JS_REDIR.YUZ

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It may be unknowingly downloaded by a user while visiting malicious websites. It may be hosted on a website and run when a user accesses the said website.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system. As of this writing, the said sites are inaccessible.

This is the Trend Micro detection for Web pages that were compromised through the insertion of a certain IFRAME tag. Once a user visits an affected Web page, this HTML script launches a hidden IFRAME that connects to a malicious URL.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It may be unknowingly downloaded by a user while visiting malicious websites.

It may be hosted on a website and run when a user accesses the said website.

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://online-{BLOCKED}ity.ru:8080/forum/showthread.php?page=3ff54f2d2ccf3428

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

As of this writing, the said sites are inaccessible.

Other Details

This is the Trend Micro detection for Web pages that were compromised through the insertion of a certain IFRAME tag.

Once a user visits an affected Web page, this HTML script launches a hidden IFRAME that connects to a malicious URL.