This site is very badly infected (Its now clear)

Tonanet · September 20, 2012, 12:59pm

Hello,

I usually visit a site about sports that is quite popular in my country called Lancenet.

However today, when I was checking the news about my soccer team, I received tons of alerts of malware (1 executable and a lot of java exploited files). They were so many infections that my webbrowser stopped to work.

The link is this one hxxp://www.lancenet.com.br/flamengo

I believe that the site was hacked.

Please, visit this site only if you are from the avast team, or know what you are doing…

I dont know if avast is detecting the malwares from this site. Trend Micro that is installed here in my work is detecting it…

I am just alerting here so avast can start to detect it if its not already detecting.

Thanks!

Elminster

Pondus · September 20, 2012, 1:10pm

Very infected
http://sitecheck.sucuri.net/results/www.lancenet.com.br/flamengo

sucuricata and snort filter alerts also http://urlquery.net/queued.php?id=190604

Tonanet · September 20, 2012, 1:12pm

I believe that it started today. Because yesterday I visited it without any problem…

Do you know if avast is detecting the exploits and the executable?

Thanks for your attention,

Elminster

Pondus · September 20, 2012, 1:23pm

I could have tested that if i was on my comp…but doing this post from cellphone

will check later today

Tonanet · September 20, 2012, 1:25pm

Oh Ok, Thanks!

I already alerted the avast team with the contact form, just in case if this isnt already being detected…

Thanks!

Elminster

polonus · September 20, 2012, 2:31pm

Someting more about the infection process can be found here: http://www.honeynet.org/book/export/html/149
SCUMWARE also has the detection- only one in the VT url scan that flags…
Javascript encoding used to hide a malicious iframe.
Also packed paywall tracking code on that site…
The snort IDS alerts are for server attacks producing routing errors…

polonus