Wigwam Jones
Caesar non supra grammati
Well, there you have it then. I guess nobody is having any trouble at all. We're all making it up.
Virus attack after log in
- Thread starter JCAUPS1
- Start date
Well, there you have it then. I guess nobody is having any trouble at all. We're all making it up.
iTunes shouldn't care a whit whether your windows environment is virtual, or real.
As for use of VM's for browsing, it isn't a common practise, but it sure is effective!
Wigwam Jones
Caesar non supra grammati
You try it. It works fine in a VM for doing synchs. Every time iTunes downloads an update for the iPod, the iPod gets bricked and has to be set back to the default state. It's Apple's issue, but it ends up being my problem.
Does not run on netbooks. And effective or not, no one should have to do it. That's just unacceptable.
Apparently not everyone is experiencing the same issues... no reason to get testy about it.
I personally haven't experienced any issues to date either, and I'm struggling to make sense of what differences might explain the discrepancy.
So far, as a casual observer on the sidelines, I am not seeing anything resembling a pattern.
Kegger
R.I.P. 1/12/1966 - 6/1/2017
There is obviously something funky going on here, beyond anything that has
even come close to what is going on now, this problem is being worked from
every side imaginable there is to try an take care of it.
Anyone saying IT NEEDS TO BE FIXED, Yah We Know, it sucks what is going
on and no one inside of admin is taking this lightly, this is AK's livelihood and
it's not just standing pat thinking it's only happening to a few.
Keep posting any problems, but AK is not laying down on the Job, it's serious.
It is happening to other Vbulletin sites, and they don't know what it is either.
(software's been reloaded, Ads turned off, everything is being checked/tried)
even come close to what is going on now, this problem is being worked from
every side imaginable there is to try an take care of it.
Anyone saying IT NEEDS TO BE FIXED, Yah We Know, it sucks what is going
on and no one inside of admin is taking this lightly, this is AK's livelihood and
it's not just standing pat thinking it's only happening to a few.
Keep posting any problems, but AK is not laying down on the Job, it's serious.
It is happening to other Vbulletin sites, and they don't know what it is either.
(software's been reloaded, Ads turned off, everything is being checked/tried)
tomrich22
Well-Known Member
Still problems???
I read all your posts about the virus warnings when the thread was started and said to myself "well I am not having any problems". Well a couple of days ago when I was in Audiokarma I got a message pop up that looked like a Java update and I clicked on it and it messed up my Mcafee anti virus. It kept turning off the Mcafee, the firewall etc. I finally called Mcafee and they remotely reinstalled the software.....and now it is working fine again.
But about 5 minutes ago I got that Java pop up again while in Audiokarma.
This time I just deleted it and so far no problems.....So I guess there are still things going on, on the site.
I read all your posts about the virus warnings when the thread was started and said to myself "well I am not having any problems". Well a couple of days ago when I was in Audiokarma I got a message pop up that looked like a Java update and I clicked on it and it messed up my Mcafee anti virus. It kept turning off the Mcafee, the firewall etc. I finally called Mcafee and they remotely reinstalled the software.....and now it is working fine again.
But about 5 minutes ago I got that Java pop up again while in Audiokarma.
This time I just deleted it and so far no problems.....So I guess there are still things going on, on the site.
Kegger
R.I.P. 1/12/1966 - 6/1/2017
Yes...
There is obviously something funky going on here, beyond anything that has
even come close to what is going on now, this problem is being worked from
every side imaginable there is to try an take care of it.
Anyone saying IT NEEDS TO BE FIXED, Yah We Know, it sucks what is going
on and no one inside of admin is taking this lightly, this is AK's livelihood and
it's not just standing pat thinking it's only happening to a few.
Keep posting any problems, but AK is not laying down on the Job, it's serious.
It is happening to other Vbulletin sites, and they don't know what it is either.
(software's been reloaded, Ads turned off, everything is being checked/tried)
There is obviously something funky going on here, beyond anything that has
even come close to what is going on now, this problem is being worked from
every side imaginable there is to try an take care of it.
Anyone saying IT NEEDS TO BE FIXED, Yah We Know, it sucks what is going
on and no one inside of admin is taking this lightly, this is AK's livelihood and
it's not just standing pat thinking it's only happening to a few.
Keep posting any problems, but AK is not laying down on the Job, it's serious.
It is happening to other Vbulletin sites, and they don't know what it is either.
(software's been reloaded, Ads turned off, everything is being checked/tried)
spaceman
Registered Lunatic
I wonder if it's related to that Chinese drone attack, from a year or two ago? :scratch2: I didn't realize that Java notification was involved in this mess, and I might have set myself up by clicking it. I just happened to reinstall Win 7 recently, & obviously had to reinstall all that stuff too, like Acrobat reader, Java, etc. :scratch2:
lico
Super Member
AK is doing all they can with this problem. My gut says it's the ad networks serving up the culprit, just based on what I saw 2 days ago in my cache. But - it's hard to prove, and I haven't received another hit since I've installed more tools to debug where it actually originates from. The next time I get a hit I'll have something conclusive to report.
FF8 seems to have the vulnerabilty to what happens, that's where most users have reported it. FF9 came out 1 month later to plug security holes. I was running FF8 myself, didn't even know there was a new version until I checked for updates. Since installing FF9, haven't seen any issues.
In any case - anybody thinking they are safe relying on Microsoft Security Essential to catch this be forewarned. Only thing I've found to work is Norton Security Suite, it's caught at least 3 instances cropping up successfully. MSE wll sit there with a green status while your system gets infected quicker than you can say ComboFix, it's worthless.
FF8 seems to have the vulnerabilty to what happens, that's where most users have reported it. FF9 came out 1 month later to plug security holes. I was running FF8 myself, didn't even know there was a new version until I checked for updates. Since installing FF9, haven't seen any issues.
In any case - anybody thinking they are safe relying on Microsoft Security Essential to catch this be forewarned. Only thing I've found to work is Norton Security Suite, it's caught at least 3 instances cropping up successfully. MSE wll sit there with a green status while your system gets infected quicker than you can say ComboFix, it's worthless.
similost
Rockin and Rollin....
Well it sure did suck for me... I just speant two hours trying to get my laptop back up abnd running... I guess a piece finally got past my AVG and adaware..
Couldn't get the laptop to boot, and it couldn't repair itself. I finally told it to use the last known good configuration. That got me in, and then I ran Combofix. I removed a few pieces of crap.. along with drivers that it shouldn't have..
Oh well.. those are easier to replace then all the pictures and files I could have lost. And yes, I backed thse up now..
Couldn't get the laptop to boot, and it couldn't repair itself. I finally told it to use the last known good configuration. That got me in, and then I ran Combofix. I removed a few pieces of crap.. along with drivers that it shouldn't have..
Oh well.. those are easier to replace then all the pictures and files I could have lost. And yes, I backed thse up now..
similost
Rockin and Rollin....
I'm running Win7 Home Premium with SP1. Running IE with high security, and a LOT of blocked sites, This is the only thing I've ever picked up on that machine...
Looking at logs from Combofix, what ever this is, it's dumping files all over the place. Not like anything I've ever seen, and I've seen a hell of a lot of crazy malware, viruses, worms and trojans...
I'm gonna have to take some time and really look at this in case any of the machines at work get hit with it. See if it's something we might be able to block at the proxy. We seldom have any machines hit, but every now and then....
Looking at logs from Combofix, what ever this is, it's dumping files all over the place. Not like anything I've ever seen, and I've seen a hell of a lot of crazy malware, viruses, worms and trojans...
I'm gonna have to take some time and really look at this in case any of the machines at work get hit with it. See if it's something we might be able to block at the proxy. We seldom have any machines hit, but every now and then....
Uncle Paul
Super Member
The upgrade to FireFox 9.0.1 seems to be preventing the XP Anti Virus crud, and so far, so good. Other details are I'm running Windows XP Professional, 32 bit, McAfee Virus Scan Enterprise 8.0.5i (definitions up to date), and McAfee Host Intrusion Protection 7.0. McAfee periodically traps issues, but nothing seems to be getting through. I've been running Combofix periodically to confirm that nothing got through and is lurking.
Wigwam Jones
Caesar non supra grammati
Uncle Paul
Super Member
Spoke too soon - got the XP anit-virus crud a few minutes after I posted this. Fixed my laptop, then worked on my addition a couple of hours to blow off the steam. I'd REALLY like to know who those bozo's are and where they live, but that's a bit off topic, and more suited to a guns and ammo forum...just kidding, really :scratch2:
Trying noscript now, and if that fails I'll be going to VMware.
JesusChrysler
...drives a Dodge ; )
Sorry something here took out my wife's laptop....
I only browse from my phone now as I don't want to kill another computer...
Not saying its ak's fault just paranoid I guess.
Matt
I only browse from my phone now as I don't want to kill another computer...
Not saying its ak's fault just paranoid I guess.
Matt
I will avoid using Chrome to prevent Google collecting data on my web use as long as I can. They get enough from my droid enabled phone.
Someone posted some URLs from the banner ads which seem to be related to the hijackings. I followed a few of them and was led to a Java applet which I suspect contains the malicious code.
Java applets are theoretically safe as they run in a sandbox that prevents them from mucking around with system settings and such. The problem is that the official (Sun, now Oracle) JRE (Java Runtime Enviroment) has had vulnerabilities which allow untrusted applets to break out of the sandbox and execute arbitrary code on Windows and possibly other platforms.
You can use NoScript as others have suggested. It prevents Java applets from running without your permission. It also blocks JavaScript (which is entirely separate from Java), again according to the permissions you give it. I strongly recommend using NoScript or an equivalent for your browser.
Back to the Java issue... The JRE has had many security fixes in the last two months. If you don't plan to use NoScript, then either disable/remove the JRE (or at least the Java plugin for your browser) or update it to Java SE 7 Update 1 or later.
Another safeguard is to log into Windows with a non-admin account. If you do that, damage should be isolated to that particular account and be easier to fix. i.e. you probably won't have to reinstall the entire OS. There are no guarantees though because the bad guys are always finding vulnerabilities in Windows that lets them gain admin privileges.
Java applets are theoretically safe as they run in a sandbox that prevents them from mucking around with system settings and such. The problem is that the official (Sun, now Oracle) JRE (Java Runtime Enviroment) has had vulnerabilities which allow untrusted applets to break out of the sandbox and execute arbitrary code on Windows and possibly other platforms.
You can use NoScript as others have suggested. It prevents Java applets from running without your permission. It also blocks JavaScript (which is entirely separate from Java), again according to the permissions you give it. I strongly recommend using NoScript or an equivalent for your browser.
Back to the Java issue... The JRE has had many security fixes in the last two months. If you don't plan to use NoScript, then either disable/remove the JRE (or at least the Java plugin for your browser) or update it to Java SE 7 Update 1 or later.
Another safeguard is to log into Windows with a non-admin account. If you do that, damage should be isolated to that particular account and be easier to fix. i.e. you probably won't have to reinstall the entire OS. There are no guarantees though because the bad guys are always finding vulnerabilities in Windows that lets them gain admin privileges.
Similar threads
