JS_IFRAME.ZT

This is the Trend Micro detection for Web pages that were compromised through the insertion of a certain malicious script. Once a user visits an affected Web page, this HTML script launches a hidden IFRAME that connects to a malicious URL. However, as of this writing, the said sites are inaccessible.

Other Details

This is the Trend Micro detection for Web pages that were compromised through the insertion of a certain malicious script.

It inserts the following IFRAME code in webpages:

• http://{BLOCKED}z.com/stat.php
• http://{BLOCKED}0.51yes.com/sa.aspx
• http://{BLOCKED}gji123.com/g1.aspx
• http://{BLOCKED}z.com/stat.php
• http://{BLOCKED}s.51.la/1672557.js
• http://{BLOCKED}z.com/stat.php
• http://{BLOCKED}hi88.com/ai/Yes.htm
• http://{BLOCKED}e520.com/wangma/n.htm
• http://{BLOCKED}z.cn/web.htm
• http://www.{BLOCKED}1.cn/428/index.htm
• http://www.{BLOCKED}.cn/61.htm

Once a user visits an affected Web page, this HTML script launches a hidden IFRAME that connects to a malicious URL.

However, as of this writing, the said sites are inaccessible.