Broadband Tech > Security > Security > Ursula Andress has a trojan, please say it ain't so

Ursula Andress has a trojan, please say it ain't so

Nothing pops up here for me running NOD32. Gallery 1 or any of the others. Oh and I should add using Firefox

Edit: Perhaps Pops up was not a good use of the term. lol

Edit 2: I tried on a system running KAV7 using Fx and IE 7 and nothing.

Running MVPS Hosts file too so that might have some affect.

reply to Link Logger
The privoxy action file that I use has the entire geocities.com domain blocked. Looks like the author has knowledge of more than one problem there. It's the first time, that I've noticed, that it blocked me from a site. I've been using it for at least a month, but my surfing is pretty tame.

reply to Link Logger
FWIW, LinkScanner doesn't find anything.

reply to Link Logger
Just clean out your TIF and move on.

Detailed Description
Agent.A is a trojan-clicker that attempts to redirect infected machines to specified advertisement websites, which results in unwanted pop-up advertisements and banners displayed on the machine.

Generally, trojan-clickers redirect the user's machine to specified websites in the Internet. This is done to generate high hit counts on those specified websites as part of its advertising agenda.

Agent.A arrives on the system as an HTML script file in the Temporary Internet Files directory.

Upon execution, it will only display a blank web page to hide its actual content.

It attempts to bypass pop-up blockers such as the following:

Norton Internet Security popup blocker
Internet Explorer Popup blocker

It also adds the following cookie:

PayPopUpAds

This is used to track user's browsing habits.

Detection
F-Secure Anti-Virus detects this malware with the following updates:

[FSAV_Database_Version]

Version = 2006-02-06_01.

»www.f-secure.com/v-descs/agent_a.shtml

Generally, trojan-clickers redirect the user's machine to specified websites on the Internet. This is done to generate high hit counts on those specified websites as part of its advertising agenda. Trojan-clickers may also be used to cause Denial of Service attacks or may be used to link the user to infected or malicious websites.

Microsoft makes it easy to compare and contrast its descriptions by providing cross-references to other vendors' names for a particular threat. For example, the threat that Microsoft displays as Trojan:JS/Agent.FA is known variously as Trojan-Clicker.HTML.Agent.a (Kaspersky), Troj/Clicker-EB (Sophos) or Trojan-Clicker.HTML.Agent.a (Sunbelt Software).

example:

C:\Documents and Settings\Your Name\Local Settings\Temporary Internet Files\Content.IE5\G1MR8LUF\popup[1].php Infected: Trojan-Clicker.HTML.Agent.a skipped
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/

reply to Link Logger

reply to Link Logger
ClamAV Blocks the tag at the top of each Gallery for me.

FireFox/Dansguardian/Clamav

BTW She has always been Hot... and
I'm still young...

reply to Link Logger
Ursula Andress carries Trojans?

Nothing like always being prepared...

reply to Link Logger
If you are Ursula Andress you can do a trojan or two if you want to!
--
☛ "The future is not what it used to be" ☚

reply to Link Logger
Backdoor trojan? Better bring in Mcaffee stinger!