Hi,

I have an application wich uses a FORM to fill-in a vald IMEI number ( 16 digits )
But a virus ( ? ) transmits to a form for furher information ( AMEX ).

As far I can see, the original URL to post the form to, has been modified.
I have controlled all DNS settings but I cannot find any link.

On the bottom of the included image ( navigation ) you see a hacked URL for my original code.
( The included image is online available --> www.softo.be/clamwin/virus_amex_02.jpg )

Question: Any idea how this is possible ?

Kind regards
Thierry,


https://postimage.org/image/hjkq3a9yd/

Perhaps via javascript, which is used a lot by malware authors for redirection. It must be around somewhere. See if you can send the html code to Clam AV for a signature.

Regards,