VBS:Malware-gen

DavidR · 2009-01-01T22:03:56.000Z

You’re welcome and a Happy New Year to you too.

system · 2009-01-03T00:16:34.000Z

Hi

I have avast home and everytime I go to this site: http://www.clownclicks.com avast pops up for me to abort connection.

It says Malware name: VBS:Obfuscated-gen [trj]

Malware type: Trojan Horse

VPS version: 090102-0, 01/02/2009

This does not appear in any other sites I go to, just to clownclicks.com
Never had any problems going to clownclicks.com and this virus warning just started about 30 min ago

I asked 3 friends to pull up clownclicks.com and they tell me they do not get any virus warnings.
So why me???

Hope to get answers, thanks!

polonus · 2009-01-03T00:22:51.000Z

Hi I scanned it with DrWeb’s link checker:
Checking: http://www.clownclicks.com/
Engine version: 4.44.0.9170
File size: 10.84 KB

http://www.clownclicks.com/ - Ok

Checking: http://www.clownclicks.com/functions.js
File size: 7390 bytes

Went there with flock browser and NoScript temporarily allowing that site, no alerts (not from avast). So there must be something else wrong. Is your java version up to date?

polonus

system · 2009-01-03T00:24:21.000Z

Does not alarm for me either. Could it be you got installed something bad on your computer? Please, start another thread if you want to get more help.

DavidR · 2009-01-03T00:29:40.000Z

I can visit that page without an alert, I can’t see anything in the page source that might trigger it, perhaps the webmaster found the script and removed it. Or as kubecj said perhaps something on your system.

system · 2009-01-07T09:43:50.000Z

Same here hxxp://www.live-magazine.eu/
Can you check it, please. Thanks

system · 2009-01-07T09:51:22.000Z

Mega-obfuscated script at the end of the page. Not a fp.

system · 2009-01-07T20:23:50.000Z

Hello,

I was looking at my “warning” log, and found the following from 6/23/2008:

"VBS Malware-gen has been found in “http://www.yahoo.com/\unp 113810025 file”

I never received any other notification of this problem, other than just noticing it in the log. I have had no problems, whatsoever, so I am proceeding under the assumption there is nothing to be concerned about. Am I correct? Thank you for any replies and corrections.

polonus · 2009-01-07T21:20:26.000Z

Hi foto,

The live-magazine dot eu link is also flagged by finjan as having malicious code,

polonus

system · 2009-01-10T14:00:46.000Z

I am also getting a VBS:malaware-gen message when visiting what I believe to be a safe company website.

hXXp://www.thelawrencegroup.com/

Filename hXXp://www.thelawrencegroup.com/AC_RunActiveContent.js
VBS:Malware-gen
Virus/Worm
090109-0, 01/09/2009

Please let me know if this is a false positive.

DavidR · 2009-01-10T14:29:39.000Z

There is a big chunk of obfuscated document write (javascript) at the bottom of the script.

I have no idea what that is intended to do or why it would be obfuscated in that way or even if it is meant to be there. Since javascript is meant to be a plain language scripting language when obfuscated in this way I get suspicious at what they have to hide.

So it may well be a legit detection but you could submit it (as a possible false positive) for further analysis.

system · 2009-02-21T20:29:13.000Z

I’m getting this same warning for hXXp://ssbresins.com/. It has the same line of compressed/weird JS as some of these other pages. Just thought I’d chime in.

DavidR · 2009-02-21T20:43:26.000Z

Well if it is your site or one you regularly visit it has probably been hacked.

Considering its location just before the closing Body and HTML taks it certainly looks like code injection into the page.

Please modify your post, changing the http tp hXXP so the link isn’t active, avoiding accidental exposure, e.g. hXXp://ssbresins.com/.

system · 2009-03-02T19:21:07.000Z

Getting Malware-gen for hXXp://icamaxi.se, any idea if it’s a FP?

Thanks

system · 2009-03-02T19:25:58.000Z

Not a false.

DavidR · 2009-03-02T20:05:37.000Z

Nicl@s post:206:

Getting Malware-gen for hXXp://icamaxi.se, any idea if it’s a FP?

As kubecj said not a false positive, a big chunk of javascript (which I have edited to make it easier to see in the image) trying to look like an advert script, but it has an obfuscated link at the end of it. There should be no legitimate reason to do that, e.g. what are they trying to hide.

So it looks like the site has been hacked.

Please modify your post change the http to hXXp to break the link to avoid accidental exposure (as in the quoted text above).

system · 2009-07-14T12:42:22.000Z

I plugged in my digital camera and the virus notification came up and said I had VBS:Malware-gen, so I put it in the virus chest and scanned it and it said it was in this file AutoRun.inf. I just had to completely wipe, format and reinstall vista the other day due to not having an antivirus and the first thing I did when I got it running was download avast. I know for sure theres nothing up with my laptop…

If anyone could help me please do!

DavidR · 2009-07-14T13:12:42.000Z

This is somewhat different to what is covered here, hacked web sites and is for a different malware name.

Please start a New Topic of your own as this seems unrelated to the original subject and will just confuse the topic and we will try to help.
Go to this link, http://forum.avast.com/index.php, scroll down to the Viruses and Worms forum and click it, click the New Topic button at the top of the list and post there.

system · 2009-08-07T16:29:38.000Z

barmon post:194:

It says Malware name: VBS:Obfuscated-gen [trj]

Malware type: Trojan Horse

I clicked on www.thtndc.org
avast 4.8 database 090806-1 08/06 also popped up and warned me of VBS:Obfuscated-gen [trj]
This site was a good one and meant no harm.
Can someone check it please to see if there is any more trojan or malware?

Please also check www.phiatruoc.net as it is a site administered by the same team of the above.

DavidR · 2009-08-07T16:44:44.000Z

Well it tries to install a chat-room-client without asking the user and at best is down right rude and at worst possibly malicious.

It is also creating an applet and an object where it appears to be hiding (obfuscating) what the purpose is and I don’t like what it tries to do directly in the C:\ drive.

avast isn’t alone in thinking there is something wrong with this, http://www.virustotal.com/analisis/d430171aface541b88b199daef5962168ec1686e0ab2d8cb95ea9f85dfecea59-1249663618

Announcements