hxxp://autosolution.load4.net/
Lots of VBScript that looks suspect.
This is a fake escrow site btw.

Kaspersky identifies Trojan.VBS.StartPage.bk present on that page, and a heuristic verdict of Type_script.


AhnLab-V3 2008.2.4.10 2008.02.04 -
AntiVir 7.6.0.62 2008.02.04 VBS/MacDonald.A.1
Authentium 4.93.8 2008.02.03 VBS/StartPage.BO
Avast 4.7.1098.0 2008.02.03 VBS:Malware-gen
AVG 7.5.0.516 2008.02.03 -
BitDefender 7.2 2008.02.04 Trojan.VBS.Autorun.J
CAT-QuickHeal 9.00 2008.02.01 -
ClamAV 0.92 2008.02.04 Trojan.VBS-5
DrWeb 4.44.0.09170 2008.02.04 SCRIPT.Virus
eSafe 7.0.15.0 2008.01.28 -
eTrust-Vet 31.3.5509 2008.02.04 -
Ewido 4.0 2008.02.04 -
FileAdvisor 1 2008.02.04 -
Fortinet 3.14.0.0 2008.02.04 VBS/StartPage.BK!tr
F-Prot 4.4.2.54 2008.02.03 VBS/StartPage.BO
F-Secure 6.70.13260.0 2008.02.04 Type_Script
Ikarus T3.1.1.20 2008.02.04 -
Kaspersky 7.0.0.125 2008.02.04 Type_Script
McAfee 5221 2008.02.01 VBS/Doli.worm
Microsoft 1.3204 2008.02.04 Worm:VBS/Lido.gen!A
NOD32v2 2845 2008.02.02 VBS/StartPage.BK
Norman 5.80.02 2008.02.01 -
Panda 9.0.0.4 2008.02.03 Suspicious file
Prevx1 V2 2008.02.04 -
Rising 20.29.22.00 2008.01.30 Unknown
Sophos 4.26.0 2008.02.04 -
Sunbelt 2.2.907.0 2008.02.02 -
Symantec 10 2008.02.04 -
TheHacker 6.2.9.208 2008.02.04 -
VBA32 3.12.6.0 2008.02.03 -
VirusBuster 4.3.26:9 2008.02.03 -
Webwasher-Gateway 6.6.2 2008.02.04 Script.MacDonald.A.1

Account suspended.

Can someone attach the page source? I would like to take a look at it.

Hi, no source code saved, but I have saved one of the .startpage objects that was being detected.

This is a Virus that has been converetd to VBS file with EXE2VBS utility. It infects the system and creates a copy of itself after renaming any doc/jpg file in the computer. It will execute and place a copy of the actual infected file Winini.dll inside the System32 folder and will make a registry run entry as well. It will attach itself wth Winlogon process as well.

here are the findings:

Antivirus Version Last Update Result
AhnLab-V3 - - -
AntiVir - - VBS/MacDonald.A.1
Authentium - - VBS/StartPage.BO
Avast - - VBS:Malware-gen
AVG - - -
BitDefender - - Trojan.VBS.Autorun.J
CAT-QuickHeal - - -
ClamAV - - -
DrWeb - - SCRIPT.Virus
eSafe - - -
eTrust-Vet - - -
Ewido - - -
FileAdvisor - - -
Fortinet - - -
F-Prot - - VBS/StartPage.BO
F-Secure - - Trojan.VBS.StartPage.bw
Ikarus - - Trojan.VBS.StartPage.bw
Kaspersky - - Trojan.VBS.StartPage.bw
McAfee - - VBS/Doli.worm
Microsoft - - Worm:VBS/Lido.gen!A
NOD32v2 - - VBS/StartPage.BK
Norman - - -
Panda - - Suspicious file
Prevx1 - - -
Rising - - Unknown Script Virus
Sophos - - -
Sunbelt - - -
Symantec - - -
TheHacker - - -
VBA32 - - -
VirusBuster - - -
Webwasher-Gateway - - Script.MacDonald.A.1
Additional information
MD5: b8b72f5add2279d739107f008c102215
SHA1: 25c79fd0ec1a6e97effd0b57db7104f6e99fd776
SHA256: c1d6c6519f8264c42a3871a2dc16a0cffdb5680f3bfb50e35198bfee426c46f9
SHA512: 10b0295b765d556a9d7214bebc515b0259e75c96ff6eac05f5721515f44776d7 dd6f804c6da876fe0037b0d557c65353103dfe3961a6c7ee1187bd9decbf6220


Thanks & Regads...
MaliciousBrains
http://maliciousbrains.blogspot.com