TrojanDownloader:JS/Small.AC

TrojanDownloader:JS/Small.FC is a trojan written in JavaScript that may redirect users to adult Web sites, where users are prompted to download and install a "video codec" in order to view content. The downloaded file is actually a malicious executable, identified as Trojan:Win32/Tibs.gen!G.

TrojanDownloader:JS/Small.FC may be encountered when a user visits a Web page, possibly modified by an attacker. When the modified page is viewed in a Web browser, the script executes, redirecting users to an adult-themed Web site. The page may request that the user download and install a "Video ActiveX Object" in order to view the media content, as shown in the example displayed below:

 

 

If the user tries to cancel the download, the script will continuously request the user download the requested file:

 

 

 

Other attempts to close the Web page may cause additional pop-ups to be displayed, potentially containing adult-themed images. Accepting the download requests a file named 'MediaTubeCodec.exe', identified as Trojan:Win32/Tibs.gen!G.

At the time of this writing, the script was still active, and potentially present in as many as 60,000 Web pages.