2 replies to this topic

[Malware Sucks]

I go on the Yahoo! Answers forums a LOT and somebody keeps posting a link to an infected "video" to help people with their problem. I'm not sure if Malwarebytes detects the site or the infected file, so here ya go.

The site he links people to is: hxxp://browsershots.org/png/original/f9/f9f39bf9fb73a566dd8fbaa6f07e386e.png (http changed to hxxp)

I went to BrowserShots to get a picture of the site so here's the pic (safe): http://img237.imageshack.us/img237/295/f9f...6dd8fbaado8.png

The site is dangerous and the file that is downloaded should be flagged as infected.

[sho-dan]

Malware Sucks, on Nov 21 2008, 07:57 PM, said:

I go on the Yahoo! Answers forums a LOT and somebody keeps posting a link to an infected "video" to help people with their problem. I'm not sure if Malwarebytes detects the site or the infected file, so here ya go.
The site he links people to is: hxxp://browsershots.org/png/original/f9/f9f39bf9fb73a566dd8fbaa6f07e386e.png (http changed to hxxp)
I went to BrowserShots to get a picture of the site so here's the pic (safe): http://img237.imageshack.us/img237/295/f9f...6dd8fbaado8.png

The site is dangerous and the file that is downloaded should be flagged as infected.

Next time you see this link posted, report it to the mods.

This link provides the k-codec281.exe which WinPatrol picks it up as a new startup xxx82227.exe and this file is detected/removed by MBAM only, the site is a different matter

Developer mode log:
Malwarebytes' Anti-Malware 1.30
Database version: 1416
Windows 5.1.2600 Service Pack 3

11/22/2008 6:21:20 PM
mbam-log-2008-11-22 (18-21-20).txt

Scan type: Quick Scan
Objects scanned: 46324
Time elapsed: 2 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\MSFox (Trojan.Agent) -> Quarantined and deleted successfully. [3857535134305383807566791534727079851301414438586445483634456446343641424738615
2483953563451386146809174777766614652398089]

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[JeanInMontana]

MBAM deals with Zlob very well, but does not block sites at this time, notifying Yahoo might help, the poster should have their account deleted for posting links to malware.