Forum Virus

[NickFitz]

There was an iFram injected at the bottom of the page and it was pulling content from another site. I can only assume that it was the payload for a trojan.

Wonder how that got in? vBulletin shouldn't let something like that through via a forum post etc.

Avast was blocking communication with:

http:// indikatorl DOT in / z / enukgb

Spaces added around the slashes... Feel free to have a poke about and see what it was doing but my priority is patching the forum right now so not got time to look myself.

Admin

I'd love to, but I'm at ClientCo using Windows, so perhaps I'd better not

[mudskipper]

On my AVG free protected Vista/Firefox PC just visiting the forum home page caused Java runtime to kick into life in the system tray. Deleted FF temp files and updated Java from 6v24 to 6v30 and rebooted when I saw it.
Quick scan is clear.

Java runtime not fired up on my PC, so hopefully that's a good sign.

Hi All,

There was an iFram injected at the bottom of the page and it was pulling content from another site. I can only assume that it was the payload for a trojan.

Ah - I've got adblock - maybe that's blocked the content. Anyone running ff with adblock seen it?

[ctdctd]

Java runtime not fired up on my PC, so hopefully that's a good sign.



Ah - I've got adblock - maybe that's blocked the content. Anyone running ff with adblock seen it?

I have adblock:-(

[SimonMac]

Wonder how that got in? vBulletin shouldn't let something like that through via a forum post etc.

Inside job? Doesn't one of the posters on here help admin with a bit of freelance work on the website?!

[mudskipper]

I have adblock:-(

Did you see the trojan?

[ctdctd]

Did you see the trojan?

Only saw Java kicking off - didn't see anything amiss on the CUK forums home page

[mudskipper]

Only saw Java kicking off - didn't see anything amiss on the CUK forums home page

Ah yep, sorry, lost track of who posted what!

Scan still running - nothing picked up yet...

[malvolio]

Which post had the bad link Mal? (for edukshun purposes - we don't need to go back to it...)

No single post, it was any access to the main Forum page, and any move to another one, including the PMs and users. So whatever it was was at the top of the site.

[d000hg]

Avast was blocking communication with:

http:// indikatorl DOT in / z / enukgb

Did Chrome users (or others) get automatic warning from the browser about it?

[DimPrawn]

I've just noticed that since browsing CUK this morning I've got a very swollen nob and itchy bollox?!?



Admins should do more to protect us vulnerable users.