Virus alert!!

[Oldmoparguy1]

I got the HTML/Framer virus from http://www.turbomopar.com this morning. (also called HTML/Framer Z virus. Not sure all the details yet, but AVG 7.5 found it on a full scan. Also Opera V9.25 also found it in the browser cache.

At first glance, it appears that this thing contains a password harvester and who knows what else.

Best check your systems ASAP...
At come point, it modifies a whole bunch of files with this code:
Quote:
?>


This apparently is coming from infected web sites and appears to be widespread.

 

[daman]

Did you have any simptoms with this infection??

 

[Oldmoparguy1]

Quote:
Did you have any simptoms with this infection??


Not so far as I can tell. AVG saw it as soon as it loaded. I've been researching it and it looks like it appeared in early March, but just got really active in the last few days. Even the AVG web site appeared to be infected at some point.

This was in my lap top.

My desktop is also infected and we are scanning it now.

Google has lots of hits for HTML/framer Z virus.

I'll post anything else I find.

 

[TooManyWheels]

According to this post from the Grisoft AV forum

http://forum.grisoft.cz/freeforum/read.php?4,120492,sv=

that virus is recognized by all the major AV packages, but under other names.

So your Google hits on HTML/Framer will probably only reflect interactions with AVG.

 

[daman]

Originally Posted By: Oldmoparguy1

Quote:
Did you have any simptoms with this infection??


Not so far as I can tell. AVG saw it as soon as it loaded. I've been researching it and it looks like it appeared in early March, but just got really active in the last few days. Even the AVG web site appeared to be infected at some point.

This was in my lap top.

My desktop is also infected and we are scanning it now.

Google has lots of hits for HTML/framer Z virus.

I'll post anything else I find.

Than you for the heads up,going to do a AVG scan now..

 

[daman]

I see AVG has a new ver. out soon, 8.0,,make sure you guy's
update

 

[Drew99GT]

http://www.pcworld.com/article/id,145151-c,hackers/article.html

If you use this product, http://www.sandboxie.com , none of this will be a problem.

 

[ToyotaNSaturn]

add this to your hosts file:
127.0.0.1 xanjan.cn

If you're not infected, problem solved, for the time being.

 

[Oldmoparguy1]

Originally Posted By: ToyotaNSaturn
add this to your hosts file:
127.0.0.1 xanjan.cn

If you're not infected, problem solved, for the time being.


What does that do?

 

[ToyotaNSaturn]

redirects the server xanjan.cn to the loopback adapter which is included as a software test that's on the localhost. I should have put the following:

127.0.0.1 xanjan.cn http://www.xanjan.cn

More info on the hosts file as a defense mechanism: http://www.mvps.org/winhelp2002/hosts.htm

 

[Oldmoparguy1]

Thanks TNS!

 

[ToyotaNSaturn]

No problem!

For some reason, this board inserted the "http://" before the xanjan address. Do *not* put the "http://" in your hosts file.

 

[NJC]

I did not realize viruses can run from Google's cache.

 

[97tbird]

That's not for the FREE version.
one has to buy 8.0
free version is still 7.5

http://www.grisoft.com/ww.special-get-new-avg-8-app-freecnv.tpl-mcr1
Originally Posted By: daman
I see AVG has a new ver. out soon, 8.0,,make sure you guy's
update

 

[Drew99GT]

AVG free version 8 is out and looks pretty good! Essentially, it is AVG free AV 7.5, AVG antispyware paid version 7.5, and linkscanner lite combined. So the free version now has antispyware included.

http://www.wilderssecurity.com/showthread.php?t=207173

http://free.grisoft.com/ww.download-avg-anti-virus-free-edition

They are doing away with AVG antispyware free.

 

[97tbird]

ooops. my mistake.
there IS an AVG 8.0 free.
DANG it's 45 MB!

 

[Oldmoparguy1]

Well! It looks like this virus is an exploit of the iframes security hole in IE. I'm not sure if it has any effect on other browsers.

 

[97tbird]

i'm running an AVG scan right now. none found yet.
(I use FF 99% of the time)

 

[97tbird]

nothing found.

 

[Oldmoparguy1]

That's good news.

The desktop had something different on it. AVG cleared it. Looking at the daily scan results for the month, I find that AVG has cleared 4 other nasties!