atention admin sever you have a virus

[delboysim 1]

Its not just that darn trojan - this site has a redirect exploit attached to it ........................

 

 

Dont it just make ya wanna rip the face off the total idiot who put it there ...................................

 

 

 

 

Delboysim  ................. NOT A HAPPY GUY !!!!!!!!

 

 

 

 

Edit - the viruses are JSMHTMLredir!exploit and Win32.MS05-002!exploit ..............................

[Voar Tok 4]

For all the people who don't have any anti-virus software on their computer, you can go to grisoft.com and get AVG for free.  Not only can you get it for free, it is also considered to be one of the best anti-virus software programs in existence.

EDIT: I don't know whether this will help or not, but I have just been avoiding the home page right now; and I don't have a single trojan on my computer (at least not that I can tell).

[tsb29 0]

Crap.   Everytime I access the homepage my internet connection wizard pops up.  My Anti-virus program normally alerts me to unwanted files, but it might be time to run a scan. 

[Dirktator 2,327]

We're trying to figure out what's happening here.  Thanks for all the information, the more you can tell us the easier it is for us to try to find the cause.

I use both IE and Firefox with Macafee running but have not receieved any virus message yet.  Thanks again...

[Alkaola 18]

well dirk if its right to keep this updated as much as possible i can say i just recieved a ' Downloader.Trojan'10 times after every time, so i recieved it ten times

 

hmmm

[Fairlane500 8]

Well, I've been recieving a message from norton that a trojan is being blocked. Here is the message I recieve:

Note instead of an .ani file, it reads .anr.

http://img223.imageshack.us/img223/7176/vrs4vf.jpg align=baseline>

I also noticed some interesting messages of things being loaded at the bottom of the IE window, including Google.com and iframesite.biz/dl/adv519.php, or something similar. The virus window seems to pop-up while it is reading Google.com, and I think I saw the adress replaced with Blocked for an instant.

 

Hopefully these observations can go to some use.

[Dirktator 2,327]

Thanks for all the help, here's how you can help us further:

 

1.  Please document exactly where on the site you're seeing this. 

 

2.  On the page that you see this, please capture a screenshot, and View Source.

 

3.  Send that screenshot and the View Source text to dirktator@simtropolis.com

 

 

[zmveliger 16]

Hi, if it can help, that's what I got when I opened the main page (not even logged on).

https://www.simtropolis.com/idealbb/files//ST-virus.jpg align=baseline>

[Dirktator 2,327]

This is really disturbing.  I cannot find anything in any of ST's files or pages that contain a virus.

 

I have found that many other forums and sites have similar afflictions.

 

Even on sites that don't use any type of scripting or external references. 

 

If you do a google for sploit[1].anr you'll see a number of forums and sites discussing these same kind of infections.

 

I'm still working on figuring out why or how, but it still eludes me right now. 

[citynut 2]

im running mcafee antivirus and the firewall and have never gotton any type of warning or message and I scan my computer weekly - no probs - sorry I wish i could help out Dirk. but no probs here

[Compromise 1]

I have also not got any warnings at all when visiting this site of virus's today and my McAfee virus protection is completley up to date and I got warnings of viruses last time there was one on ST.

[sloppet 3]

well, I also get this information all the time on the main page.. the screen shot is on the page earlier... and btw, didi you have the previous problem with the trojan too dirk ?

[Dirktator 2,327]

There are reports of this happening on other sites and forums, all reports seem to be originating from the last few days:

 

http://www.zuga.net/forums/showthread.php?s=bae46b1365368f78a3d001abb1af8347&p=241079#post241079

 

http://www.johnwesleyharding.com/phpBB2/viewtopic.php?p=831 &

 

http://www.bullguard.com/forum/10/Massive-spread-of-viruseshelpp_9357.html

 

http://gallery.menalto.com/node/34050

 

http://forum.hijackthis.de/showthread.php?t=4991

 

http://help.lockergnome.com/lofiversion/index.php/t33296.html

 

etc..

 

If anyone reads up on anything, please post any info you have!

[Boggy1 45]

I have an up-to-date virus scanner and 3 backup firewalls, and I havent had anything yet.
Also, I've been viewing the source code (using Firefox) and I dont actually see anything out of the ordinary...

EDIT!! Just as I pressed Submit I tried ST on Internet Explorer and got 2 high risk warnings. I'm doing a scan right now.

[SimGoober 2,365]

Dirk, I PM'd this to you but...

 

Here is the text from the Norton Virus Alert :

 

Scan type:  Realtime Protection Scan
Event:  Virus Found!
Virus name: Downloader.Trojan
File:  C:\Documents and Settings\W63\Local Settings\Temporary Internet Files\Content.IE5\2JAD0LOT\sploit[1].anr
Location:  C:\Documents and Settings\W63\Local Settings\Temporary Internet Files\Content.IE5\2JAD0LOT
Computer:  XXXX

User:  w63
Action taken:  Clean failed : Quarantine failed : Access denied
Date found: Friday, December 02, 2005  12:50:19 PM

 

It only occurs on the SimTrop home page, and does every time I go there now.  Only started this afternoon, wasn't there this morning.  It's doing it on both my laptop and my PC.

[sloppet 3]

it looks like we're not the only one.. damn, I hope I could help more, but unfortunetly there's nothing I can do

[Boggy1 45]

Eh, as soon has I got the warning I went into Control Panel/Internet Settings and deleated everything in the Temp Files folder. Scanned it and I didnt get anything.
So my advice is that once you've got an alert, deleate everything inside that folder.

EDIT: maybe it has something to do with the Geo Visitors thing?

EDIT2: When I used Firefox I didnt get any alerts...so my advice is use Firefox.

[MallowTheCloud 41]

So... I'm wondering what this is...

[PhilsCafe 8]

I only get the message when I try to access the main page. When I go directly to the forums page, there is nothing like that. I'm using McAfee and I have posted a picture of the VirusAlert message on page one of this thread (maybe that helps). It says something about Java, so maybe it looks like the virus uses some Java applications.

Also, my browser crashes when I try to enter the main page. I think it happens when firefox tries to load the 'recent replies' frame.

Hope that was of some help.

- Phil

EDIT: I was also wondering about the 'Geo Visitors' button, but maybe we're just getting a little hysterical .

EDIT 2: About what SkiGeek says below, maybe that would explain why McAfee wasn't able to clean it... I found the 'files' in the quarantane.

[toxicpiano 125]

Date: 12/2/2005 1:04:26 PM Author: MallowTheCloud So... I'm wondering what this is...

quote>

it tells you where people that visiting the site are visiting from.

[MallowTheCloud 41]

Date: 12/2/2005 1:08:25 PM
Author: toxicpiano
it tells you where people that visiting the site are visiting from.

quote>

Ah, I see. So it's supposed to be there then.

[Boggy1 45]

Date: 12/2/2005 1:08:25 PM
Author: toxicpiano

Date: 12/2/2005 1:04:26 PM Author: MallowTheCloud So... I'm wondering what this is...

quote>

it tells you where people that visiting the site are visiting from.

quote>


But the virus alerts seemed to happen after that button got installed...

Anyway, I'm still reading the source but I cant find anything so far.

[Voar Tok 4]

This has probably already been posted, but I did a google search for  downloader.trojan and apparently this file has a few derivatives of itself that masquerade as Windows Service Packs .

Dirk, I know that moral support doesn't actually get a job done, but you have my unwavering support, especially in this weird event.

[Meg 368]

I got the alert and scanned my computer and didn't find anything.  Is it possible this is a fake alert?  or do we have evidence that it is real?

[Compromise 1]

Date: 12/2/2005 1:31:02 PM Author: SkiGeek I got the alert and scanned my computer and didn't find anything.  Is it possible this is a fake alert?  or do we have evidence that it is real?

quote>

Yesw it's strange some get the alret and some don't, perhaps it is a fake but either way I am confident that the Geo Visitors button has nothing at least directley to do with it.

[zmveliger 16]

Looks like a temp file vanishing after closing an apps. BTW Dirk, I just sent you my source txt file by e-mail.

I'm afraid I can't help much more on that. If I see something strange happening again, I'll let you know...

[sim1234 62]

I'm getting the high risk alert too! I'll check the source now!

EDIT: I just sent dirk the source of my home page and a link describing the effects of the virus that is described.

http://img217.imageshack.us/img217/1237/vps4ku.jpg align=baseline>

[Athens2004 1]

Hello,

I think a member of Simtropolis attached a copy of that virus to his message.

[Fairlane500 8]

Just with a hunch, I entered iframesite.biz which I had seen as something being loaded on the home page, into Google, and I also came up with a number of results regarding virus/trojan problems on forums.

 

The most interesting result was at this sitem the Internet Storm Center:

http://isc.sans.org/diary.php?date=2005-11-19

 

It sounds like this iframesite.biz is the source of a number of different problems with related sources.

 

I wonder if that site has something to do with the problem?

[Rymac91 15]

thats strange....I haven't had a singe problem and all my Anti virus stuff is updated...even on IE...I haven't had a single problem...not sure if this matters...