VIRUS: Caught One!

[NickFitz]

FWIW it's stopped appearing for me now, in the sense that it isn't even trying to inflict junk on me. Given that its appearances have been sporadic, I wouldn't be surprised if it operates for a while, then goes dormant. Alternatively it could have decided to ignore my IP address. If anybody sees any signs of it could they post here and let me know, preferably with browser details? Cheers

[DimPrawn]

I'm still getting the virus warning on IE9.

[NickFitz]

I'm still getting the virus warning on IE9.

It's back for me too

[fullyautomatix]

So IE 9 definitely vulnerable, IE 10 and IE 11 no data yet.

NIck has said Firefox and Chrome are safe, but not proved yet.

Is CUK safe or not ?

[Bunk]

So IE 9 definitely vulnerable, IE 10 and IE 11 no data yet.

NIck has said Firefox and Chrome are safe, but not proved yet.

Is CUK safe or not ?

Erm, don't think it affects IE11

[Scoobos]

Finally, someone believes me ... I've had this since Monday - go figure.

I use Opera and I get reports the payload comes from URL :-> *DONTCLICKME*http://twobutfoxbut.dyndns.info/mix/*DONTCLICKME* without the *DONTCLICKME

[Sysman]

I'm still getting the virus warning on IE9.

Windows 7? I can whip that up in a VM if needs be.

Except I'm off to the pub now for a couple of beers. It's nice and sunny here.

[NickFitz]

Finally, someone believes me ... I've had this since Monday - go figure.

I use Opera and I get reports the payload comes from URL :-> *DONTCLICKME*Google without the *DONTCLICKME

It switches around through quite a few different domains; I'll add that one to my list, as once we've got CUK sorted out I'll be reporting all those domains to DynDNS (who ultimately own them as part of their dynamic DNS service) for abuse.

I've downloaded and decompiled the initial Java payload, which takes a heavily obfuscated parameter and then runs through a load of heavily obfuscated spaghetti scattered around four classes with meaningless method names and much use of reflection to generate the URL of the final payload. Asthat wasn't going to get me very far in terms of cleaning CUK I'm now concentrating on the JavaScript that generates the iframe that loads the page that embeds that initial payload

[NickFitz]

So IE 9 definitely vulnerable, IE 10 and IE 11 no data yet.

NIck has said Firefox and Chrome are safe, but not proved yet.

Is CUK safe or not ?

It will be

[Zippy]

Sorry but may have seen this last weekend (haven't really been paying attention) . On a few occasions, while trying to load General, FF 3.6 popped up a message that it needed me to install the Java VM. Obv I didn't.
On win XP (HE) sp 3.