Warning! The ASCnet site maybe infected with a Virus.

Ben Thoele · February 18, 2013, 11:32:32 AM

Sophos AV kicks out the following warning when I visit the ASCnet site.

Virus/spyware 'Troj/Iframe-JG' has been detected at "www.ascnet.org/AM/HierMenu/HM_ScriptDOM.js"

Ben Thoele · February 18, 2013, 12:03:44 PM

Sophos Labs confirmed that the ASCnet.org is infected with Troj/Iframe-JG.

Aaron over at ASCnet is working with their web hosting provider to get it resolved. He said he would email me when it's fixed. I will follow-up when I hear from him.

Charlie Charbonneau · February 18, 2013, 12:16:18 PM

Yikes! Is that the free stoof you get with membership?!

DebAmstutz · February 18, 2013, 12:37:26 PM

Here are a couple of questions from someone not well-versed on the topic of virii.

How does a site like that (or any) become infected?

How would it get passed to me if I visit the site?

I delete email when I do not recognize the sender, and as far as I know, I've not had any virii on my workstation. Seems like everyone else in the office has had to be "disinfected" but not me.

Jim Jensen · February 18, 2013, 12:48:35 PM

Deb, lots of websites have malicious software that have become imbedded in them. A lot of sites run small programs (scripts) in order to make them look nice or have certain functionalities. Some use Java, while others use Flash. These scripts run on your computer. This is why you've seen the warnings about issues with Java and that you need to either disable it, or apply a patch (when they are available). If someone infiltrates and website and leaves behind malicious coding, it can run on yours just by going to the website. Email is only one way to obtain a nasty on your computer.

Ben Thoele · February 18, 2013, 12:54:29 PM

Quote from: DebAmstutz on February 18, 2013, 12:37:26 PM
Here are a couple of questions from someone not well-versed on the topic of virii.

How does a site like that (or any) become infected?

How would it get passed to me if I visit the site?

I delete email when I do not recognize the sender, and as far as I know, I've not had any virii on my workstation. Seems like everyone else in the office has had to be "disinfected" but not me.

Here is a great You Tube Video I showed our staff to help understand this.
http://www.youtube.com/watch?v=EK6BBYmiVpo&feature=share&list=PL4E9816850A80ED8E

I wouldn't visit ASCnet, for now, unless you are prepared to reload your computer. And that's the rule of thumb I use for all internet browsing at work. Is the site "work related" and or, am I willing to deal with the repercussions. Since there is no 100% safe web surfing I advise users to browse based on a cost/benefit analysis. Is the site I'm going to worth the potential risk to my work computer. If a user is infected from a vacation site, then they are in trouble. If they get a virus from Travelers.com then they are O.K. because that's a cost of doing business. Hopefully you're not paying to rebuild computers so your employees can plan their vacations at work.

Marie (Zionkowski) Gozikowski · February 18, 2013, 01:15:21 PM

Ben - what a great link... thanks for posting it! I am going to have my users watch them all :-)

Lynne Desrochers · February 18, 2013, 01:17:07 PM

Hey, how do we know that link is safe? : )

Ben Thoele · February 18, 2013, 01:41:26 PM

Quote from: Lynne Desrochers on February 18, 2013, 01:17:07 PM
Hey, how do we know that link is safe? : )

Good Question. I look at the domain, in this case It's www.youtube.com which I trust. If I receive an Insurance Marketing email and the link points to www.hellspawn.com I don't click on it. If you can't see the link you can "mouse over" or hover over the link to see where it points. This way you to inspect the link before you click on it. An email from Travelers.com should include links to www.Travelers.com/whatever not to www.russianmalwarehost.com/virus or whatever.

Does that help?

Marie (Zionkowski) Gozikowski · February 18, 2013, 01:47:14 PM

I have Youtube blocked at work, but it looks like you can also view these videos directly from Sophos' site:

http://www.sophos.com/en-us/security-news-trends/anatomy-of-an-attack.aspx

Ben Thoele · February 18, 2013, 01:55:54 PM

Looks like the Ascnet site is fixed for now. At least they made a change and when I go there it's doesn't set off our AV.

Surf at your own risk!

Bloody Jack Kidd · February 18, 2013, 07:26:11 PM

It can happen to many sites, although often enough the malicious content is actually served from a site other than the one you are visiting. In this case it could be a few things, like Sophos getting a bit too paranoid, in which case the javascript in question may not be as dangerous as this makes it appear.

Another possibility is that the site has been compromised and malicious code has been planted there.

I would point a finger a snicker, but this can and does happen to even the most well-run and secure sites. In fact, recently Bit9 a company on the bleeding edge of application white listing got hacked and delivery malware out to their own clients.

Gene Foraker · February 19, 2013, 10:36:29 AM

I don't know how the message board get a virus, but don't forget that there is a "files" area where you can download files. There may have been something there.

Mark · February 19, 2013, 11:00:53 AM

Interesting. So, the .js file was probably compromised? I looked at that file and realized that I don't read JavaScript files, but it looked like it was trying to determine what type of browser you were using.

Bloody Jack Kidd · February 19, 2013, 11:03:51 AM

Quote from: Mark on February 19, 2013, 11:00:53 AM
Interesting. So, the .js file was probably compromised? I looked at that file and realized that I don't read JavaScript files, but it looked like it was trying to determine what type of browser you were using.

browser / platform id is a very common javascript trick - nothing malicious about that in and of itself - but malicious sites looking to exploit a system will often first determine what you are running and then deliver the appropriate payload.