FWIW Dan, I just got the virus again here....
http://www.dansdata.com/coolercomp.htm and there was no Vonage banner at the top.
OK. It's not triggering on any particular ad (I've turned the Vonage campaign back on now, because for some reason people occasionally click on it and make me some money
.
The false positive is, rather, triggering on the intermediate Javascript that surrounds whatever banner gets loaded. This script is always very much the same; the only things that change are the title tag and the details of what the script calls in an iframe (yes, just like JS_FORTNIGHT, the difference of course being what's actually being
put in the iframe).
A couple of readers using Trend Micro's antivirus products have managed to preserve the files it's unhappy about; here's one of them:
var theDoc=document;
var sawPop=theDoc.cookie.indexOf('bpuc488919403=ywsi');
if(sawPop==-1)
{
theDoc.cookie='bpuc488919403=ywsi; path=/;';
if(theDoc.cookie.indexOf('bpuc488919403=ywsi') == -1) {
sawPop = 1;
} else {
sawPop = -2;
}
}
if(sawPop == -2)
{
var pophtml = "<HTML>\n"+
"<HEAD>\n"+
"<TITLE>Matchmaker</TITLE>\n"+
"</HEAD>\n"+
"<BODY leftmargin=0 topmargin=0>\n"+
"<iframe src=http://www.burstnet.com/cgi-bin/ads/ad4889a.cgi/SZ=0X0SB/RETURN-CODE/BCPG19403.37524.40298/53523/ height=300 width=700 frameborder=0 scrolling=no marginheight=0 marginwidth=0>\n"+
"</BODY>\n"+
"</HTML>";
var awin = window.open('', '_blank','width=700,height=300,scrollbars=no,status=no,resizable=no');
window.focus();
awin.location = 'javascript:*opener.pophtml';
awin.moveTo(60,40);
}
I inserted a * between "javascript:" and "opener" to stop it from turning into javascript
pener... turn off emoticon parsing and all tags apparently stop working. No matter.
The stuff between the title tags changes from ad to ad, and the four five digit numbers after RETURN-CODE also change, and so do the height and width tags for the iframe and for the window.open below. That, however, is
it for the differences between this code, which is one of the ones that gets a JS_FORTNIGHT warning, and other ads, which don't. I don't know what the magic cookie is that triggers the warning, but I am now satisfied that it is entirely spurious, since it appears to be triggering on various ads from various unrelated companies. Yes, they're all Burst ads, but all the antivirus programs seem to be noticing is that there's an iframe being opened with something in it that matches a JS_FORTNIGHT signature.
I haven't been able to find the actual code for any JS_FORTNIGHT variant, though; if someone has it and would like to e-mail it to me (dan@dansdata.com; do yer worst, I run Eudora
, that'd be great.
Facebook
Twitter