Trojan.JS.Fraud.ba

Technical Details

This program is a Trojan. It is an HTML page containing Java Script. It is 72 367 bytes in size.

Payload

When an infected page is opened in a browser, the user will be shown a message about malicious activity on the computer.

The infected page then imitates an antivirus scanner, which finds nonexistent malware on the victim's computer. The user is then asked, in the guise of system protection, to install a fake anti-virus.

When the user attempts to close the page, the following message is displayed:

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Delete the original program file (its location will depend on how the program originally penetrated the infected computer).
2. Empty the Temporary Internet Files directory, which may contain infected files (see How to delete infected files from Temporary Internet Files folder?).
3. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

MD5: 59e8a1003fe8d1e06e7fac36ecf7f433
SHA1: e2f37b243c6655d068493ef46788c6151db62757