According to Trend Micro you should stay away from files called start.html, begin.html, r.html, main.html, news.html, and about.html since all these files will try to install a dangerious file called WATCH.EXE. This .EXE file contains a malware called TROJ_AGENT.AYZO.

Since all these .html and .exe files are hosted on legitimate sites that has been hacked or compromised it’s important to have a look at your address bar every now and then. It’s of course also important to not to download files you don’t know are safe!

If you own a web site on your own you have to upgrade all your blogging, forum and other software you may use on your site as soon as a new security update is released. You should also look for files you know you haven’t uploaded (espesially files called start.html, begin.html, r.html, main.html, news.html, and about.html).

If you host your web site on a unix or linux based server then it’s really easy to search for the *.html files. Just logon to your server via SSH and type find . -name “r.html” -print. This will search for all files called r.html in the current directory and in all subdirectories. If you got a large web site it may take some time

Popularity: 11% [?]

You may also be interested in...
No related posts

This entry was posted on Tuesday, July 22nd, 2008 at 4:35 pm and is filed under Malware, Trend Micro. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.