system
February 24, 2010, 5:29pm
1
hxxp://www.threatexpert.com/report.aspx?md5=57d98acbec13e2744775f4467361206a
upon visiting this threat report page, avast5 alerts about JS trojan(JS:ScriptSH-inf).
Just wondering how on earth this particular report is infected.(note: threatexpert main page or reports page are clean. Other threat reports seem to be clean, too)
DavidR
February 24, 2010, 6:17pm
2
It may be that there are examples of javascript exploits or though only avast and GData detect it so it is possible it could be a false detection.
I uploaded the page to VT for checking, http://www.virustotal.com/analisis/f5ebb017e10fee7df6a8192c835f8f74aa678af90ce130b3611a3dc155b0c0eb-1267034790 only avast 4&5 plus GData detecting.
I have uploaded this for analysis by avast.
system
February 25, 2010, 7:29pm
3
I am not too sure this is it, but it could be one of the registry keys mentioned…
There is obfucated code as part of a key, that de-obfucates to be a link to a malicious site…
http://www.mywot.com/en/scorecard/89.119.67.154
http://www.mywot.com/en/scorecard/kukutrustnet777.info
http://www.mywot.com/en/scorecard/kukutrustnet888.info
This could be setting avast! off as it exists pretty much as is in the source code…
-Scott-