Knovel JS Exploitation

Viruses and worms
1

Hello all,

I recently attempted to access a book through Knovel but was unable as Avast blocked the link - reporting it to be a java-script exploitation (JS:Pdfka-PK). I was using Internet Explorer at the time. I have used Knovel in the past without any problems. Should this be ignored as a potential false-positive?

Thank you for support on this matter.

Kind regards,
Koray

2

Do you mean a book from Elsevier, the web-based application or… ?
What exact version of avast?
What is the exact message avast is giving you?
What os/service pack?

3

1 - Knovel, Technical Engineering Reference Information → http://why.knovel.com

2 - Avast Free, 8.0.1497

3 - Info below shown in pop-up box.

EXPLOIT BLOCKED
avast! Web Shield has blocked a harmful webpage or file.
Object: http:/…/knovel.swf.require.js?v=origin_mast
Infection: JS:Pdfka-PK [Expl]
Process: C:\Program Files (x86).…\IEXPLORE.EXE

4 - Windows 7 Home Premium, Service Pack 1

Thanks for the quick response.

4

sucuri report outdated joomla http://sitecheck.sucuri.net/results/why.knovel.com

5

Also outdated version of avast.
I strongly suggest to remove it using avastclear and download/install the latest version.

6

With avast! going to the site gives no problem (with javascript blocked),
Quttera finds this file as potentially suspicious (insecure coding)
/modules/mod_fpslideshow/mod_fpslideshow/engines/jquery-comp.js
Severity: Potentially Suspicious
Reason: Detected potentially suspicious content.
Details: Detected potentially suspicious initialization of function pointer to JavaScript method eval __tmpvar751150090 = eval;
Threat dump: http://jsunpack.jeek.org/?report=04b47bb598e35c1968943a74cef7f70acbaf92d1 (abuse of WP code via PHP exploit - software on site needs updating)
File size[byte]: 29846
File type: ASCII
MD5: FB49BB7A70D7BE19CC6A145146CA7D44
Scan duration[sec]: 0.245000

polonus
7

Hello all. We’re having the same problem. It seems to be a false positive.

I just spoke with tech support / customer service for Knovel. The workaround is to disable the Flash add-on in your browser.

When Knovel switched to a new platform recently (app.knovel.com), the behavior for viewing PDFs changed, so that it is now trying to load a Flash-based PDF viewer. If you disable Flash, it will revert to using whatever PDF viewer you have installed.

I verified that my Flash is up to date: 11.9.900.152 using Firefox plugin check.
Avast engine, virus defs, and program are also up to date. (Endpoint Protection Suite running on Windows XP. Also tested on Windows 7.)

I will try to report this to Avast so they can look at the offending viewer more closely.

8

Cheers for the temporary solution. :smiley:

I’ve completely updated all software on this machine, including Avast! to version: 2014.9.0.2008.

9

I did create a problem ticket with Avast today, so hopefully they will take a closer look at the link for that viewer soon.

10

Another problem “solved” by helping each other.
Keep up the good work people.