did you spot it as your were typing and still continued to make the thread?
Malware on popups?
- Thread starter BadDNA
- Start date
Yes. I certainly didn't use the edit function to amend my post after I posted the post. Absolutely not at all.
or the delete button either too. certainly not
ass
ass
I am getting a firefox block today, not sure why, not really happy.
Okay, in case anyone hadn't noticed, this definitely didn't go unnoticed or acted upon. It looks like whoever caused the problem that started this thread created a hole that they got into again.
The servers have been seriously locked down and we have locked down access to the admin tools by whitelisting only approved IP addresses and restricted access of the modification of any site files. We will remain in this mode until we're sure it can't happen again.
I am seriously frustrated that this occurred. Have no reason to believe the site is dangerous at this point but we'll continue to monitor. The locking down of the admin tools should prevent even other back doors from being utilized to break into the server.
Will continue to post updates as necessary. Sorry, guys. The "warning" messages aren't indicating an active threat condition, the site got blacklisted and the warning messages won't go away until the site is re-scanned, at which point it will come up clean.
The servers have been seriously locked down and we have locked down access to the admin tools by whitelisting only approved IP addresses and restricted access of the modification of any site files. We will remain in this mode until we're sure it can't happen again.
I am seriously frustrated that this occurred. Have no reason to believe the site is dangerous at this point but we'll continue to monitor. The locking down of the admin tools should prevent even other back doors from being utilized to break into the server.
Will continue to post updates as necessary. Sorry, guys. The "warning" messages aren't indicating an active threat condition, the site got blacklisted and the warning messages won't go away until the site is re-scanned, at which point it will come up clean.
strange enough, google redirect virus, and a few trojans popped up on my work PC lastnight. What a nightmare, They are tearing through my machine and patience.
I would highly advise anyone on here to go to emsisoft and download their anti-maleware program. MSRT (or whatever the microsoft malicious file program is and malware bytes found nothing) Rkill.exe ended the processes enough to run the emsisoft software. After quarantine and deletion of trojans and malicious files Vista boots to black screen.
2 days of working on this thing and i'm not closer than where I began. I keep snatching defeat from the jaws of victory.
Oh BV, I emailed Gabe about whereabouts of the converters and havent heard back yet
He said he would be sending them out to me so hang in there!
I would highly advise anyone on here to go to emsisoft and download their anti-maleware program. MSRT (or whatever the microsoft malicious file program is and malware bytes found nothing) Rkill.exe ended the processes enough to run the emsisoft software. After quarantine and deletion of trojans and malicious files Vista boots to black screen.
2 days of working on this thing and i'm not closer than where I began. I keep snatching defeat from the jaws of victory.
Oh BV, I emailed Gabe about whereabouts of the converters and havent heard back yet
He said he would be sending them out to me so hang in there!
so if theres nothing wrong, then why are some people being prompted to DL a file??
Who, where and when?
UDi mentioned it on the last page and jonkranked told me he got it too
...and?
I don't see anything since we locked down the servers and cleaned it up...
I don't see anything since we locked down the servers and cleaned it up...
thats all i needed to know. you didnt mention anything of files trying to download in your update post or if had been solved.
Sorry, I thought the "...at this point" indicated that we had cleaned up anything found.
Still pissed this happened.
Still pissed this happened.
I never got asked to D/L anything, however I certainly got some malware recently, as well as those few trojans I dug out. I'll post the log of the ticks emsisoft dug out.
- not saying the malware came from here.
- not saying the malware came from here.
Last edited:
BV and others: thanks for the hard work at fixing this 
Thanks, Stephan. I don't want to kill anyone anymore.
All BV, man...all BV.BV and others: thanks for the hard work at fixing this
Good thing we didn't bother with the texts then.
Trojan.Win32.Swisyn!IK
Exploit.Java.CVE!IK
Java.Trojan-Downloader.OpenConnection!IK
Trojan-Downloader.Java.OpenStream!IK
Trojan-Downloader.Java.OpenStream!IK
Java.Exploit.CVE-2010-0094!IK
Exploit.Java.CVE-2010-0094!IK
Exploit.Java.CVE-2010-0094!IK
Trojan.SuspectCRC!IK
Java.Trojan-Downloader.OpenConnection!IK
the rest of the stuff in the quarrantine log seemed to be tracking cookies
Exploit.Java.CVE!IK
Java.Trojan-Downloader.OpenConnection!IK
Trojan-Downloader.Java.OpenStream!IK
Trojan-Downloader.Java.OpenStream!IK
Java.Exploit.CVE-2010-0094!IK
Exploit.Java.CVE-2010-0094!IK
Exploit.Java.CVE-2010-0094!IK
Trojan.SuspectCRC!IK
Java.Trojan-Downloader.OpenConnection!IK
the rest of the stuff in the quarrantine log seemed to be tracking cookies
Last edited:
happy the boat seems to have stopped taking on water. good work!
it was a battle man, those ****ers dig in deep. The google redirect was the worst as none of the malware programs would find it.
how'd you end up getting rid of it? I've had it for a few weeks now and I'm out of ideas
Im not really sure how I got rid of the google redirect. In the last two days i've used Malware Bytes anti-malware, emsisoft anti-maleware, RKIll, TDSSKiller, and MRT.exe from the command line. Im not sure which one killed it, but the combination of them all somehow got rid of it.
Most people seem to be able to kill it using TDSSKiller alone, however it didnt spot anyone when I used it by itself.
Most people seem to be able to kill it using TDSSKiller alone, however it didnt spot anyone when I used it by itself.
It has been quite the battle to get rid of this nasty virus, I've tried all the software previously mentioned in this tread with no luck.
The only thing that worked for me was Hitman 3.5, the free version will do the trick, but you do have to activate it.
here is the link http://www.surfright.nl/en/downloads/
good luck guys
The only thing that worked for me was Hitman 3.5, the free version will do the trick, but you do have to activate it.
here is the link http://www.surfright.nl/en/downloads/
good luck guys
It is my understanding that if your still getting re-directed you need to clear your cache's and temp files.
Thanks BV for all your hard work. Being busy at work yesterday was the only thing that kept me from going through withdraws.
Thanks BV for all your hard work. Being busy at work yesterday was the only thing that kept me from going through withdraws.
strange enough, google redirect virus, and a few trojans popped up on my work PC lastnight. What a nightmare, They are tearing through my machine and patience.
I would highly advise anyone on here to go to emsisoft and download their anti-maleware program. MSRT (or whatever the microsoft malicious file program is and malware bytes found nothing) Rkill.exe ended the processes enough to run the emsisoft software. After quarantine and deletion of trojans and malicious files Vista boots to black screen.
2 days of working on this thing and i'm not closer than where I began. I keep snatching defeat from the jaws of victory.
Oh BV, I emailed Gabe about whereabouts of the converters and havent heard back yet
you werent kidding about emsisoft. i run both mcafee and malwarebytes regularly. but per your recommendation, downloaded and ran emsisoft's anti-malware last night and it pulled up over 100 objects. suck. thanks for the recommendation! and sure enough, some of the corrupted cookies came from this site.
glad it worked for you, first time I ran it Vista freaked out on reboot, ran it in safe mode and went back to a previous date. re-downloaded emsisoft and ran it, still found a gang of crap and deleted it, machines now fine.
Im totally paying for that software.
When did this start? Does it tell you anything more than that site name? Does it happen on other sites? Have you tried doing a full system scan with your antivirus?
Other than...
infection : URL:Mal
It started this morning but thought nothing of it and than came back from a ride and it was still warning me. Ive just finished running a full scan and everything on my end seems 110%. I can still access everything but it warns me everytime im switching pages.
All pages? Just threads? Just forums listings? Just the parent forum?
Sorry, just trying to make sure everything is 100% nailed down on our end.
edit: also, what antivirus app?
Sorry, just trying to make sure everything is 100% nailed down on our end.
edit: also, what antivirus app?
I just started getting it again this morning BV. I wasn't on much over the weekend though.
Edit: Not every page is throwing it at me. I'll try and keep tabs on where I see it.
Edit: Not every page is throwing it at me. I'll try and keep tabs on where I see it.
Attachments
Last edited:
Well effing hell, we seem to have a very persistent hacker.
I believe the root of the vulnerability that was allowing him or her in has been discovered and disabled. Please report up any issues you may find.
I believe the root of the vulnerability that was allowing him or her in has been discovered and disabled. Please report up any issues you may find.
I really wished I had seen this thread before now........dammit.
man, chunkey munkey must be really butthurt
I have something very different now (I also had the block which caused all of you to miss my birthday *sob*).
What I am getting is something that causes my screen to 'crack' very slightly down the middle. All text becomes misaligned. I am talking only very very slightly, it doesn't cause any significant problems, but it is just on this site. I load a page and within the first 2 seconds, I can see the two halves of the screen shift vertically.
Not sure if this is a problem, just thought you'd like to know BV....
What I am getting is something that causes my screen to 'crack' very slightly down the middle. All text becomes misaligned. I am talking only very very slightly, it doesn't cause any significant problems, but it is just on this site. I load a page and within the first 2 seconds, I can see the two halves of the screen shift vertically.
Not sure if this is a problem, just thought you'd like to know BV....
Have you tried logging in sober?
Happy missed cakeday Damo!