AGD Virus ...

[arkyt]

Andy, it apparently has somein to do with that banner that runs at the top of the home page....

View attachment 179

____
____

Thats what I am getting now on the home page ...

 

[Engineer]

I went to the homepage just now and got a warning from Nod32. See attachment...

I pasted the full details from Nod32 below.

xhttp://www.adservingmedia.org/exploits/JavaSignedApplet.jar probably a variant of Java/TrojanDownloader.OpenStream.NAN trojan connection terminated - quarantined Threat was detected upon access to web by the application: C:\Program Files (x86)\Java\jre6\bin\java.exe.

and

xhttp://www.adservingmedia.org/exploits/JavaSignedApplet.jar » ZIP » SiteFormatHelper.class probably a variant of Java/TrojanDownloader.OpenStream.NAN trojan

 

[Aussie-Dave]

I'm getting it too.

Also when the page loads in FF it actions Java which opens its quick access icon tools bar in XP (you know where the clock etc is).

It's something to do with the top banner, it says "Not Found" where the banner is supposed to display.


Cheers



Dave

 

[jimmiet]

No Problem

I come directly to the forum and I have no alerts

 

[dominique]

You better hurry and pull that, before google picks it up and marks you as malware site. They do that now.

 

[arkyt]

All appears to be well this morning ... :thumbs-up:

 

[Guard Dog]

It's fixed. Would have fixed it yesterday, but was too busy unloading my insides into the toilet. Fun times.

It was not the banner or the '404 Not Found' (that obviously means nothing was found, so that couldn't have been it... made me laugh)

Someone hacked the FTP in order to insert that little piece of very strange code (all regex stuff). I have increased security and verified that no other such files are on the server.

 

[Simmo!]

Just got this Andy On the homepage.

 

[bonustreak]

My windows media is trying to play a file Andy

 

[dominique]

Mine too! Just as the page loads.

 

[Perc]

I got this a couple hours ago on the forums

Object: hxxp://cazesem.co.cc/x33/pdf.php?h=
Infection: JS:pdfka-AKC [Expl]

 

[Holland87]

I received what Simmo! received opening the forum just now.

 

[arkyt]

windows media player is trying to play - kaspersky is going crazy .... its now on the forums pages and not just the home page .... logging off will return when its safe.

 

[Webzcas]

Someone hacked the FTP in order to insert that little piece of very strange code (all regex stuff). I have increased security and verified that no other such files are on the server.

Hmm I don't think the ftp was hacked Andy. More likely an injection due to the code being used.

Ping me on MSN when you come online, as obviously I will need to increase protection for AGD on the firewall. Also so we can roll back the code, prior to the attack/hack.

 

[Perc]

This is now a reported attack site...

 

[Webzcas]

I have restored the site from the end of Sept monthly backup, bar the databases.

Still testing. But please report any more instances in this thread.

 

[dominique]

seems fine now...

 

[TheGamblingGuru]

IE has vulnerabilities anyway but FF still shows the forum page as an attack site with this warning and here is the Diagnostic page for affiliateguarddog.com/forums as well:

Google Safe Browsing diagnostic page for affiliateguarddog.com/forums

http://i843.photobucket.com/albums/zz358/TheGamblingGuru/AGDForumAttackPage.jpg

Malicious software is hosted on 1 domain(s), including cazesem.co.cc/.

1 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including dofyxim.co.cc/.



____
____

 

[Webzcas]

Yep it will do Rob, as it has been reported as an attack site. Andy, needs to contact google to request a review.

Is your local AV software picking up anything?

IE has vulnerabilities anyway but FF still shows the foum page as an attack site with this warning and here is the Diagnostic page for affiliateguarddog.com/forums as well:

Google Safe Browsing diagnostic page for affiliateguarddog.com/forums

http://i843.photobucket.com/albums/zz358/TheGamblingGuru/AGDForumAttackPage.jpg

Malicious software is hosted on 1 domain(s), including cazesem.co.cc/.

1 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including dofyxim.co.cc/.



____
____

 

[TheGamblingGuru]

Yep it will do Rob, as it has been reported as an attack site. Andy, needs to contact google to request a review.

Is your local AV software picking up anything?

I'm using AVG Dave and it's not picking up anything...just the FF browser.

____
____