing. It could well be the site is down at the moment. Thanks for the heads up.
The way to hide the malcode online gets more and more advanced, so they use all tricks in the book to evade detection. But, mind you, this is avast expertise, folks, and avast is getting better at this every day,

polonus