atention admin sever you have a virus

[1ajs 49]

i got a virus msg pop up and ..... well i killed it but i talk to several other plp they all geting virus off ya.... might wana kill the virus btw its a java virus and it trys to install it self as a plug in...........

[1ajs 49]

some more info

C:\DOCUMENTS AND SETTINGS\PORK\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\GHCHGZQT\XOCE[1].ANI

Contains signature of the exploits EXP/MS05-002.Ani.A beter

[tungston 19]

Check it out:

Check it out:

http://securityresponse.symantec.com/avcenter/venc/data/trojan.moo.html

 

 

 

Trojan.Moo is a Trojan horse program that exploits the Microsoft GDI+ Library JPEG Segment Length Integer Underflow vulnerability ( described in the Microsoft Security Bulletin MS04-028 ).

Note:

• This signature will detect files created by Hacktool.JPEGDownload .
• Virus definitions released September 27, 2004 and later detect this threat as Bloodhound.Exploit.13.

 

[Tolomar 5]

some self installers .exe files sometimes get false reading as virius, something to do with it not reconizing the file something geekie like that and to be on the safeside...porkie uses them, he ok in my books....got a few before here and there from other files...waited for an update and file then becomes ok......never picked up a virus from ST myself...try a new version of your security system or check for updates...

 

 

 

looks like that what happened here, but thanks for the heads up 

[tungston 19]

I didn't open any exe's, I got it from the page that 1ajs posted.

[gggg 9]

hmm...

something hapening here..

first the hack earlier this week and now this....

 

you guys realy need to do something about that...

wish I could help..

 

[gggg 9]

sorry for the 2nd Post but I just wonted to say that I just gott that Virus messege to

killed it though

[dhoppeii 12]

I too received this message this morning around 7 am while at work.  My companies network scan caught it.  It was the same file listed above, extension *.ani

I cleaned my temp folder and did a scan, but nothing else turned up.

[Compromise 1]

I got a message saying that a trojan has been detected and deleated about ten seconds after I logged on to ST and I got the message again about four more times until it stopped and has not gone off since. I did a scan of my system and nothing else has been found.

 

This is a bit of a major coinsidence that a virus has appeared on the system just days after a hacking insident. I think somebody really dosen't like ST and we need to up security as much as possible to stop this happining again.

 

EDIT: I have a picture...

 

https://www.simtropolis.com/idealbb/files//Simtroplis%20Virus.jpg align=baseline>

[Stanislavs1 1]

   Is it just happening with the Firefox browser? I use Internet Explorer 6 and never used an anti virus on this PC, and also never found a virus when I scanned online with McAfee.

[Superstar 69]

I think it may have something to do with the new member forum



This is what I get when on the main forums and notice that little dot at the end of the forums description...

[1ajs 49]

umm when i load ie i got 20 pop msgs warning me bye my anti virus of the same file so its not just mozila

when i came back on to check this i got the warning msg again and deleted the virus ... strange hope we don't loos anything

[MrCinatit 30]

good catch, superstar

[Andreas Roth 629]

I just tried it with Firefox 1.0.7 and Internet Explorer 6.0 SP2, and I don't see any Plugins needed messages, nor do I see the dot in the New Members forum description. I also deactivated my local ad blocking proxy and AdBlock from Firefox - no effect.

[mutter24 0]

I also got error message about that virus. So i went checked simtropolis' source code. It seems that there is an intruder in the code :



I don't what an iframe of Twobio is doing on Simtropolis but it looks suspicious...
It's the same thing as what Superstar showed. (I think)

[starrdarcy 4]

my computer has been acting strngly too, i see things that are running in the background that i have never sen befoe. That plugin window shows up, as well as the virus error.

[Compromise 1]

The dot has been deleated and I haven't seen any virus warning's since - if you see one now after the time this was posted please report it immediatley. As its looking like the dot is responsible I think we have another hacking of the bullition boards administration menu on our hands again, exactley like last time.

[ILL Tonkso 1,239]

So whats causing this? Banned member? Someone who doesnt like simcity? Royal? Internet Widespread Forum Cirus Epidemic?

[Jasoncw 11,949]

Whoever did it wanted us to find it. It's very easy to remove an iframes borders, so if the hacker didn't want us to find it they would have removed the borders. Or it's just a bad hacker.

I'm glad that I wasn't using simtropolis at the time, and I'm glad that I never use the all forums thing.

Edit: I just had another thought. If someone can hack into the forums then they could hack into the stex and possibly re-upload something and put a virus with it.

[Superstar 69]

I'm glad my pic helped fiz the prob!
Anyways it seems to me that the hacker wanted us to find it, I doubt it would be a bad hacker as he did manage to hack his way into ST at least twice
I think once again security needs to be seen to...this is not a very conforting matter

[Compromise 1]

Yes it looks like this hacker is thet's say more of a pranckster than a havoc casuser (currentley).

[Mikeaut1 261]

Wow, this is unbelievable. Sad to see a virus going around ST. Well, thanks for the notification, I'll be on the alert.

Hopefully the person responsible for this act will be found.

Also, is it harmful to download anything from ST at this time?

EDIT: Just notifying everyone that I've done some research on this twobio website, and the message has appeared in other forums on the web, as well as in email.

http://board.thefanlistings.org/lofiversion/index.php/t47740.html

[Micah 16]

Ohhhhhhhh... That explains it now. My antivirus program that the Trojan program was a virus. So it halted my internet connection for quite some time. I'm glad this thread caught my eye.

[Eastwinn 6]

Date: 11/30/2005 9:04:21 AM Author: dhoppeii 

 It was the same file listed above, extension *.ani

quote>

That's strange, an *.ani file is an animated cursor file. Those files are not capable of exicuting any code what so ever. All they do is play lopping animation that can be used as a cursor. This is very strange.

[TheCrybKeeper 301]

GNS released a recent artical on Virus' and hackers. Seems they have a new way of infiltrating software now. I will see If I can find it archived on the wire and provide a link.

 

EDIT: Jon hasn't put it up yet, is all I can gather. The article is recent and Jon Swartz writes for USAToday.

 

Title: Cyberattackers Slither Through Software Holes.

    by: JonSwartz

Picked up by GNS and The Gazette

 

 Cyber attackers, in a major new approach, are exploiting flaws in popular software programs__ especially anti-virus and back-up tools__to break into the computers of consumers, government agencies and businesses.

  The Change in attack, spells new headaches for PC users already under seige from hackers and another challenge for administrators.

Hackers have changed their tactics, says Alan Paller, research director at security firm Sans Institute, which discovered the new wrinkle in attacks and issued an alert. The bottom line is that security has been set back 6 years in just the past 18 months......

 

After A Short Sleep, The Monster Awakens 

By Michael Ellison

 

 This is a different form of attacks ladies and gentlemen. They are attacking a newly discovered vulnerability, in software utilities. Mainly anti-virus programs and back-up softwares. This also incudes movies, jpegs, flash, animated gifs or any download to a software or utilities application.

 My recent browsing habits, have resulted in some strange occurances, at a variety of websites, including ST, as you all are finding out.

 I believe they are feeling us out right now. We should take it all very serious and their is no such thing as a friendly hack, to show us our vulnerable side.

The Monster is back and stretching out its kinks. I would say, get ready for the pounce and nashing teeth, awful soon.

[PhilsCafe 8]

I just got this Virus Alert message when I entered simtropolis.com a couple of minutes ago!



Man, what the heck's goin' on here...?! Strange things are happening since ST got hacked!

- Phil

[sloppet 3]

It looks like I also have this problem.. man, that's not too good for t...

[Hordijk 18]

Same here, got the message three times in row when entering the Home page three times
It's called: downloader.trojan

[Alkaola 18]

i also got trojan moo in my system, this is bad!

[vidioman 21]

Trojan Removal Website

If you get a trojan, this will tell you how to remove it. Many trojans use Java to get into the computer, I would recommend disabling it for now.

I dont have an anti-virus protection at the moment, so I've gone in and checked my computer as best I can. Nothing yet on my side, thankfully. At least not that I can tell..