Kaspersky goes wild on submit page

Maria · 2006-09-06, 10:55 AM

Hi there guys, my sweet Kaspersky goes wild when I enter two submit URL's. Seems to be identified as trojans. To be exactly as Trojan-Downloader.JS.Agent.ab
I don't wanna acuse anybody in this early stage, but sure I would like to know how this is possible.
Here are the two url's:
Don't click if you're unprotected because I can't say they're safe or not
I'll post them without the http://www. thing. Fill it in yourself.

thumberland.com/tgp/submit.php
jpegworld.com/tgp/submit.php

Like to hear what you think about this guys....

cd34 · 2006-09-06, 11:04 AM

Both appear to have a javascript exploit at the bottom of the page. That javascript commonly is added by a compromised FTP account.

Just another time to mention -- if you have someone install a script on your website, make sure you change the password after they are gone. You may personally run virus scanners and spyware blockers, etc, but, you don't know what the people that install scripts for you are doing to protect that information.

2006-09-06, 10:55 AM	#1
Maria Aw, Dad, you've done a lot of great things, but you're a very old man, and old people are useless Join Date: Aug 2006 Posts: 25	Kaspersky goes wild on submit page Hi there guys, my sweet Kaspersky goes wild when I enter two submit URL's. Seems to be identified as trojans. To be exactly as Trojan-Downloader.JS.Agent.ab I don't wanna acuse anybody in this early stage, but sure I would like to know how this is possible. Here are the two url's: Don't click if you're unprotected because I can't say they're safe or not I'll post them without the http://www. thing. Fill it in yourself. thumberland.com/tgp/submit.php jpegworld.com/tgp/submit.php Like to hear what you think about this guys....

2006-09-06, 11:04 AM	#2
cd34 a.k.a. Sparky Join Date: Sep 2004 Location: West Palm Beach, FL, USA Posts: 2,396	Both appear to have a javascript exploit at the bottom of the page. That javascript commonly is added by a compromised FTP account. Just another time to mention -- if you have someone install a script on your website, make sure you change the password after they are gone. You may personally run virus scanners and spyware blockers, etc, but, you don't know what the people that install scripts for you are doing to protect that information. __________________ SnapReplay.com a different way to share photos - iPhone & Android