Trojan.HTML.REDIR.F

This Trojan may be hosted on a website and run when a user accesses the said website.

It redirects browsers to certain sites. However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan may be hosted on a website and run when a user accesses the said website.

Other Details

This Trojan redirects browsers to the following sites:

• http://{BLOCKED}s-forever.freehostia.com/e107_handlers/news.php
• http://{BLOCKED}palim.com/_vti_script/2.php
• http://{BLOCKED}s.canal-si.com/fotos/encuesta.php = mal 1
• http://{BLOCKED}mistry.net/download/_vti_inf.php
• http://{BLOCKED}lass.ru/res/401.shtml.php
• http://{BLOCKED}ius.com/images/gifimg.php
• http://{BLOCKED}eher.com/my_mod/browsePhoto.php
• http://{BLOCKED}rylavandia.co.cc/wp-includes/wp-cron.php = mal 4
• http://{BLOCKED}lnye-znakomstva.co.cc/wp-includes/readme.php = mal 3
• http://[BLOCKED}mmyhome.net/.AppleDesktop/.php
• http://{BLOCKED}9.us/wp-includes/xxxbigdump.phpxxx.php
• http://{BLOCKED}roy.ru/been83/index.php
• http://{BLOCKED}mal88.webphoto.ir/photos/NotExistc.php
• http://{BLOCKED}u.com.ua/t2/headerMainPagew.php
• http://{BLOCKED}nejosalegres.com.ar/ferozo/presentacion.php
• http://{BLOCKED}no.ru/russ/russian.php
• http://{BLOCKED}it.org/images/contact-bereavement.php
• http://{BLOCKED}f.fr/telechargement/img/njobjg.php
• http://{BLOCKED}one.info/include/reseau.php
• http://{BLOCKED}ldtiming.com/wp-admin/simplescriptsbkup_G6yhu46M_1263754178.php
• http://{BLOCKED}onecomputers.com/ronak/text.php
• http://{BLOCKED}s.com/images/product7.php
• http://{BLOCKED}lecom.pl/telefony/403.shtml.php
• http://{BLOCKED}zza.ru/goods_pictures/install.php
• http://{BLOCKED}ubbhopallakecity.com/buttons/pres_profile_15.php
• http://{BLOCKED}hi.com/sql/profile.php
• http://{BLOCKED}-v.eu/frames/index.php
• http://{BLOCKED}h.rock.tuzonavirtual.com/img/index.php
• http://{BLOCKED}nging-word.com/_vti_bin/scarf21.php
• http://{BLOCKED}ka.ru/valentin/captcha.php
• http://{BLOCKED}aldiagnostic.techno-path.com/images/gifimg.php
• http://{BLOCKED}a.hi2.ro/index.php
• http://{BLOCKED}td.com.tr/yonetim/firmalar.php
• http://{BLOCKED}e.ge/engine/admin.php
• http://{BLOCKED}lier.com/panel/product.php
• http://{BLOCKED}ukula.com/yahoo_site_admin/index.php
• http://{BLOCKED}plata.com.ar/asociarse/capacitacion_s.php
• http://{BLOCKED}-tours.gr/images/p5yyd/3.genika.php
• http://{BLOCKED}n.it/images/offline.php
• http://{BLOCKED}mucusari.com/mucusari-vacacional/enviar.php
• http://{BLOCKED}mucusari.com/mucusari-vacacional/e
• http://{BLOCKED}y.com/wp-content/wp-blog-header.php
• http://{BLOCKED}ie-huis-drenthe.nl/css/.ftpquota.php
• http://{BLOCKED}p.com/images/gifimg.php
• http://{BLOCKED}photo.com/images/gifimg.php
• http://{BLOCKED}phics.com/highcottonboutique/servicetext.php
• http://{BLOCKED}mal88.webphoto.ir/photos/NotExistc.php

It does the following:

• The malware will proceed with the redirection, every time it is used/loaded by a webpage visited by the user.

However, as of this writing, the said sites are inaccessible.