Trojan Horse Warning When Signing On

[Tarhead]

My Avast lit up just now when I was signing in and said: (Don't click on these links!!!!)
4/23/2010 4:09:45 PM SYSTEM 1448 Sign of "JSrontexi-AP [Trj]" has been found in "http://google.analytics.com.scvepuxdfzar.info/kav/kav4.php" file.
So I exited and signed in again and again:
4/23/2010 4:10:03 PM SYSTEM 1448 Sign of "JSrontexi-AP [Trj]" has been found in "http://google.analytics.com.scvepuxdfzar.info/kav/kav4.php" file.

Now it's gone.

 

[Ray Martin]

Thanks Mark. Good advice. Never click on something if you don't know what it is.


Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3

 

[Mt. Gomer]

I had a similar thing happen earlier this afternoon. My suspicion is that one of the ads might be causing the browser to raise the red flag. It's only happened once.... at least for me.
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2)

 

[davejones]

I actually picked up a virus this morning on my work laptop. This is one of the sites I visited, although I am not 100% certain that the virus came from this site. I do know that I did not visit any sites that I don't normally visit and all have been trustworthy to date.

FYI, the virus ended up being "Anti-Spyware Soft" which gives you a fake virus warning and then sends you to their site to buy software to fix the problem.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3

 

[jpr28056]

I just had it happen to me also. It says it's the JSrontexi trojan and from what I read it is coming from one of the ads on the site. My avast scared the heck out of me with the giant pop up window.
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.1.249.1045 Safari/532.5

 

[froglips]

I looked into this a bit. Its a new kind of Malware exploit coming in through advertising services, such as Google. http://forum.avast.com/index.php?PHPSESSID=25444947fd793e2decd1cb43362d24b0&topic=56931.0

Avast anit-virus is doing a decent job of catching these bad ad's.

I'm not sure we can do anything on our end (other than cut off our nose).

URL's like this one are a good indication of trouble: google.analytics.com.scvepuxdfzar.info

It would help to know what ads are at the top and bottom of the page when you get these reports. We can block specific ads due to various content/policy related reasons.

Sorry for the trouble. Looks like all the big players in ad serving are facing this.

Jim
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3

 

[bitbight]

View image in gallery​

Last night when I logged on, my Norton AV blocked an attempt to download a virus to my system. There is a screen capture in my gallery if anyone wants to look at it.

Ray
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 (.NET CLR 3.5.30729)

 

[froglips]

I would like to see it. Couldn't find it in the Photo Gallery. Could you send a link?

Jim
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3