Select Page

Sunbelt Software researchers turned up an interesting (infected) Web site that’s been taken over and used in a redirect to install Zbot on the machines of web users looking for Al Gore’s “An Inconvenient Truth” site. Search engines are beginning to find it too:

Here is the real site they’re looking for at

The infected site, hxxp://, (DO NOT GO THERE!) has been registered since 2006, so, it’s probably a legitimate site that’s been taken over.

Obfuscated JavaScript at the bottom, points to
hxxp://, (DO NOT GO THERE!) which delivers Zbot, a Trojan that plants spyware on victims’ machines to steal banking log-in information.

Tom Kelchner