AA main page...Trojan?

[Kurt_Nelson]

The trufelsite thingy is back again...

[Kurt_Nelson]

In looking at the trufel thing again, the site is alive. The webpage that appears just makes it looks like it's inactive, but the source code appears to be a script to try and force a buffer overrun? I think the offending call to that site is still imbedded somewhere because every once in a while my browser (Firefox) hangs when I first come on to the site. It's not crashing like it did before, but it's definitely crunching away for about 30 seconds or so. Not getting any virus warnings... just a high RAM usage for a brief period.

[Devilishturtles]

When I use IE7, my entire browser just locks up. Also the high ram usage and the computer is useless for about 4-5 minutes. It seems like I can get the trufel site link a few days in a row, then go a week or two without seeing it again, then it pops back up.

[jsoong]

This site had been good for the last month or so, but ..... Getting the Trufel thing today ..... Even though AVG caught it, still crashed the browser & locked up the entire computer, only recourse is hard reboot.

I still think there is something in this site that is lurking. It is intermittent so much harder to deal with. I am noticing that for the last while, there will be random slow down when I first try to load an AA page. May be I am paranoid, but I will now shut down the browser if AA doesn't load within a second or 2. .... and never visit AA with anything open (& unsaved).

Hope somone can find the problem .... this is too good a site to have to avoid.

[Kurt_Nelson]

Here's another piece... (I'm guessing fishfreek is reading?)

The main forum occasionally loads something from "googlerank.info" but I've never seen it give any problems. I never thought about it since I assumed it was some Google performance tracker. If you go to the domain, it even looks like a Google site, with their logo and everything. But if you do a whois on that domain, you get a guy in Romania. Not good.

The trufelsite domain resolves to "smoothdns.net", which just happens to have the same text on it's homepage as the trufelsite domain, so I'm thinking they're one in the same. And it looks like smoothdns.net is a privately hosted site, so there's no hosting company to file an abuse case with.

This thing is becoming more persistent. Can the folks that did all the pbpBB hacks help you on this?

[Kurt_Nelson]

Sorry... not Romania, but Russia.

Poking around some more, that googlerank.info seems to load on every page. Looks like it's posing as a counter of some sort? It doesn't seem to be a problem with the latest Firefox or IE, but it's definitely no good...

http://www.siteadvisor.com/sites/goo....info/summary/

[Kurt_Nelson]

I'm no professional web guru, but you've got an iframe call to googlerank.info still on your index.php page. I can't see it in the source code through the browser (Firefox), but using Firebug (http://www.getfirebug.com/) I can see it plain as day. Not sure if it's related to the trufelsite thing though. Shoot me a PM fishfreek if you want me to email you a screenshot of what I'm seeing.

[Kurt_Nelson]

fishfreek - PM sent.

[jsoong]

More info - another episode of browser lockup at AA. This time I managed to shut down IE & got a bit of a trail ....

lock up appears to be an attempt to redirect the web page (main forum page) to the Trufelsite, which tried to load several htm pages (or elements of page), one has a virus, the other a loader script.

Thus, the virus or loader does not appear to be in this site, but there is a redirect somewhere, which comes on intermittantly. The redirect seemed to happen after the entire page is loaded, so would be something loaded late in the process. This is just my observations .... I have no real web page expertise, so I can't take this further.

[Peyton]

I've been having problems with trojans on this site for about 5-6 months now and sadly I had stopped visiting for a while, but I really miss coming here. It all started when the google rank thing appeared.

The only way I can avoid it is to hit the stop button in IE right after the page loads. It gets old real fast doing it to every page though. I hope someone can get the problem corrected soon, I miss you guys.