exploit

nod32 IMON caught this

Code:

hxxp://66.246.72.200/index.php	HTML/Exploit.IESlice.NAC trojan

ideas anyone?

 

That link just delivers the following code here (at the moment)...

Code:

<script language="JavaScript"> window.location.href = "hxxp://spl/" </script>

Cheers

 

I am not a professional AV examiner, but it looks like a virus to me. The payload is in another file that is downloaded. The virus tries to make a connection to the Internet and/or use FTP. It also inserts itself into the registry so that it will start when the computer is booted, possibly called ShareSearcher or SSearcher. Another thing is does is run a "net view" command and saves it to the c:\nv directory. One other thing it does it to install a file, wsusupd.exe, in the c:\ directory with the hidden file attribute.

-John

 

They're enjoying themselves changing it at will and now it's Google...at the moment

 

interesting .. and i dont even know how i got it, have only been to the usual websites