[m|dg3t]

That's about the best idea for a virus encompassing site. I was thinking it was blizzards site when I went their, but right as it loads up, Avast tells me it's trying to install a virus. Thank god for Avast!

When you enter into that site it starts a virus download, luckily some anti-viruses recognize it and let you cancel the download before something worse happens. Anyhow you have been WARNED! DO NOT GO TO h.ttp://w.w.w.W.A.R.C.R.A.F.T.3.com (without the random dots to prevent accidental clicking).

 

[Mr.N00bLaR]

EDIT: Hmm.. I'm getting a forum and I have avast, nothing popped up..

 

[CanadaGradeEh]

You tell him not to, so he goes

lolz

 

[ShawnMcGrail]

Is it another one of those .wmf trojans?

Heh, Either way, FireFox pwns n00bs, Because it ALWAYS asks you before you download ANYTHING, Therefor pwning virus also.

 

[Blue_Fire]

lol who wouldnt lol i did an nothing i use avg.

 

[Ch13f121]

lolz I'm on linux right now, so even if it asked me to dl somthing...wouldn't happen

 

[Chillaxed]

well now i just HAVE to go to it

its just a forum...

 

[DataX]

Actually guys he's right...
I went to the the web page and got this:

So I downloaded it and this is what the file was:

I scanned it with nod32, but it didn't come up as a virus:

The files comes from asikral.com, apparently from /clientscript:

Indeed it does, this is what you get when you vist the page for first time:

And when you visit it again, you get this:

I had to use a few proxys to use different ip's and find this..
I also attached the source code of the page before you visit, when it gives you access to the file, and the source after you visit, when it blocks your ip. It's just a big script, dunno what it's supposed to do.
I think I remember reading that Windows had a vulnerability with these files, this might have something to do.

 

[TriplePlay]

Wow, you put a lot of research into this, didn't you DataX? lol

Well it is appreciated. I'll remember not to go there...

 

[DataX]

Quote:

Originally Posted by TriplePlay Wow, you put a lot of research into this, didn't you DataX? lol Well it is appreciated. I'll remember not to go there...

lol, I just found it interesting, and tried to find out what was going on.. took me about 10-15min

 

[marcin123b]

i read script and i think it means to put somthing in your favorites

 

[thecomputerdude]

I'll add something- it's a nasty piece of script that looks like it will add a link to the top of the Favorites list and download a spyware/malware program to boot. I'm not too good at writing script, not fluent at reading it either, but that's just what seemed to stick out about it.