system
1
Getting js script virus alert from avast when visiting
hxxp://www.mediafire.com/?of2zwhhfbd273uk
URL: http://www.mediafire.com/dynamic/download.php… {gzip}
Process: file://C:\Program Files (x86)\Mozilla Fi…
Infection: js:ScriptSH-inf [Trj]
only happen on that link, other mediafire link worked fine
is it false positive or just the server that reside the file that infected?
thx
Asyn
2
Report 2011-10-17 11:22:34 (GMT 1)
Website mediafire.com
Domain Hash ccf210f70c2a4ac52d0b1ee1d819121f
IP Address 205.196.120.8 [SCAN]
IP Hostname -
IP Country US (United States)
AS Number 46179
AS Name MEDIAFIRE - MediaFire, LLC
Detections 6 / 23 (26 %)
Status DANGEROUS
Pondus
3
not sure what avast dont like there…
checked the file located there at Virscan.org and it is clean
http://r.virscan.org/c034a52936ab6d19be3bdda37c00ac6f
Pondus
4
well Asyn…lots of strange files are uploaded to Mediafire…like Essexboys logs…and also malware samples
polonus
6
system
7
don’t think it was the file that was infected, but the javascript,
anyway seem the server is also blocked by avast
hxxp://199.91.152.194
hxxp://199.91.152.194/a2583f3cce9g/of2zwhhfbd273uk/Yandere_Kanojo_%28JOKER%29_c31%5BVexed%5D.rar
blocked by avast URL:MAL
polonus
9
system
10
look like the server is really infected, as its been down for a while,
the link provided earlier also been deleted for violation lmao
good to know that mediafire browse avast forum 