JS TrojanDownloader on opkg.org?

Alex (Maxious) Sadleir maxious at gmail.com
Wed May 12 12:40:49 CEST 2010


On Wed, May 12, 2010 at 7:55 PM, Thomas Franck <thomas.franck at gmx.com> wrote:
> Hi..
>
> I was just going to have a look at something on opkg.org when my NOD32
> came up with this warning (work PC ;) ):
> ---------8<------------
> 12.05.2010 11:50:48     HTTP filter     file    http://www.opkg.org/
> JS/TrojanDownloader.Pegel.AP trojan     connection terminated - quarantined
> ---------8<------------

Not a false positive. opkg.org definately has had malicious code added
to it after the </html> tag. The javascript attempts to access
http://crewamerica.ru which Norton verifies is a malicious site
http://safeweb.norton.com/report/show?name=crewamerica.ru



More information about the community mailing list