Potentially Suspicious File...good old avast! Webshield detects!!!

Viruses and worms
1

Searching for this pattern in particular code:

 <script>\n<!--\n0\n//-->\n</script>

because of issues raised at this thread:
→ http://forum.avast.com/index.php?topic=115497.msg898405#msg898405

I get a firekeeper alert for searching on

: === Triggered rule ===
alert(url_content:“%3CSCRIPT”; nocase; msg:“ tags GET request cross site scripting attempt”; url_re:“/%3Cscript.*%3E/i”; reference:url,http://ha.ckers.org/xss.html; reference:url,http://en.wikipedia.org/wiki/Cross-site_scripting;)

=== Request URL ===
http://ajax.googleapis.com/ajax/services/search/web?v=1.0&key=ABQIAAAADQJp_C6OaW6hvHOMrOnyTRSJ36dQUZSEtUNltVpyNDSTnR8ihRSMP6upCTiKY-Eecqqq5JsdgenlYg&q=<script>\n<!--\n0\n%2F%2F-->\n<%2Fscript>.

This was found in: particular site with /includes/js/overlib_hideform_mini.js
Procedure: + has been called with a string containing hidden JavaScript code, as mentioned by Quttera’s …
This code could well be benign as these are often code hacks to get a better overall performance.
Nevertheless I like to know what the risky part of it all could be and why Quttera flags it…so I delved a bit deeper into this issue…

Malscript detector comes up with this warning for the search result page:

Warning:

This site URL may contain possible malicious scripts hosted or injected!

Solutions: Close this window, Disable JavaScript

Detected Malware: XSS URL Injection Malware

Source:http://www.google.com/search?client=(mybrowse)r&channel=fds&q=<script>\n<!--\n0\n%2F%2F-->\n<%2Fscript>.&ie=utf-8&oe=utf-8&aq=t

Code could be used in a non-interactive shell script attack attempt ...

Here → htxp://jsunpack.jeek.org/?report=1a52d5b7498df2897026dc64ed0fea7e24113f0a
our never sufficiently praised avast! Web Shield detects this code as JS:Ifame-PL[Trj]

By the way Netcraft also blocks:

This page has been blocked by the Netcraft Anti-Phishing Extension for the following reason:

Suspected XSS Attack

Blocked URL: http://www.google.nl/search?q=<script>\n<!--\n0\n%2F%2F-->\n<%2Fscript>&oq=<script>\n<!--\n0\n%2F%2F-->\n<%2Fscript>&sourceid=chrome&ie=UTF-8

Visit anyway

polonus

2

Another direct avast! Network Shield block for see: https://www.virustotal.com/en/url/474630cc9f7781b5be7593353c0187a79cb2edf3ac659543d4f3fcb0c595516b/analysis/1361398842/
Infected with Troj/Cycbot-H → recent report here: http://urlquery.net/report.php?id=1054958
with various IDS alerts on ET TROJAN Kazy/Kryptor/Cycbot Trojan Checkin 2

pol

3

I think we are going to see more direct web shield detections in the future as the new Evo-gen signatures and other new methods come into play.