|
Cleo - it almost looks like its coming from the paycounter - its a trojan downloader - being activated when you go to the second page? Its definitely activated by javascript and then tries to use a vbs and activex exploit to load - checking the files that were downloaded on my test were about 10 files - two js files, a vbs script and a bunch of count.html pages - those pages also have all kind of exploits in them
I noticed that all his sponsor links are going to adultdialersolution - thats a real shame - but its happening on a bunch of free sites
|