Trojan.JS.Redirector.os

Technical Details

This Trojan opens different websites in the browser without the user's knowledge. It is an HTML page containing Java Script. It is 2059 bytes in size.

Payload

When an infected page is opened in the user's browser, the following HTML document is displayed:

After the user sends an SMS to the premium rate number, nothing will change on this page. The malware also attempts to execute the script named "fol.js", which is placed on the malicious user's server. This script redirects to other resources, which may contain other malware. At the time of writing, this link was inactive.

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
2. Empty the Temporary Internet Files directory, which may contain infected files (see How to delete infected files from Temporary Internet Files folder?):

   %Temporary Internet Files%

3. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

[MD5: 105940f88bf45f5889c03ceaafbd5123]
[SHA1: a5aeee877f418aaf5ffbba8e6db2004fa9148ab6]