After this notice, the user is redirected to a web site hosting a complete replica of the Shockwave Player Download Center, as you can see below:Īll the links on this web page lead to Adobe’s web site except for one (I’m pretty sure you can guess which one).īesides creating a really nice replica of Adobe’s web site, the bad guys also added this little JavaScript to it:įunction clickIE() ĭocument.oncontextmenu=new Function('return false') When visited, the web page in question (a game site related to RuneScape) shows couple of broken icons and all links just point to another web page that conveniently inform the user that his version of Macromedia Flash Player needs to be updated. Shortly, it’s pure social engineering – the user is actually encouraged to install the malware himself. However, the web site submitted by Jason didn’t have any such elements and I actually forgot about it until we heard again from Jason who managed to find out what happened here. In almost 100% of cases the bad guys lately just insert hidden iframe links which point to web sites hosting various exploits. When we get reports of web pages like this one, I typically first download the web page with wget (faking the User Agent field, of course, so the target site thinks I’m using Internet Explorer).

One of his users visited the web page he submitted and subsequently got infected with a Trojan horse. Jason Frisvold wrote to us about a suspicious web page.

Adobe shockwave version check