up vote 2 down vote favorite
share [g+] share [fb]

Recently I noticed that some web pages I visit comes wrapped into a frameset with two frames:

The whole thing is invisible - I only noticed it because the pages that are wrapped do not display a title in the browser tab so I checked Firebug and saw what was happening. MSE doesn't detect any virus. I'm downloading WinClam now and will do a fullscan but in the meantime do you think I have a virus and, if so, which one? Is there anything I can do to diagnose what's going on?

Here is the full code I'm being served for lemonde.fr:

<html><head></head>
<frameset frameborder="0" rows="100%,0" framespacing="0" border="0">
<frame src="http://219.141.147.70:8080/indexbj.jsp?
 param=ABaW1zaT00NjAwMzYxMTE1MzAzMjAmdXJsPXd3dy5sZW1vbmRlLmZyLyYxPTIwNDcwMjQ5NzI=&amp;ref=1" 
 name="frm123" id="frm123"></frame><frame src="http://118.213.88.152/tongji.html" 
 name="frmOLD" id="frmOLD"></frame></frameset></html>
link|improve this question
100% accept rate
feedback

migrated from security.stackexchange.com Mar 26 '11 at 21:58

This question came from our site for IT security professionals.

6 Answers

up vote 2 down vote

lemonde.fr is located in France and you are redirected to server in China on port 8080 which is serving you javascript so gonna have to say yes you have been infected with some type of malware try MalwareBytes

link|improve this answer
I think he means lemonde.fr which is located in France, not Germany. But, obviously I agree with your analysis. – emgee Mar 26 '11 at 22:42
It is a French website but the server is located in Germany. – Arctor Mar 26 '11 at 23:02
lemonde.fr is 195.154.120.129. GeoIP lookup on 195.154.120.129 looks up to Paris, France. www.lemonde.fr looks up to the COTENDO.NET CDN, which is geographically diversified. lemonade.fr = 82.98.86.169. GeoIP lookup on 82.98.86.169 reveals Frankfurt, Germany. – emgee Mar 26 '11 at 23:20
lol screwed that one up pretty good that's what i get for skimming over stuff lemme correct it :P – Arctor Mar 26 '11 at 23:28
kids/pets running around so I was just reading key words and responding :\ – Arctor Mar 26 '11 at 23:29
show 2 more comments
feedback
up vote 1 down vote

That'a a good catch. A virus certainly seems likely from that. Could also be some sort of MITM sort of hijacking / injection, although my first guess would be a virus.

If this were my computer, I'd disconnect it from the internet and download an alternate antivirus software package from a different computer. My personal experience doesn't leave me too much faith in WinClam. My preference is VipreRescue.

In the meantime, check your hosts file, look for autorun.inf files and strange processes. However, if MSE didn't detect it, chances are you won't either.

link|improve this answer
I'm running ClamWin now and will try VipreRescue afterwards, but I'm suspecting they are not going to find anything. If it's a MITM hijacking, is there anything I can do about it? I also often find that there's something weird going on with SSL certificates (like sometime the url is "https" but Firefox shows that the "website doesn't provide any info about its identity" (how is that possible if it's https?). Any suggestion on what I could try? I'm in China at the moment and I'm starting to wonder if it's not a "feature" of their Grea t Firewa ll. – Laurent Mar 27 '11 at 3:34
I'm actually not familiar with the Great Firewall, but if no virus, I think that by the process of elimination we've found the culprit. I'd be very careful if you're having any https wonkiness. – emgee Mar 28 '11 at 20:57
feedback
up vote 0 down vote accepted

For information, I have tried all the antivirus, antimalware and rootkit detectors I could think of and nothing was found.

I have noticed however that it doesn't happen when I connect to the internet from a different connection, so I'm assuming it's a Chinese hacking thing. For now, I have blocked these IPs in Windows' firewall so at least they are not tracking anything.

link|improve this answer
feedback
up vote 0 down vote

Can you try a non-Chinese proxy and open the same sites? For instance, my ISP, panix.com, allows me to use their Privoxy filtering proxy from any location.

link|improve this answer
feedback
up vote 0 down vote

Looks like some sort of virus/malware infection to me, as stated in earlier posts.

I too like to run VipreRescue but I also use SuperANTISpyware and HitMan Pro. I've had great success using all three of those applications. I'm not really a fan of malwarebytes anymore. I feel it misses a lot. Same with Spy-bot search and destroy. Used to be good, but now not so much.

link|improve this answer
feedback
up vote -1 down vote

Try to run virus scan to determine if your computer is infected with virus. What antivirus do you have? i am using AVG. And i would suggest update your antivirus.

link|improve this answer
He said in the original post that he was doing a virus scan. – CarlF Apr 28 '11 at 12:29
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.