[Malware on Forum, iFrame tag] What does the forum use mediacount.net for ?

General Topics
21

I’m still experiencing deep lags using avast + Firefox + Comodo.
The lag does not occurs so deeply if I browse with Opera.
The lag disappears if I browso with Opera and WebShield disabled.
It’s becoming a mystery…

22

I’m OK so far with Avant (an IE shell).

Yesterday I couldn’t log in in Avant, Opera, or Firefox. I kept getting an incorrect password error. Couldn’t create a new account either.

23

Odd … if by Comodo you mean the firewall, I’m having no problems at all with the same combination (on dialup).

Maybe while you were sleeping, Brazil got moved to another planet so you now have a teensy bit of transmission lag? :wink:

24

Ok, agree with that, too. Don’t mind which form it takes. p’raps a forum announcement would be preferable.

25

Firefox users may have ben exposed to malware not detected by avast. I picked this up in my Firefox cache:

(The malware was still infecting the Google cache of the forum as of yesterday evening.)

Antivirus Version Last Update Result
AhnLab-V3 2007.8.25.0 2007.08.24 -
AntiVir 7.4.1.63 2007.08.25 HTML/Shellcode.Gen
Authentium 4.93.8 2007.08.25 -
Avast 4.7.1029.0 2007.08.25 -
AVG 7.5.0.484 2007.08.25 -
BitDefender 7.2 2007.08.26 -
CAT-QuickHeal 9.00 2007.08.25 -
ClamAV 0.91 2007.08.26 -
DrWeb 4.33 2007.08.26 VBS.Psyme.443
eSafe 7.0.15.0 2007.08.23 -
eTrust-Vet 31.1.5085 2007.08.24 -
Ewido 4.0 2007.08.25 Downloader.Psyme.kt
FileAdvisor 1 2007.08.26 -
Fortinet 2.91.0.0 2007.08.26 VBS/Agent.U!tr.dldr
F-Prot 4.3.2.48 2007.08.25 -
F-Secure 6.70.13030.0 2007.08.24 -
Ikarus T3.1.1.12 2007.08.26 -
Kaspersky 4.0.2.24 2007.08.26 -
McAfee 5105 2007.08.24 -
Microsoft 1.2803 2007.08.26 -
NOD32v2 2484 2007.08.25 -
Norman 5.80.02 2007.08.24 -
Panda 9.0.0.4 2007.08.25 -
Prevx1 V2 2007.08.26 -
Rising 19.37.61.00 2007.08.26 -
Sophos 4.21.0 2007.08.25 Mal/JSShell-C
Sunbelt 2.2.907.0 2007.08.25 -
Symantec 10 2007.08.26 -
TheHacker 6.1.8.173 2007.08.26 -
VBA32 3.12.2.3 2007.08.26 -
VirusBuster 4.3.26:9 2007.08.25 -
Webwasher-Gateway 6.0.1 2007.08.26 Script.Shellcode.Gen

Seems to be an exploit so users of up-to-date Firefox were not at risk.

Still, a scan with Ewido/CureIT! might be in order.

EDIT: The write-up for this malware only states: ‘Exploits system or software vulnerabilities’, so I’m not sure if it was specifically aimed at Firefox. If it’s a VBS as DrWeb and Fortinet suggest, it might also have been aimed at IE. Don’t know why I found this one and not the ANI exploit.

http://www.sophos.com/security/analyses/maljsshellc.html

26

My goodness! Seems I missed all the fun here lately!.

Glad that things are working ok now though and good job getting rid of the culprit.

27

Hello malware fighters,

Do not give it to much attention. That is always the best policy. If no one was actually compromised. Again strange because this Iframe hacking in combination with a Storm worm variant happened to various other forums in 2004. It also happened to the site of The Register in the U.K. as I remember. So a security company should be aware of these things threatening their very forums.
On the other hand we could say that the very in browser security is far from ideal. If only script could be sandboxed really secure and this was brought in by default inside all kind of browsers, script kiddies and malware authors would not welcome that day. Hell no, they would have a troublesome time when NoScript was on in browsers for instance to launch their malicious attacks. But others would not welcome this very much because it would hamper their silent profiling, tracking and monitoring for what ever reason you could imagine. This is in a few words the actual crux of the big divide between easy and commercially interesting and secure and consumer friendly. So all solutions taken are still far from definitive, and the user has to bring in his own forms of protection, as you think of it really a shame.

polonus

28

I had the same problem on friday I got a web shield warning and IE7 came up with a request for a remote connection Active-x to run. To which I obviously said get lost . I did a full check afterwards and was clean so my security and webshield worked

29

I found that in my firefox cache too, when I ran avg-as scan afterwards. I have to admit I didn’t check the creation date and time. I also did a VT scan and send the sample to avast.

Now perhaps people will realise how powerful iframe tags can be when so many are used in emails. Hence the avast suspect alerts when found in emails.

30

Hmmm… what happened then? Do they sleep?

31
Do not give it to much attention. That is always the best policy.
[b]Sticking your head in the sand and making believe nothing happened is never a good policy.[/b] IMHO
32

No one’s sticking anything anywhere. Please see the other thread.

Cheers
Vlk

33

Thanks Vlk :slight_smile:

34

bob3160…

Have a blessed Sunday…it is Sunday afterall. :wink:

Peace

35

Thanks you to. :slight_smile:

36

Hi bob3160,

I did not mean that there should not be an analysis of the facts to better prevent this for the future, of course that is appropriate. I just meant to stay do not make it bigger than it is, because the people that do these things do this just because of that reason. That was all that I meant to say in my previous posting.

polonus

37

I would concur Pol I mean webshield stopped it