Modified infected by trojans?

lightningbolt · Post by **lightningbolt** » 14 Mar 2005 20:48

I use firefox and I haven't gotten any trojans.

ebo · Post by **ebo** » 16 Mar 2005 00:15

I use Opera and my system is full of Trojans.

Everytime I log on, my anti-virus software blocks another one.

A word from the Admins maybe?

crazydwarf · Post by **crazydwarf** » 16 Mar 2005 09:24

Um... I'm using internet explorer and I don't think I have any, is it possible that I am just too stupid to notice them?... Hope not...

zachatree · Post by **zachatree** » 20 Mar 2005 12:22

FIX MODIFIED

ok for real modified needs a fixing for real real. i have been useing firefox and my spybot has resently been finding the same trojans again. i have been trojan free for about a week since i started useing firefox. resently i been starting to get the same pop-ups and problems as befor. actully it started 15 mins ago. and i was talking with some foot faires

and they have been experianceing the same problems, an they are useing firefox as well. can some one plz do something about this. no mod or anyone has repleyed about these problems in a way about geting something done to get rit of them. can something be done about this? or can we find out how they got here or something? or are these kinda problems a really tuff deal to deal with? im not a computer wiz so i could be ranting about something i have no idea about. but can we plz be alittle enlightened on the subject of these problems?

HG · Post by HG » 20 Mar 2005 15:26

Not all trojans do anything.

Have these trojans done ANYTHING to your system?

Some files are just thought to be trojans by anti spyware software and they really arent. If it isnt doing anything to your system, its either lying dormant and waiting to explode, but it is probably just harmless.

zachatree · Post by **zachatree** » 20 Mar 2005 15:57

its pop ups of course its doing something to my system, its slow and some times messes with my sound card.

wolfpac444 · Post by **wolfpac444** » 20 Mar 2005 16:40

Zach, have you PM'd an admin (jer or Splint) about this?

I don't think the moderators can do anything about it. The hosts file that Cameron posted will take care of all the sites it lists -- all you have to do is do a little search on Google about the hosts file. With that in place, it is like those sites don't even exist.

Tsiangkun · Post by **Tsiangkun** » 20 Mar 2005 17:50

good point, I don't know if anyones has contacted the admins

Anz · Post by **Anz** » 21 Mar 2005 05:18

I PM'd Splint before starting this topic. He hasn't replyed it...

Now there are these "Plz visit" texts at the main page...
Someone is hacking Modified.

ptaku · Post by **ptaku** » 21 Mar 2005 05:52

For this host file. Yeah... it works but you should put it to the correct folder.
In Win 95/98/Me it's just c:\windows\ with 2000/NT/XP Prof it's c:\windows\system32\drivers\etc\ and on XP Home it's c:\windows\system32\drivers\etc\

ninja · Post by **ninja** » 26 Mar 2005 17:19

Thought Id post this here. I still have that PWSteal.Banker.B

Cant find how to remove it. This is how your supposed to remove it http://securityresponse.symantec.com/av ... ker.b.html but the trojan uses mpr.exe to run which only exists in windows 95/98. I cant navigate to the key .....Winlogon\notify\f3dsl

I also cant navigate to the key ....\control\MPRservices\TestService

The bits in bold dont exist. The MPRservices one im guessing because mpr.exe aint on windows xp. So I cant delete what it says to. Anyone know what to do. Norton always pops up when I come to modified (only modified actually - not sure if it makes a difference) saying its detected a virus on the computer, that being PWsteal.Banker.B and show in nero and wmplayer.exe

It cant repair the file and says acess to the file was denied. Also some mms:/// message pops up saying windows cant access the specified device, path, or file. You may not have the appropriate permissions to access the item. Both the virus message and the mms message only show when accessing the index page of the forum

Sorry if this was long. Anyone know what to do. A virus scan from norton doesnt pick up the PW thing so cant get rid of it that way. Virus deffinitions are up to date too. Cheers.

ninja · Post by **ninja** » 28 Mar 2005 21:00

Can someone help. Anyone else running XP and got that PW trojan, what did you do?

Plus now Norton keeps detecting malicious scripting on here but I can chose to stop it. When you point to back you can see it tried to make me go to http://howtoloseweight.frsa.com/index.php

Anyone else having issues like these with modified? Admin are you doing anything about it, atleast address the issue.

Anz · Post by **Anz** » 29 Mar 2005 04:05

Now all the fucking time I open some new page at modified a trojan warning comes!!

It starts to be annoying - Brad, do something about it please!

habitat · Post by **habitat** » 29 Mar 2005 08:58

yes, I get a message from howtoloseweight fucking shit, on every DAMN page. I have to bring up the back menu everytime cause it wont even let me hit back without it coming up again. Can we seriously move to a different server or just totally wipe out this one, or can we still remove this script or whatever from the database

It's getting real annoying . . .

brian relly · Post by **brian relly** » 29 Mar 2005 09:37

I use Mozilla Firefox, and therefore have no idea what any of you are talking about.

delakong · Post by **delakong** » 29 Mar 2005 09:54

Windows has blocked this software because it can't verify the publisher. is what comes up every time I go to a new page. It kind feels like a shooting game, I don't like this shooting game.

FlexThis · Post by **FlexThis** » 29 Mar 2005 11:08

Muffinman · Post by **Muffinman** » 29 Mar 2005 11:12

I was bored at work (soooo dead on Easter Sunday) and came onto the forum, in Internet Explorer (I use Firefox at home, thuogh it still messes up BOTH my websites...) and I got a virus popup warning, or something, and I got all flustered and didn't know how to use their virus thingy, so I just closed it and walked away.....

ebo · Post by **ebo** » 29 Mar 2005 13:43

This has been going on for more than 2 weeks now, and I STILL get
trojans everytime I log-on. Apparently, the virus is called
"TrojanDownloader.JS.gen". WTF Can someone fix this very soon, please.

edit: For the record, I'm running Opera and "G-Data AntiVirenKit (German)"

Tsiangkun · Post by **Tsiangkun** » 29 Mar 2005 14:11

I think the system works like this.

On modified there is a link to a webpage that serves up a trivially encrypted string of unicode characters. Javascript is used to execute the unicode string through the eval function, and the newly created executable code downloads the trojans for you.

Try turning off javascript or something.