Le blog sécurité de Philippe Vialle / Phil Vialle's blog

I was just looking for Google images of an american actor of a serie. Then my browser was trapped, as one of the Google Image results lead it to:

http://www.google.fr/imgres?imgurl=http://www.celebritylatest.com/wp-content/uploads/premieres/marg_helgenberger_mr_brooks_premiere_3.jpg&imgrefurl=http://www.mainstream.fr/img/-%%%%%-dating.html&usg=__grAZHQrnfxcFdhmvNprdLlOKD70=&h=808&w=1000&sz=70&hl=fr&start=17&sig2=jTOL3-NJ0X06PCeKxHJQ0Q&zoom=1&tbnid=SBAcGCvMS_01OM:&tbnh=120&tbnw=149&ei=KJXZTYXXMoub-gbgwuHGAQ&prev=/search%3Fq%3D

and celebritylatest.com has most likely been hacked. Therefore, my browser went to: http://bervert. osa.pl/2.php 

I came to that link:

http://www1.smartyauscanner .co.cc/6zf9gss?jtkay6=jt3j2t6hsNrF1uzyw5vozMWroZeqkOTUxbZpmc7D1Oa2sci6ic3hq5aioZra1Lat6aSH1N3dntfSpsng3dLXkO3lxdxz3dPQ6Nfih9jWoKfAlM7ip6ydj6tpqpuSqaenkq2Z1tXP4trlp6WR2OKasKWYpZrt1eGwl5Keo5mjnKXQl7Jc5%2BCeo6epl6ajlpOjpovW2eHMyudz6uTYpaLswuvYxcna0srYz%2BLexqeipeWP1%2BmfyeTbyp7n1c7T2Zrdxt9z2%2BHV4pmsopqlqYagtMfX3OrQ0%2B1k4uDCoOTlhqe5lY%2Fe1tWW

There is first a nice warning, telling me my computer was at risk of being infected by a malware...

Then, whatever I do, my browser will be send to this webpage:

There is also another URL that does the same:

http://www1.powervorsoft .co.cc/j48zmy?1rdgeik=Vd%2FN1KLSzNjS3Ivn39OvpqGemqHbyKSYj8zS0emiwsm2mN%2Fio6VhqIrW2Kbi5qadx9varNTSss7moN%2FJjdDY2NvhtMfs69Tq2t%2BM15SvqrmL0tutp6mTpKmmoKSmmaJiqora2crf5eK0i%2Bnf06%2BrppmapebQpJmam6WjqJej26WrmePZsWKllJ2WmZ%2Bioq6L1uXc09zdo%2Buo6ZeV2Mrh1dHf0dbb1dfh4suinaTclcrekejg28rTs%2BLl3NjJ3KKY1szLptPk4%2BeKpbeUpLmUmLqT19bdytvfnt7qxqDm25eltZiiodrUiw%3D%3D

Now, obviously, if I click on the "remove all" button (which I do NOT recommend you to do), an exefile shows up as a download... how interesting!

Here is the real URL of the website hosting the file:

http://www2.save-mastermme .byinter.net/qjsh106_328.php?kan9=j87XprDK182Q0ofo3cmvoJ%2BdkdHXnbCUnMaPz9OwxLi5k9nYqJKeb5nQ6aKk45iZ1s7Wqs%2FErsngqODGnNCc2szlscfs4tLd0tGUnNaevLdT1tGwrJegn6CcmZKlbKGSroug4cLn6divk%2BTOz56mcKaH6tmZqpWkpJqmnp%2BW0JenX%2BfUs5ZgnZekpJmkoKSLz9DbmtzPs9yk5JSh58bo0s%2FN18XTn9jP6cpb2ZProsrnk%2BXWz8bPdubU386Q1dKZ5srYqtXZ39GTbLSGqKtSn6fV2dfo0t%2FZmdDhmqHR4opfs5Oh5M3ik%2BDazaTbnbDU29ORs8rf2Yk%3D

What does VT says for this sample, well... only 10 out of 43 engines do detect it :(  and Kaspersky Security Network did not help.

http://www.virustotal.com/file-scan/report.html?id=e8f307051d84cfc90e5d7a7973a5b9a503136771bee9137325719b840ad28ee0-1306104047

More to come (my cat reminds me time's up :) )

Update 1 (24 hours later):

Chromium does alert while trying to access the URL:

Update 2 (48 hours later):

Only 2 URL scanners do detect the URL, according to VT:

http://www.virustotal.com/url-scan/report.html?id=8a27b11a8ec194015b0bd305ca94b5b9-1306353987

And while browsing my disk drive, Kaspersky antivirus did pop up a warning regardng the file that had been downloaded after the "fake antivirus scan":

KAV did not alert by itself, I had to access the folder where the file formerly undetected is.

This proves again it is strongly recommended to let the antivirus software do a full system scan, on a regular basis (at least, very week, or more often if you have any doubt).