mcafee goes insane?

Viruses and worms
1

instance found here…avast alerted me on mcafee site:Link removed

http://zulu.zscaler.com/submission/show/1b7a973b6a1e11aa553ad7cca9ebdbd7-1337082116

2

Not reproducable…was able to do it once with IE and and once with chrome

works only once i guess…go here first:
hxtp://home.mcafee.com/virusinfo/threat-activity

Then place your mouse on those virus names until the tooltip comes up for it and keep moving on different ones and u will see a alert by avast for one of them

3

So, your topic title is wrong then…it is not McAfee that goes insane. ::slight_smile:

4

Have to go into some trouble trying to reconstruct from the conflicting scan results - bytesize do not match at all for the two…
The representation of this is completely wrong. As seen from the IP info for the Zscaler Zulu scan the IP concerned denotes an obscure searchengine result here: hxtp://www.kmle.co.kr/search.php?Search=mm+virus&SpecialSearch=HTMLWebHtdig&Page=3 IP = 161.69.12.12
The other to a site: htxp://reverseinternet.com/domain/clinic.mcafee.com where the url resolves to an invalid IP address.
Wonder whether the two scan results really match?

polonus

5

hxtp://home.mcafee.com/virusinfo/threat-activity

The alert took place when i was on the above site…when i placed the mouse pointer on one of the list name i got the alert on tooltip of the link

6

Here is the info from avast web shield log from programdata folder:

15-05-2012 16:41:05 hxxp://home.mcafee.com/WebServices/VirusInfoWebSvc.asmx/GetVirusInfoTooltip [L] JS:ScriptSH-inf [Trj] (0)

7

i was able to re-produce it again… I just went here:
[Link removed]
started placing my mouse pointer on each virus name from the bottom of list and i got the alert on one of them.

8

Break that link asap, there is a malcious iFrame there: : [iframe] home.mcafee dot com/ScriptResource.axd?d=LV-CfaVg0Uc9 etc. etc. MD5 crack code,

polonus

9

Thanks! for the confirmation polonous! ;D