Trojan clicker?

Avatar

Please consider registering
Guest

Search

— Forum Scope —






— Match —





— Forum Options —





Minimum search word length is 3 characters - maximum search word length is 84 characters

Register Lost password?
sp_Feed sp_topic_old
Trojan clicker?
Avatar
joel2007
Member
Forum Posts: 35
Member Since:
October 4, 2010
sp_UserOfflineSmall Offline
1
October 6, 2010 - 3:09 am
sp_Permalink sp_Print

Hello, my AV software caught it before it had a chance to infect my PC.
[img:11uo972z]http://img188.imageshack.us/img188/6988/trojanclicker.png[/img:11uo972z]

I do a research about [COLOR="blue"]fiji water[/COLOR] using google search. I see the website which is:
[code:11uo972z]hxxp://structuralevolution.org/blog/2008/06/05/avoid-fiji-water-unless-you-like-arsenic/[/code:11uo972z]
After I clicked on the website link. My AV software detected the Trojan.
My question is:
I did not download or click on a download link or install anything. How can the virus attack my computer?

Avatar
grr
Member
Forum Posts: 211
Member Since:
April 26, 2010
sp_UserOfflineSmall Offline
2
October 6, 2010 - 3:49 am
sp_Permalink sp_Print

looks like it is a script based virus/trojan.

[quote:3otvf5zg]Programs classified as Trojan-Clicker are designed to access Internet resources (usually web pages). This is done either by sending appropriate commands to the browser or by replacing system files that provide

Avatar
Jim Hillier
Admin
Forum Posts: 2492
Member Since:
August 9, 2011
sp_UserOfflineSmall Offline
3
October 6, 2010 - 4:26 am
sp_Permalink sp_Print

Hey Joel - Grr is correct. The site in question has most likely been affected by what is known as a 'drive-by' infection.

I just accessed the site myself, from Firefox within a sandbox (virtual environment) and Avast issued me with a warning that it had just blocked a malicious site.

The site is actually rated Green (safe) by leading site advisory services so it would almost definitely be some outside influence.

One of the very reasons we need strong security...and some brownie points for your AV software methinks!

Cheers....Jim

Avatar
David Hartsock
Admin
Forum Posts: 1105
Member Since:
August 7, 2011
sp_UserOfflineSmall Offline
4
October 6, 2010 - 4:27 am
sp_Permalink sp_Print

Grr has the right idea. Out of curiosity what browser were you using?

Avatar
joel2007
Member
Forum Posts: 35
Member Since:
October 4, 2010
sp_UserOfflineSmall Offline
5
October 6, 2010 - 3:16 pm
sp_Permalink sp_Print

Grr has the right idea. Out of curiosity what browser were you using?[/quote:28n2a3ke]
I'm using FF.
Is there a way to know the website has virus before click on the website link? I don't want to be got hit again when I do my research.

Avatar
Jim Hillier
Admin
Forum Posts: 2492
Member Since:
August 9, 2011
sp_UserOfflineSmall Offline
6
October 6, 2010 - 5:10 pm
sp_Permalink sp_Print

Joel,

There are plenty of online services which will check a site/link for malware for you. All you are generally required to do is just copy and paste (or type) the URL into the dialogue box and then click on a 'Scan' (or similar) button.

Dr.Web has one [url=http://online.us.drweb.com/?url=1:1j0fslv8]HERE[/url:1j0fslv8]
AVG has one [url=http://linkscanner.explabs.com/linkscanner/avg/:1j0fslv8]HERE[/url:1j0fslv8]

Another way to protect yourself would be to use something like Sandboxie, I use it all the time. Each time you run it Sandboxie sets up a temporary virtual environment. Select the option to 'Run Web browser sandboxed' and just surf as usual. When your session is over just delete the contents of the sandbox and everything is gone; history, downloads, added bookmarks, any malware, everything.....nothing gets near your system.

Of course that would mean, if you wanted to retain any info, you would need to take notes during sandboxed browsing and re-visit any worthwhile sites normally.

Your security programs and any site advisory service will still operate as per normal during the sandboxed browsing session and continue to issue warnings, except any malware will be contained (imprisoned if you like) within the sandbox.

Sandboxie is free, [url=http://www.sandboxie.com/:1j0fslv8]Sandboxie Home Page[/url:1j0fslv8]

Cheers....Jim

Avatar
joel2007
Member
Forum Posts: 35
Member Since:
October 4, 2010
sp_UserOfflineSmall Offline
7
October 6, 2010 - 5:41 pm
sp_Permalink sp_Print

Dr.Web shows clean: http://online.us.drweb.com/cache/?i=651 ... f1d3233c59
AVG shows clean: http://linkscanner.explabs.com/linkscan ... e-arsenic/

Avatar
Jim Hillier
Admin
Forum Posts: 2492
Member Since:
August 9, 2011
sp_UserOfflineSmall Offline
8
October 6, 2010 - 6:18 pm
sp_Permalink sp_Print

Joel - Just re-visited the site in question (from the link you posted originally) and it is indeed now clean. No warning from Avast nor any warnings from any of my other security software.

This is the nature of these drive-by threats...here today, gone tomorrow!!

Cheers....Jim

Avatar
David Hartsock
Admin
Forum Posts: 1105
Member Since:
August 7, 2011
sp_UserOfflineSmall Offline
9
October 6, 2010 - 6:38 pm
sp_Permalink sp_Print

Websites actually live on a remote computer. As such they are susceptible to similar issues if the owner of the computer doesn't use strong passwords and keep the underlying software up to date.

There was probably an underlying software vulnerability, or the site owner did not have a strong password. This would allow a third party access to the content on the server. When this happens they usually place a script on the site which downloads items to your computer, and place the actual site in an iframe. The download happens in the background without the visitor's knowledge and the site displays at normal - Yes, they are a sneaky bunch, which is why security software and safe practices are important!

Avatar
joel2007
Member
Forum Posts: 35
Member Since:
October 4, 2010
sp_UserOfflineSmall Offline
10
October 6, 2010 - 8:58 pm
sp_Permalink sp_Print

Thank you .

Avatar
grr
Member
Forum Posts: 211
Member Since:
April 26, 2010
sp_UserOfflineSmall Offline
11
October 7, 2010 - 2:35 am
sp_Permalink sp_Print

what AV u have?

Forum Timezone: America/Indiana/Indianapolis

Most Users Ever Online: 188

Currently Online:
9 Guest(s)

Currently Browsing this Page:
1 Guest(s)

Member Stats:

Guest Posters: 10

Members: 1273

Moderators: 3

Admins: 4

Forum Stats:

Groups: 8

Forums: 19

Topics: 1538

Posts: 11824

Administrators: Jim Hillier, Richard Pedersen, David Hartsock, Marc Thomas

Moderators: Judy Novotny, Jason Shuffield, Mail Poet