I get an Avast popup: “Trojan Horse found” every time I start Firefox 3.5.3. Doesn’t seem to be page related since my startpage is google.com.
Name of trojan: HTML:IFrame-LL [Trj]
The Avast popup is attached in a screendump here.
Scanned the hard drive for viruses without finding anything.
Please help!
Isn’t your hosts file compromised?
Clean your Hosts file (replacing it) with HostsMan tool.
This is the web shield alerting so it probably isn’t on your system, unless it is something on your system trying to connect to that URL. If that were the case then I would say that your avast scan would have found it earlier or not at all, in which case you need to check with other tools, see ### below.
Is it one of your feeds that would be loaded when you startup firefox ?
I ask because of the URL in the image you posted.
On a security point your copy of firefox is a few security update short, the latest version is 3.5.7, so I would suggest updating.
If you haven’t already got this software (freeware), download, install, update and run it and report the findings (it should product a log file).
Don’t worry about reported tracking cookies they are a minor issue and not one of security, allow SAS to deal with them though. - See http://en.wikipedia.org/wiki/HTTP_cookie.
Update: there are a couple of other detections on that link in the image, this is on the favicon.ico file (see image1) and that give me the impression that this site has been hacked.
avast isn’t alone in not liking the two alert files, see http://www.virustotal.com/analisis/83ab73f257238076f986298413ee6afb7574d03566cde962393f07829c7484e9-1263583887, one of the favicon.ico files.
and http://www.virustotal.com/analisis/56ad9e3bf3a8e7f1d9bf3b03ed61edd32735c8d66ca0b90f06d6b3b180c3e5de-1263583948 related to the main alert image you posted.
So if this is one of your feeds then it looks like the site has been hacked.
Yupp apparently copyriot was one of my feeds, deleted it and problem seems to be gone.
Thanks a lot everyone for your help!
You’re welcome.
I would suggest you drop copyriot.se an email about the possible hacking of their site.