English

Log in

Search

The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service.

Internet threat level: 1

Follow us on

Home→Descriptions→Trojan.JS.Fraud.ao

Trojan.JS.Fraud.ao

Detected	Aug 18 2010 17:27 GMT
Released	Aug 19 2010 03:57 GMT
Published	Oct 22 2010 12:18 GMT

Technical Details
Payload
Removal instructions

Technical Details

This Trojan opens different web sites in the browser without the knowledge or consent of the user. It consists of a Java Script. It is 531 bytes in size.

Payload

When a page infected by this script is opened, the Trojan uses the following meta tag:

META HTTP-EQUIV = "REFRESH"

to redirect the user to the following site:

http://www.resi***techniek.nl/x.html

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
Empty the Temporary Internet Files directory, which may contain infected files (see How to delete infected files from Temporary Internet Files folder?).
Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

MD5: FE5A171F29345A285FCDBA0D7EA567B9
SHA1: 8E3AC520EF226516DB9B4EA159C24F15E56E0DFA

Print

Share

Malicious programs

Trojans

Trojan

This type of behaviour covers malicious programs that delete, block, modify, or copy data, disrupt computer or network performance, but which cannot be classified under any of the behaviours identified above.

This classification also covers “multipurpose” Trojan programs, i.e. those that are capable of conducting several actions at once and which demonstrate several Trojan behaviours in a single program. This means they cannot be indisputably classified as having any single behaviour.

Other versions

Trojan.JS.Fraud.ba

Aliases

Trojan.JS.Fraud.ao (Kaspersky Lab) is also known as:

Mal/FakeAvJs-A (Sophos)
JS.Fraudload-1 (ClamAV)
JS/FakeAV.Y (FPROT)
HTML/TrojanDownloader.FraudLoad.NAC.Gen trojan (Nod32)
JS:FakeAV-GC [Trj] (AVAST)
JS/FakeAV.A (AVIRA)
Suspicious_Gen2.CUUXL (Norman)
Trojan.JS.Fraud.ao [AVP] (FSecure)
JS_FAKEAV.SMX (TrendMicro)

© 1997-2013 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.
The authors' opinions do not necessarily reflect the official positions of Kaspersky Lab.

kaspersky.com

securelist.com