Is Kioti's site infected with viruses?

[JayC]

I'm not sure where to put this. I am using Avast with the latest updates. Every time I go to Kioti's website, click Products, then choose a tractor model Avast pops up with a notice saying it detected a virus. Here are the two main notices:

Sign of "VBS:Malware-gen" has been found in "http://www.heiheinn.cn/new.htm" file.

Sign of "SWFDownloader [Trj]" has been found in "http://www.qq117cc.cn/4562.swf" file.

I don't know if these are just false positives or what.

 

[crabjoe]

It's not a false positive. I went to the site and I got infected. Only way for me to clean the infection was to run a manual full scan with Symantec. The auto scan only caught the issue of my POC trying to go to those sites and not the root cause.

 

[Cyberroc]

Yes. Chinia Hack, Someone should call them to see when they plan to fix...

 

[gravel13]

I'm running AVG and it caught it, but I'm going to run a full scan later on tonight. Hopefully everything will be OK.

 

[Grrrr]

The two links in the first post are flagged up as dangerous sites by Firefox.

Where do those links go?

 

[Reg]

Avast catches it on access, as long as you abort the access you should be OK.
Worth reporting, if they get enough reports they MIGHT feel enough pressure to DO something about it.

 

[JayC]

After seeing the replies to my thread and the one in the Kioti Owning/Operating forum I am SO glad I didn't disable Avast thinking it was a false-positive. Just a few days ago, there was an issue with Yahoo and that version of virus definition updates. It kept giving false-positives when accessing the Yahoo site. There were numerous reports on the Avast forum. I was wondering, would it be possible for TBN to put a notice out or something until this issue is resolved? I would sure hate to have anyone get infected, especially from a site that no one would ever suspect as a threat.

 

[crabjoe]

The two links in the first post are flagged up as dangerous sites by Firefox.

Where do those links go?

From what I saw it went to 2 different sites in China. I did a little lookin and it seems it's a trojan that most affects Chinese internet users.

As for the way this thing kicks of... It's a Javascript. From what I read, all that Kioti needs to do is fix their site so it doesn't load this corrupted script.

A bigger issue for them is to protect their site so this doesn't happen again, after it's fixed.

 

[Reg]

It isn't really TBN's problem, it is KIOTI's.

If they don't care enough about scaring potential customers away when they(we) come looking for product information, they will just not get us.

"IT cheap" is an oxywhatsit (-:

 

[Grrrr]

If anyone does get infected with this site I can offer assistance for cleaning up the virus again by looking through your Hijack This logs etc.

Or, you can visit Computer-Juice and post in the Virus, Spyware and Security Forums there where one of us will help you out.

You would be surprised how much Norton or similar will leave behind.