Avg Online Shield Popping Up With A Javascript Exploit Blocked

[InhumaneSlayer]

Would no recommend clicking the link, just case, but I commonly get a prompt by AVG Stating a threat has been blocked. Linking to:

 

s.niziot.com/2/at74/pagespeed.js

 

Which is attacking the FireFox executional directly. Anyone else encountering this?

[ModoX]

In case it's "out of nowhere" you're infected with a trojan or other malware.

I actually don't experience that, even went onto the site, it's just JavaScript code it doesn't get executed when i go to the .js file directly (Firefox)

 

Or when does this happen? When does the prompt show up?

[InhumaneSlayer]

In case it's "out of nowhere" you're infected with a trojan or other malware.

I actually don't experience that, even went onto the site, it's just JavaScript code it doesn't get executed when i go to the .js file directly (Firefox)

 

Or when does this happen? When does the prompt show up?

  It's quite a weird scenario. I've got nightly scheduled tasks which perform malware/anti-virus and other necessities. It's only a prompt when on the Warframe forums

[ModoX]

  It's quite a weird scenario. I've got nightly scheduled tasks which perform malware/anti-virus and other necessities. It's only a prompt when on the Warframe forums

That is indeed really weird.

Just checked the JS file with VirusTotal: https://www.virustotal.com/de/file/47823b168904508fed9587a8fc9abff187c40e2b04c11075bb892c15ebbc48a0/analysis/1397786555/

And on the Warframe forums or page there are only referals to "https://damrte0h9s7q0.cloudfront.net"

 

Mhm.. maybe the JavaScript code is injected using MitM or something different :( ; cause i don't see and links refering to "s.nizlot.com"

Just checked html-sourcecode of forums mainpage & mainpage of "warframe.com" no referals there. Must've been injected :o

 

And actually you could guess, DE isn't using any malware here.