Hello.
I need some information about Trojan.JS.PrygSkok.a (What it is, where to look it).
Trojan is detected in files *.jpg, *.gif or *.ico. when i open my webpage.
I try to scan my server www (apache on linux) but it's seems to be clean.
I cant find any information about this thing so if someone know something, please give me a clue.
Regards.
Full Version: Trojan.JS.PrygSkok.a
hello
the type means it's a javascript trojan. are you sure those jpg's are actually jpg's when you call them in your browser and are not in fact js files?
the type means it's a javascript trojan. are you sure those jpg's are actually jpg's when you call them in your browser and are not in fact js files?
Well, I can't be sure. Kaspersky always delete the file, so i never saw it.
The files was always with jpg, gif, or ico extension, and this files exist on www serwer. But when i scan it on www server or when i download files on my computer and then scan, there is no virus or trojans.
That's why i want to find out how Prygskok works.
Next time i try to cache thouse files and chek it, likie You say.
Thanks for reply.
The files was always with jpg, gif, or ico extension, and this files exist on www serwer. But when i scan it on www server or when i download files on my computer and then scan, there is no virus or trojans.
That's why i want to find out how Prygskok works.
Next time i try to cache thouse files and chek it, likie You say.
Thanks for reply.
post the url, but make it unclickable (so rename http to hxxp for example)
QUOTE(Lucian Bara @ 5.11.2009 16:26) 
post the url, but make it unclickable (so rename http to hxxp for example)
For example (log in Polish):
wykryto: Koń trojański Trojan.JS.PrygSkok.a Adres: hxxp://www. szkola-skrzyszow.okay.pl /konkursy/fotograficzny/k-fotogr.jpg
wykryto: Koń trojański Trojan.JS.PrygSkok.a Adres: hxxp://www. szkola-skrzyszow.okay.pl /images/header_left.gif
wykryto: Koń trojański Trojan.JS.PrygSkok.a Adres: hxxp://www. szkola-skrzyszow.okay.pl /images/baner1.gif
Problem is that information about trojan not always appears. Sometimes it's a couple times per day, sometimes it's nothing for whole day.
I have the same problem with this trojan Trojan.JS.PrygSkok.a. Not many information there is in internet about it. Talking that Kaspersky detecting java script in your website and giving false alarm. But what is that script I cant found.
I Checked my my server and didn't found anything. Like ztlog said this trojan not always appears. When I get the alarm about it i checked the server proceses and see that httpd proceses are <defunct>, when restarting httpd trojan disappearing, until next time. That trojan appears only when you have IE + Kaspersky. For other virusscan ant browsers it is not detectible. Maybe someone can give more info how it works and how you can remove it.
I Checked my my server and didn't found anything. Like ztlog said this trojan not always appears. When I get the alarm about it i checked the server proceses and see that httpd proceses are <defunct>, when restarting httpd trojan disappearing, until next time. That trojan appears only when you have IE + Kaspersky. For other virusscan ant browsers it is not detectible. Maybe someone can give more info how it works and how you can remove it.
QUOTE(andrelis @ 7.11.2009 10:17)
That trojan appears only when you have IE + Kaspersky.
This is also true for me.
It also happened that a couple of minutes after this virus/trojan/ or whatever has been detected my PC did a not ordered shut down.
Strange.
And it was also detected within a web-page downloaded from an apache server, administered by myself.
The resource on the apache server itself (.gif file) seems to be clean, though.
Maybe the file gets infected not before being processed by the apache server and sent to the client.
I'd be very curious about what this actually is, where it comes from and how it behaves.
Nice greets
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.