message redir-CB [Trj]

Viruses and worms
1

Bonjour,

Voici le message que je reçois redir-CB [Trj] en allant sur le site hxxp://www.pcf.fr depuis 2 jours.
J’ai installe Avast 5 familliale depuis le 26/05/2010

Voir fichier attaché, merci

2

Could you please repost in english…?
Or just wait for the french speaking members to answer…
asyn

3

google translate

Hello

Here is the message I get redir-CB [Trj] going to the site since hxxp://www.pcf.fr two days.
I installed Avast 5 familly since 26/05/2010

See attached file, thank you

4

Thanks for translating, Pondus…!
Still I didn’t get the question (if there is any)…
asyn

5

Hi JA67, asyn, Pondus

There is a suspicious script alerting this rule:

alert(url_content:“%3CSCRIPT”; nocase; msg:“ tags GET request cross site scripting attempt”; url_re:“/%3Cscript.*%3E/i”; reference:url,http://ha.ckers.org/xss.html; reference:url,http://en.wikipedia.org/wiki/Cross-site_scripting;)
- Could that be what avast is alerting?
I think so, it alerts the code attached as: JS:ScriptUE-inf [Trj]

polonus

6

Nice shot, polonus…!
Could well be…
asyn

7

what, you have problems understanding how google translate works?