virus at a website that I visited

Viruses and worms
1

Hi

I have been recently visiting a web site from my home computer on which I have Avast Home Professional ( Free ) Edition 4.8 installed and it has not complained about the virus “WW: Trojan.Dldr.QCut.2” being present on that website.

However, I have tried to access the same website at a workplace and the virus scanner at work picked up about the virus on that website and prevented me from acceessing the website.

I relly love Avast. But would love to know if this virus from that is a false positive or if virus is really present on that website.

I have also been using Norton Internet Security on my home computer since last year. But found it to be not so good and have not renewed my subscription this year.

If Avast can give me some information about the Trojan “WW: Trojan.Dldr.QCut.2” from the particular website, I would like to purchase the Professional Edition hoping that it will give me 100% protection.

I have not mentioned the particular website that has the Trojan mentioned in this post as I am not sure if it is allowed. If it is okay to mention the website name I will post it later.

Regards

2

Yes, it’s actually beneficial that you post the link to the website that you visited. Just be sure to change the URL to “hxxp” instead of the real “http” so as not to infect others.

It could possibly be a false positive, but we won’t know until we actually see what’s causing it.

Thanks!

3

The website is hxxp://www.ozusenet.info

I have used hxxp instead of http as suggested.

Regards

4

Thanks for providing the link MrBilla,

I see that nothing bad was detected by avast. Also, bad stuff detektor couldn’t find any malicious iFrames either. http://jutaky.no-ip.org/index.php?option=com_content&task=view&id=19&Itemid=32

I’m unable to right-click on their website to view their source code, to find anything further, probably because they have some sort of script that disables the “right-click”.

However, since the site has to do with usenet, there is a possibility that some sort of virus might be on their page. Unfortunately, I don’t know how else to scan the site to find any malicious code.

If there are any, I hope that we could provide it to avast to improve detections.

Avast is pretty good with this sort of thing, so I’m hoping that it’s just a false positive by Norton Internet Security (which is almost worthless in my opinion) and that it’s ok to visit that site. I’ll leave it to others that can give us more suggestions.

As of right now, I’m thinking that it’s ok to visit the site. Just be careful as to what you download.

Oh, and thanks for “de-activating” the URL, it’s much appreciated.

5

Actually, I opened the site with firefox and was able to look at the source code.

There is a strange script running in the header of the website, and it maybe what Norton is complaining about.

See attached photo.

6

Actually, it is not Norton on my home computer that is compalining about the virus on that web site. Its the virus checker at a company that I have worked recently. I do not know what software they use. It is some sort of virus checker on the proxy that picked this up. If Norton was to pick this up I would have been happy because I use Norton at home. Norton does not pick up anything on my home computer. I have to rely on Avast to protect me.

Regards

7

I looked at the ‘strange’ script briefly, it looks like obfuscation which is there by purpose. So it seems like a FP of another product, not avast’s omission.

8

Hi MrBilla,

I am not sure about this bit of code there:

 for SECURITY<SCRIPT LANGUAGE="J*v*Script"^^!--
document.write(unescape("%3C%53%43%52%49%50%54%20%4C%74%75%72%6E%3B%7
[snippage]
3C>-QAPKRV%3C"));//--></SCRIPT>
	<title>OZusenet.info MAIN^/title^

polonus

9

Polonus, after the deobfuscation the normal code of ozusenet is seen. I don’t understand this kind of paranoic obfuscation, but sometimes it’s there…