Virus on Hibs.net

[Martin]

When going on to Hibs.net i'm getting a virus alert for a Trojan.....

JS:ScriptPE-inf [Trj]

[therealgavmac]

When going on to Hibs.net i'm getting a virus alert for a Trojan.....

JS:ScriptPE-inf [Trj]

Yes me too - on every page or message I try to open

Petrie - get it sorted :grr::grr:

[khib70]

When going on to Hibs.net i'm getting a virus alert for a Trojan.....

JS:ScriptPE-inf [Trj]
Me too. Its associated with this URL http://unistends.com/nn/. My antivirus is coping with it, but be careful out there!

[Martin]

For anyone without virus software it could already on that users machine....

would suggest AVG free as checker/solution

http://free.avg.com/gb-en/download-avg-anti-virus-free

[Jay]

Me too. Its associated with this URL http://unistends.com/nn/. My antivirus is coping with it, but be careful out there!

I got that unistends at the bottom where it says done as it was trying to load hibs.net then it came up with this website wants to run an add on then it was closed down.

Sorry not the most technical explanation :greengrin

edit: Still getting that unistends bit.

[Golden Bear]

Norton just alerted me that an attempt was recently made to attack my computer but it was successfully "blocked".

[HibeesLA]

Norton just alerted me that an attempt was recently made to attack my computer but it was successfully "blocked".

Symantec Corporate does not find anything.

[khib70]

See also this Holy Ground thread:-

http://www.hibs.net/message/showthread.php?t=176025

[Martin]

Symantec Corporate does not find anything.

That's what I am using at work and it's popping up everytime I open a new window in hibs.net

[Martin]

See also this Holy Ground thread:-

http://www.hibs.net/message/showthread.php?t=176025

That's a different virus .....

[DaveF]

We are looking into it.....

[down the slope]

Buy an apple Mac. no probs.

[WarringtonHibee]

Ooh, I love my iMac. :greengrin

[HFC 0-7]

I think the virus is called Exploit.JS.Agent.avm. Its a virus contained in a file on the site which downloads and installs malicous software on your PC, it also finds weaknesses in your security and firewalls allowing other programs to gain access.

[Arch Stanton]

Buy an apple Mac. no probs.

I was going to post the same about Linux but since I don't have a virus checker I realised I can't actually be certain of that.

I'm pretty sure that there should be no way for a trojan to be delivered via Firefox on Linux - but I'm not exactly an expert. That said, Linux shouldn't make much sense of a Windows Trojan anyway.

However, no harm in keeping my fingers crossed as well. :greengrin

[cabbageandribs1875]

is this specific to certain browsers ? opera appears ok

[MrSmith]

Just taken AVG and Zone Alarm off of my machine - it was running like a pig in treacle!

Downloaded COMODO internet security suite and have to say the results are great and my machine feels refreshed.

download here: www.filehippo.com

[MyJo]

Is this something specific to IE?? i use chrome for browsing on my netbook

[Keith_M]

I'm pretty sure that there should be no way for a trojan to be delivered via Firefox on Linux - but I'm not exactly an expert.

Unfortunately, that's not strictly true. However, most viruses are aimed at Windows exploits, probably down to the number of Windows machines out there.


That said, Linux shouldn't make much sense of a Windows Trojan anyway.

No, it won't, but it's entirely possible for a Linux machine to be exploited to spread viruses. As a kindness to others, Linux users often install anti virus software for this reason.

[Arch Stanton]

No, it won't, but it's entirely possible for a Linux machine to be exploited to spread viruses. As a kindness to others, Linux users often install anti virus software for this reason.

Fair point, I'll do that then. :agree:

Edit - It is free on Linux after all! :greengrin

[khib70]

Buy an apple Mac. no probs.
Only problem is winning the lottery first.

[TheEastTerrace]

Just received the same message from my Norton Anti-Virus. Thankfully, seems to be blocked.

[Peevemor]

is this specific to certain browsers ? opera appears ok

I only had the pop-ups first thing, but my "iSpy" is goosed on both firefox and IE.

[Petrie's Tache]

Just taken AVG and Zone Alarm off of my machine - it was running like a pig in treacle!

Downloaded COMODO internet security suite and have to say the results are great and my machine feels refreshed.

download here: www.filehippo.com (http://www.filehippo.com)


I did the same, woerks great. I use it with Avira anti virus and they are both excellent programs.

[Martin]

More than likely it will be restricted to IE as it is about as safe as a chocolate tea pot

[sleeping giant]

I did the same, woerks great. I use it with Avira anti virus and they are both excellent programs.

Veird !!

So do i :greengrin

[MountcastleHibs]

is this specific to certain browsers ? opera appears ok

Must be. I'm fine on Safari.

[--------]

Is this something specific to IE?? i use chrome for browsing on my netbook

I'm getting it with Google Chrome as well.

I can only get on by using the 'history' pathway there.

I think I'm going to log off for a while.

I have Avast! Antivirus (the free version) and it seems to be blocking OK -m just making life extremely tedious with the pop-up and that plummy female voice.

[Mikey]

We're pretty sure it was a false report from the Google ads on here. Still checking but that's what it looks like.

Anyone still getting it?

[Disc O'Dave]

We're pretty sure it was a false report from the Google ads on here. Still checking but that's what it looks like.

Anyone still getting it?

Yes, I am.

[surreyhibbie]

Not any more, it was being picked up by Kaspersky on the Proxy server at work, seems to have cleared now.

No substitute for a serious AV package on your desktop/laptop though. :wink:

[--------]

We're pretty sure it was a false report from the Google ads on here. Still checking but that's what it looks like.

Anyone still getting it?

Yip. Every freakin time I post. :grr:

And then, when I replied, the browser didn't automatically send me back to the forum. I had to click the link.

[bournehibby]

Yes, I am.
Me too, Norton report says "attack successfully blocked"

bh

[paullotion]

I would suggest pulling the banner ads as i have seen this happen before on forums, most likely as others have said it will run a fake online scan where upon it will tell you that your are infected, this is bogus.

It will then want you to run an exe file(do NOT run the exe), better to save the exe file to your desktop(most likely called install.exe and usually about 1MB in size), you can then click on the home button in your browser, the fake scanner page will give you another warning, choose yes to leave site.

[blackpoolhibs]

I'm using Opera, with AVG free as my av, and have had nothing at all?

[TornadoHibby]

When going on to Hibs.net i'm getting a virus alert for a Trojan.....

JS:ScriptPE-inf [Trj]

Me too! My anti virus software picked it up and posted and alert! :agree:

Not good though Admins! :grr:

[paullotion]

Done some further testing in the virtual machine, upon entering the site using IE6, Kaspersky informs me about opening a malicious PDF file(not using any PDF software in the VM), next i receive a warning about Trojan.scar, i have yet to find any malicious files inside the VM.

I did allow both files to run, the url that is trying to load the trojan scar is:

hxxp://unistends.com/nn/exe.php?spl=MDAC

It downloads a file called exe.exe which is 7kb in size, here is the virustotal scan report

http://www.virustotal.com/analisis/431200b2890ab3ef305d37ece2b0581487c4abbfdbaebd9981 215ea20930a3cd-1267102879

[Petrie's Tache]

Veird !!

So do i :greengrin

I know. It was based on this I changed my old ones.:wink:

[paullotion]

Just run the exe.exe file and it downloads hide.dll which is a Trojan.Win32.Agent.clrv from:

hxxp://unistends.com/oem/faq/load/hide.dll

It then tries to load a Trojan-Spy.Win32.Insain.ir from:

hxxp://uninstends.com/oem/faq/ggl_chrome.exe

At this point it reboots your system.

It drops a couple of files into these location(using XP):

C:\Documents and Settings\username\Application Data\c.exe

The virustotal report on this file is exactly the same as the exe.exe file.

C:\Documents and Settings\ABC\Application Data\52386207.exe

Here is the VT report on that file:

http://www.virustotal.com/analisis/5d8991db54393c9aee1e0d32d2bd971ca5c8669339ee593b8d 9bda6967d16e10-1267104036

[passionatehibby]

Not happy chappie :grr: I've been infected and it's corrupted Mozilla. My avg picks it up but cannot delete. Malware bytes deleted it but it's cam back.:grr:

I cant belive I have picked this up from hibs .net

You seriously need to sort out your security on this site . :boo hoo:

Looks like I will have to format my hdd which will take me hours as I have lots of stuff to save first :grr:

FEC K INg DEVASTATED :grr:

[Wembley67]

Not happy chappie :grr: I've been infected and it's corrupted Mozilla. My avg picks it up but cannot delete. Malware bytes deleted it but it's cam back.:grr:

I cant belive I have picked this up from hibs .net

You seriously need to sort out your security on this site . :boo hoo:

Looks like I will have to format my hdd which will take me hours as I have lots of stuff to save first :grr:

FEC K INg DEVASTATED :grr:


Think your being a wee bit hasty with the format...someone will be along to sort it for you.

[Beefster]

Not happy chappie :grr: I've been infected and it's corrupted Mozilla. My avg picks it up but cannot delete. Malware bytes deleted it but it's cam back.:grr:

I cant belive I have picked this up from hibs .net

You seriously need to sort out your security on this site . :boo hoo:

Looks like I will have to format my hdd which will take me hours as I have lots of stuff to save first :grr:

FEC K INg DEVASTATED :grr:

You must have done something to allow it to infect you so I wouldn't be directing all your anger at the admins.

[paullotion]

It also drops this file:

C:\Documents and Settings\username\Local Settings\temp\f.dll

Here is the VT report

http://www.virustotal.com/analisis/adb03ea38a382b0793a2c6cc0a2bd86256a770c2fe871bd11b 7ed75644909043-1267104305

That is all i can find

[phoenixfire]

Still getting it:grr:

[silverhibee]

Seems to have gone for me, logged out and back on and everything working fine. Fingers crossed.:greengrin

[Beefster]

It also drops this file:

C:\Documents and Settings\username\Local Settings\temp\f.dll

Here is the VT report

http://www.virustotal.com/analisis/adb03ea38a382b0793a2c6cc0a2bd86256a770c2fe871bd11b 7ed75644909043-1267104305

That is all i can find

Good stuff, matey. I'm sure some folk will find all your work very handy.

I did find some further help for folk that you might have missed though:

http://dsskcorp.com/ibidem/fotographia/misc/panic!at.teh.dsskcorp.gif

[silverhibee]

i-spy working as well.

[Mikey]

You must have done something to allow it to infect you so I wouldn't be directing all your anger at the admins.

Indeed. There's nothing wrong with his PC.

We've been watching this one for some time and he's done something daft here that's blown in cover for sure.

So it's time to go :greengrin

[Mikey]

Seems to have gone for me, logged out and back on and everything working fine. Fingers crossed.:greengrin

More and more people are finding that it's fixing itself through the day. That backs up our assumption that it's a false report caused by the Google ads.

We're still checking but as far as we can see there's absolutely nothing wrong with the site and it's anti virus programmes picking up problems incorrectly.

[Peevemor]

I hate to say it folks, but I'm getting all sorts of pop ups now.

IE (which isn't my default browser) just opened itself at a pron download site.

Please don't fax me back to Lithuania.

[Peevemor]

Latest


attack from 249.44.78.74
port 61499

attacked port - 51845

threat - Win32/Nuqel.E

[Martin]

Yeah I'm still getting it also.

[Jonnyboy]

Glad to say I'm virus free. I do have a bit of a sore shoulder though

[Ryan91]

Running McAfee Anti-Virus on Windows 7 not picking up anything, then again, my old man has configuired a firewall on the home network, so nothing major on my computer. I figure it is best to simply close down your browser if you ever get redirected to sites that say that they are running a scan.

[hibs is life]

a was getting it of an other forum that a was on and its all of the forums sites due 2 adds that try 2 get u 2 buy virus things but its the adds that is causeing it but as admin said its needing changed back 2 google adds and that fixes it but the site is fine with ma computer now :thumbsup::thumbsup:

[Mikey]

a was getting it of an other forum that a was on

Makes sense. We still reckon it's Google.

Google ads has been tweaked. Anyone still having problems?

[hibs is life]

Makes sense. We still reckon it's Google.

Google ads has been tweaked. Anyone still having problems?

nope its all sorted now a come on this site and the other 1 every night and its all working fine now and no 1 on the other forum is haveing a problem

[Martin]

Seems to have stopped now

[Mikey]

Cheers Martin.

Anyone still getting virus warnings?

[paullotion]

Cheers Martin.

Anyone still getting virus warnings?


Kaspersky is still giving those alerts as before, the lab have not gotten back to me so far, i may have to send them another reminder.

[DaveF]

Some info here http://forum.kaspersky.com/index.php?showtopic=155379

I'm not seeing the error so don't know the URL mentioned in that topic is the same as what people are getting?

[paullotion]

Some info here http://forum.kaspersky.com/index.php?showtopic=155379 (http://forum.kaspersky.com/index.php?showtopic=155379)

I'm not seeing the error so don't know the URL mentioned in that topic is the same as what people are getting?


Thanks, i remember that and it was corrected, this one is a heuristic detection for Iframer- lot of these going about.

Only the lab can remove that detection, if it is a f/p.

[WindyMiller]

Thanks, i remember that and it was corrected, this one is a heuristic detection for Iframer- lot of these going about.

Only the lab can remove that detection, if it is a f/p.


Whooooosh!

[paullotion]

Just got word back from Kaspersky Lab and they say:


This is not false alarm. This site is infected.

[Disc O'Dave]

Cheers Martin.

Anyone still getting virus warnings?

Yes, I'm still getting it.....

[ancient hibee]

I was in my hotmail sending an email and the hibs.net page came up and took my email off?

[weststand1973]

Last night virus scan finished and given all clear, switched on the laptop this morning and got a warning about some virus. After reading this thread i checked the log and it mentions that 1 was a readme pdf and the other is a nn.htm it also mentions that the virus is Exploit.js Pdfk.bpa WTF:grr:

[gramskiwood]

Cheers Martin.

Anyone still getting virus warnings?

I'm getting a warning from Norton (it's blocking it though). I'm using Opera as my browser.

[CMac1988]

I've been on a few times today and have had no such problem. Running Firefox 3.6 (latest build), and AVG which is also up-to-date.

Could it be the ads (does this site have ads)? I use Adblock plus so don't see any of them as they dont even get to load up.

[CMac1988]

UPDATE - Just checked the ABP (Adblock Plus) blocked items, and it has the previously mentioned;

h ttp://unistends.com/nn/

and also

h ttp://unistends.com/unicounter/go.php?sid=1

It also mentions that they are frames.

A few checks on them bring up;

http://safeweb.norton.com/report/show?name=unistends.com
http://www.siteadvisor.com/sites/unistends.com/postid?p=3819181

[barcahibs]

just logged in via my phone and it immediately downloaded two pdf files one called readme and one called clipper. Hibs.net is the only site i.ve been on so can't see where else they could have come from?

[whiskyhibby]

Norton just alerted me that an attempt was recently made to attack my computer but it was successfully "blocked".


Same here

:grr::grr::grr:

[whiskyhibby]

Definately dont try accessing the site via your phone I would suggest, others view on this?

[ancient hibee]

I tried to open my hotmail just now-got as far as my inbox and it was immediately replaced with the Hibs.net front page-for some reason my Norton antivirus hasn't protected properly.Any suggestions?

[carnoustiehibee]

im still getting pop-ups and network intrusion detected. how do i get rid of this?

[PC Stamp]

Avast still detecting virus with me.

[hibbybob]

Avast still detecting virus with me.

Me too!

[Swoosh]

Still getting it Mikey, Disabled my Java plug ins in Firefox and that seems to have fixed the problem.

[hibiedude]

My Machine is working fine cheers Admins :greengrin

[Martin]

I'm getting it again sorry Mikey

[Sean1875]

just had to pause my kaspersky to get on the site as it wasnt letting me cause its infected :grr:

[RickyS]

just had to pause my kaspersky to get on the site as it wasnt letting me cause its infected :grr:

me too, I just had to click proceed despite malware warning!!!

[Mikey]

Are you guys still getting warnings? Google ads are now off altogether.

[HibbyAndy]

Are you guys still getting warnings? Google ads are now off altogether.

Just logged on for the 1st time today, And yes i got a warning.

[BigKev]

Are you guys still getting warnings? Google ads are now off altogether.

I am - on both Opera and Firefox

[Calvin]

Even getting it through Safari on my MacBook!

[Calvin]

Safe Browsing
Diagnostic page for accuratestatistic.com

What is the current listing status for accuratestatistic.com?
Site is listed as suspicious - visiting this web site may harm your computer.

Part of this site was listed for suspicious activity 1 time(s) over the past 90 days.

What happened when Google visited this site?
Of the 73 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-02-25, and the last time suspicious content was found on this site was on 2010-02-25.
Malicious software includes 40 trojan(s).

This site was hosted on 1 network(s) including AS49087 (TELOS).

Has this site acted as an intermediary resulting in further distribution of malware?
Over the past 90 days, accuratestatistic.com did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?
Yes, this site has hosted malicious software over the past 90 days. It infected 57 domain(s), including zipjogos.com.br/, fajalobi.sr/, coralina.gov.co/.

How did this happen?
In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

[lyonhibs]

Yup, I have to open each thread in a new Firefox tab/window.

Trying to left click onto a thread on my original window gives me the following error message:


Edit: scratch that, I went back to my original window to try and Copy across the error message for the Admins and now left-clicking is working fine - at least temporarily!!! :confused:

[DaveF]

We are working on it folks.

Apologies to all affected.

[Sir David Gray]

I've had no warnings of any problem at all today and I'm with McAfee and use Internet Explorer for the internet.

Either I'm unaffected or a virus has entered my machine and gone undetected.

[hibbie02]

I have had all my anti-virus and malware software knocked out. The virus has taken over as Admin on my PC and it won't even let me open Task Manager as it says it has been switched off by the admin. I can't download any new antivirus software as it blocks it. I am using Chrome and getting a corrupt file message constantly.

I did run Super AntiSpyware earlier and it found 42 infected files and it deleted the lot and rebooted. Now my PC is Donald Ducked and has been taken over by the virus. Not ****in Happy!!!!!

[paullotion]

Are you guys still getting warnings? Google ads are now off altogether.

No more warnings with the ads pulled.

[IWasThere2016]

Nae worries here

[Toaods]

Not any more, it was being picked up by Kaspersky on the Proxy server at work, seems to have cleared now.

No substitute for a serious AV package on your desktop/laptop though. :wink:



near shat myself at work when I jumped on and off dotnet to see if any PM's had come in.

Sophus warning to have me contact the works IT mob as I'd been infected, etc. Thought I was in deep doggy doos as I'm on a warning after getting the old 4th official smacked wrist when previously sending a visual joke about the US air Force about to dish out a missile to Mr Bin Laden. :greengrin

Spoke to the IT chap and he was surprised as he said they normally get a report before I do when affected but they had nothing.

Ran a scan and no further problems.

...and there was me saying my goodbyes and packing up my personal items.....:bye:

[Malthibby]

Usually a smug Apple git, but Calvino has a MacBook affected?

[Jim44]

I got a warning from AVG a couple of hours ago and 'quarantined' it there and then. I've closed down and opened my PC few times and it seems to be all clear.

PS Talk about speaking too soon. Shortly after posting this message I got 'locked out' ................some error message about 'Apache/red hat server' or something along these lines. If I try to get on to Hibsnet via my favourites link I get the error message but if I type www.hibs.net into the address bar it's ok.

[Calvin]

Usually a smug Apple git, but Calvino has a MacBook affected?

I did. Then the site was forbidden for 10 minutes, now I'm having no problems.

[Hibs90]

I did. Then the site was forbidden for 10 minutes, now I'm having no problems.

just got the forbidden message for 10 minutes there, on XP myself. Not had any virus warnings though.

[phoenixfire]

Seems to be ok:thumbsup:

[blackpoolhibs]

just got the forbidden message for 10 minutes there, on XP myself. Not had any virus warnings though.

Me too, doing a virus scan at the moment, some folks avatars were not showing up????/

[Westie1875]

just got the forbidden message for 10 minutes there, on XP myself. Not had any virus warnings though.

Me too, not had any other warnings though and I use Norton.

Just done a scan now and its removed 42 tracking cookies - yikes!

[iwasthere1972]

I've had no problems on Hibs.net today except for when I tried to post on this thread about half an hour ago. I then had a forbidden notice of some kind and then couldn't get on the site. Weird or what.

[hibee_nation]

PC tools spyware doctor with anti virus aint the cheapest but it took care of this virus no probs, would recommend it to others who experienced difficulties.

[cabbageandribs1875]

Done some further testing in the virtual machine, upon entering the site using IE6,


no offence, but i cant believe someones actually still using IE6 :confused: theres been security concerns about this version for several months now, and iirc even a few governments banning the use of IE6 including our own being advised to http://www.theinquirer.net/inquirer/news/1590090/blighty-politicians-told-ie6-ban

A PETITION has been presented to 10 Downing Street calling for the outlawing of Microsoft's Internet Explorer 6.

The petition was set up by Dan Frydman of web firm Inigo. It calls for the UK government to ban Internet Exploder 6 and move to a more modern web browser.

it's been mentioned on all media outlets often enough i imagined everyone would know about it, unless your just back from a lunar landing and missed it all :devil:


P.S. admin....the pages still aren't fully loading correctly(opera) :boo hoo:

[Beefster]

no offence, but i cant believe someones actually still using IE6 :confused: theres been security concerns about this version for several months now, and iirc even a few governments banning the use of IE6 including our own being advised to http://www.theinquirer.net/inquirer/news/1590090/blighty-politicians-told-ie6-ban

A PETITION has been presented to 10 Downing Street calling for the outlawing of Microsoft's Internet Explorer 6.

The petition was set up by Dan Frydman of web firm Inigo. It calls for the UK government to ban Internet Exploder 6 and move to a more modern web browser.

it's been mentioned on all media outlets often enough i imagined everyone would know about it, unless your just back from a lunar landing and missed it all :devil:

He was doing testing in a test environment AFAIK. Considering the guy obviously knows his onions, I'd be surprised if he uses IE6 day to day.

[Horse]

Buy an apple Mac. no probs.

Aye. Macs rule!

[I'm_cabbaged]

:confused:

When I logged on this morning it said the site wanted to run an add on and I pressed ok (being a thick bassa :greengrin), have I feked up?

[Sir David Gray]

just got the forbidden message for 10 minutes there, on XP myself. Not had any virus warnings though.

I had that as well about an hour ago. Like you, I've still had no virus warnings.

[Martin]

:confused:

When I logged on this morning it said the site wanted to run an add on and I pressed ok (being a thick bassa :greengrin), have I feked up?

I would get a virus checker and start a scan straight away

[Gatecrasher]

:confused:

When I logged on this morning it said the site wanted to run an add on and I pressed ok (being a thick bassa :greengrin), have I feked up?


i done the same, im about 60% way through a scan and nothin found yet, i done a quick scan with nothing found and im doing a full scan now :agree:

[blackpoolhibs]

A lot of the avatars have again disappeared for me, this happened about an hour or so ago, then i could not get on for a while.:confused:

[WindyMiller]

I've had no warnings of any problem at all today and I'm with McAfee and use Internet Explorer for the internet.

Either I'm unaffected or a virus has entered my machine and gone undetected.


As am I, and I've had nothing, and I've ran a scan which shows nothing.

[chorley_fm]

got the warning about half an hour ago but just logged back in and no problems so far

Using firefox

[Sir David Gray]

i done the same, im about 60% way through a scan and nothin found yet, i done a quick scan with nothing found and im doing a full scan now :agree:


As am I, and I've had nothing, and I've ran a scan which shows nothing.

I've just done a quick scan and nothing's shown up. I've just started a full scan so hopefully that will be fine, too. :pray:

[cabbageandribs1875]

He was doing testing in a test environment AFAIK. Considering the guy obviously knows his onions, I'd be surprised if he uses IE6 day to day.


i misread, apologies to paullution(sp), anyone else using opera ? pages take about 10 mins to load and even when they do load there's parts missing :boo hoo:

[thebakerboy]

Use talktalk online security and it reported a virus earlier and quarantined and then deleted . Did not make connectio until saw this thread bu PC seems OK

[PC Stamp]

Various tabs have disappeared such as all the ones like add link, add url etc and reply/edit tabs etc but no longer getting virus warning from Avast.

[ballengeich]

As am I, and I've had nothing, and I've ran a scan which shows nothing.

Me too. McAfee doing what we've paid for?

[Martin]

Me too. McAfee doing what we've paid for?

It depends what's on your machine. If it's malware McAfee might not even notice it

[DaveF]

If you are using the 'green' style then there are a few issues with icons, buttons etc but these will be fixed shortly.

[ballengeich]

It depends what's on your machine. If it's malware McAfee might not even notice it

Machine's working ok. Do you know of anything else that can be run to check for malware?

[WarringtonHibee]

Usually a smug Apple git, but Calvino has a MacBook affected?

May get a pop up but he won't get infected, as it'll not be able to execute on a UNIX OS.

[WindyMiller]

It depends what's on your machine. If it's malware McAfee might not even notice it

I have McAfee through my package with BT.
I've no idea if it's good or bad, but it has not been infected with this problem.

[HFC 0-7]

Just spoke to my system guy again at work, I had told him earlier I was getting the warning coming up but it has gone. He checked the logs for the internet security and it showed a different file trying to download each time and some of them have managed through. The ones that got through were through PDF files, not sure what that means, bottom line is, Mcafee is letting some through!

[The_Todd]

Here's what happened to me today at work:



Logged on to .net
Firefox froze
A Command window opened up and tried to run something from my temp folder
Then suspicious processes appeared in my task manager list

So I:


Installed Malwarebytes
Ran a scan
Removed the infection

Sorted.

[Liam89]

Forbidden

You don't have permission to access /message/forumdisplay.php on this server.

Apache/2.2.3 (Red Hat) Server at www.hibs.net Port 80


First virus messages now this. :boo hoo::boo hoo:

[Sexton]

Just got that too, but refreshed the page and it was fine.

[jonty]

Forbidden

You don't have permission to access /message/forumdisplay.php on this server.

Apache/2.2.3 (Red Hat) Server at www.hibs.net (http://www.hibs.net) Port 80


First virus messages now this. :boo hoo::boo hoo:

only happened when fixing the green skin. sorted now

[jdships]

Forbidden

You don't have permission to access /message/forumdisplay.php on this server.

Apache/2.2.3 (Red Hat) Server at www.hibs.net Port 80


First virus messages now this. :boo hoo::boo hoo:

Just had the forbidden notice at 20. 51hrs
Tried again to open at 20.53 all OK :confused:

[PC Stamp]

only happened when fixing the green skin. sorted now

All good here. :thumbsup:

[Martin]

Machine's working ok. Do you know of anything else that can be run to check for malware?

Yeah mate try this:

http://www.microsoft.com/Security_Essentials/

It's free I just run a check and it found a couple of things

[Speedy]

I've been getting the message all day but it's away now. It actually kept me off the site and let me get on with my dissertation...:top marks

[vahibbie]

I have had all my anti-virus and malware software knocked out. The virus has taken over as Admin on my PC and it won't even let me open Task Manager as it says it has been switched off by the admin. I can't download any new antivirus software as it blocks it. I am using Chrome and getting a corrupt file message constantly.

I did run Super AntiSpyware earlier and it found 42 infected files and it deleted the lot and rebooted. Now my PC is Donald Ducked and has been taken over by the virus. Not ****in Happy!!!!!

Had something similar, not related to this current problem tho.
Try starting up in "Safe Mode" and run antivirus and malware software.
Malwarebytes found my problem no bother.

[blackpoolhibs]

Had something similar, not related to this current problem tho.
Try starting up in "Safe Mode" and run antivirus and malware software.
Malwarebytes found my problem no bother.

How do you do this?:confused:

[Sergey]

How do you do this?:confused:

When you boot up your PC, press the F5 button.

Takes you into DOS.

If you don't know what that means, buy the "PC For Beginners" manual.

[HH81]

When you boot up your PC, press the F5 button.

Takes you into DOS.

If you don't know what that means, buy the "PC For Beginners" manual.

:faf:

My pc now seems to be working, just like that.

Does anyone know the cause or we still guessing?

[ballengeich]

Yeah mate try this:

http://www.microsoft.com/Security_Essentials/ (http://www.microsoft.com/Security_Essentials/)

It's free I just run a check and it found a couple of things

Thanks for the help.

[Hibs On Tour]

Hey admins,

Saw this and thought of you!

http://uk.trendmicro.com/uk/products/sb/worry-free-secure-site/ (http://uk.trendmicro.com/uk/products/sb/worry-free-secure-site/)

Enjoy!

[An Leargaidh]

I have an iMac running OSX 10.5 and Firefox and a netbook running Windows XP / Firefox with AVG free and had no problems at all over the last few days which is either good news or bad news (i.e. something bad has happened that I don't know about yet)

I wonder how some folk were getting humped with the trojan and some folk like me got no problems at all? Maybe it ran out of steam somwhere around Falkirk... :greengrin

Seriously though, I'm guessing if it was a Windows related trojan then it would not show up on my iMac but I am never sure how good the free version of AVG is on this netbook?

[Austinho]

Using an iMac with Safari. Got an unfamiliar message when I first logged on this morning, and instinctively cancelled it without reading it. Safari then immediately quit.

Had a problem when I was on Facebook later, Safari also just crashed and I had to force quit a couple of times.

No problems since then. Worried though!! Anything I can use to solve the problem on a Mac?

[Nazz]

What's happened to the main page? When I type in 'http://www.hibs.net' in the address bar, I am redirected to 'http://www.hibs.net/message/'. This has only started this morning for me. I am using Firefox.

[vahibbie]

When you boot up your PC, press the F5 button.

Takes you into DOS.

If you don't know what that means, buy the "PC For Beginners" manual.

Try F8. Hold down while booting up.
It will give you several choices, one being safe mode.

[Mikey]

What's happened to the main page? When I type in 'http://www.hibs.net' in the address bar, I am redirected to 'http://www.hibs.net/message/'. This has only started this morning for me. I am using Firefox.

The front page is disabled for now.

[DaveF]

What's happened to the main page? When I type in 'http://www.hibs.net' in the address bar, I am redirected to 'http://www.hibs.net/message/'. This has only started this morning for me. I am using Firefox.

There is a redirect in place at the moment, while we continue to investigate how this happened.

[Edinburgh Green]

This may be a stupid question, can you get a virus by using the internet on a mobile phone?

[Disc O'Dave]

I did have the problem using the work PC yesterday (Trend Micro) - it blocked a file on every page.

At home I have AVG 9 and it picked up nothing in the evening (obviously I checked it was up-to-date first) , and it's all fine back at the work PC today.

Whatever caused the problem seems to have gone for me.

Cheers

Dave

[Martin]

This may be a stupid question, can you get a virus by using the internet on a mobile phone?

You could - but its unlikely because it is attacking a different operating system.

[Beefster]

Using an iMac with Safari. Got an unfamiliar message when I first logged on this morning, and instinctively cancelled it without reading it. Safari then immediately quit.

Had a problem when I was on Facebook later, Safari also just crashed and I had to force quit a couple of times.

No problems since then. Worried though!! Anything I can use to solve the problem on a Mac?

If it's a Windows virus, it can't affect your Mac. However, it can be part of the problem by passing on any virus files.

I scan my MBP with ClamXav every now and again just to make sure I'm clear.

http://www.clamxav.com/

[Steve20]

This may be a stupid question, can you get a virus by using the internet on a mobile phone?

I was wondering this. Internet on my mobile hasn't worked since I tried log onto here from it.

[Martin]

I was wondering this. Internet on my mobile hasn't worked since I tried log onto here from it.

I'd be very suprised if it is connected - what type of phone you got?

[sleeping giant]

So how come some were not affected by this ?
I was not affected in any way.
No warnings from my AV or Firewall !

[blackpoolhibs]

Is anyone still having trouble? I cant use green style full width, and some avatars are missing. And if i click on a picture, all i get is a black page?

[--------]

Is anyone still having trouble? I cant use green style full width, and some avatars are missing. And if i click on a picture, all i get is a black page?



I had one wee glitch right after I came on this morning, and green full width's working OK for me.

Seems fine.




I do however keep getting this irritating pop-up called 'Jhack Rheghan', though.... :devil:

[Mon1875]

So how come some were not affected by this ?
I was not affected in any way.
No warnings from my AV or Firewall !


Bit worrying that Sleeping Giant! Maybe you are not protected from malware and just have anti virus.

Kaspersky Internet Security wouldn't let me log on to Hibs Net yesterday earlier on. Attempted again last night and logged on OK. Seems fine now and no problems.

[DaveF]

Bit worrying that Sleeping Giant! Maybe you are not protected from malware and just have anti virus.

Kaspersky Internet Security wouldn't let me log on to Hibs Net yesterday earlier on. Attempted again last night and logged on OK. Seems fine now and no problems.


Does it matter re what broswer you use? I'm on Opera and didn't see any issues.

I've got full AV, firewall etc.......

[The_Todd]

This has screwed my work PC royally! All sorts of "interesting" startup apps and icons have appeared along with some nasty registry entries. I can no longer run IE or Firefox, McAfee has been disabled, the Task Manager was disabled and I am unable to run any anti malware apps.

I have removed most of the infection manually by unregistering DLLs, deleting files created by the virus and tweaking my registry but some of the symptoms remain.

Luckily for me I'm an IT technician so I'll be fixing it myself but it's starting to look like I'll be reimaging my machine!

[Peevemor]

This has screwed my work PC royally! All sorts of "interesting" startup apps and icons have appeared along with some nasty registry entries. I can no longer run IE or Firefox, McAfee has been disabled, the Task Manager was disabled and I am unable to run any anti malware apps.

I have removed most of the infection manually by unregistering DLLs, deleting files created by the virus and tweaking my registry but some of the symptoms remain.

Luckily for me I'm an IT technician so I'll be fixing it myself but it's starting to look like I'll be reimaging my machine!

As I said elsewhere, I had to reboot in safe mode, do a system restore to Wednesday, and then battered it with all the anti virus/malware stuff I've got.

It seems to have worked.

[hibeemark]

Bit worrying that Sleeping Giant! Maybe you are not protected from malware and just have anti virus.

Kaspersky Internet Security wouldn't let me log on to Hibs Net yesterday earlier on. Attempted again last night and logged on OK. Seems fine now and no problems.

I hardly think it's worrying, to be honest. Your anti-virus is possibly just over-sensitive. There are hundreds of harmless processes that don't harm your computer, but because they operate in a similar fashion to malware, or they affect a certain area of your computer, less cultured ant-virus software like AVG, Avast, Kaspersky etc interprets it as being malicious. Even top of the range anti-virus software does sometimes.

This is evident when for example talking about 'cookies' which while having the potential to infringe upon your privacy, are in general actually a good thing. Or if you've ever downloaded keygen software to use with a computer game, you'll know that it makes anti-virus software go nuts, because of the way the program is designed to work.

You are far more likely to pick up malware manually, by opening .exe files you shouldn't, or by downloading some random toolbar you saw advertised, than by simply clicking on a webpage. If you're sensible about these things, there really is no need to panic.

[HFC 0-7]

This has screwed my work PC royally! All sorts of "interesting" startup apps and icons have appeared along with some nasty registry entries. I can no longer run IE or Firefox, McAfee has been disabled, the Task Manager was disabled and I am unable to run any anti malware apps.

I have removed most of the infection manually by unregistering DLLs, deleting files created by the virus and tweaking my registry but some of the symptoms remain.

Luckily for me I'm an IT technician so I'll be fixing it myself but it's starting to look like I'll be reimaging my machine!

I am getting the same sort of things, although I managed to get IE back up and running. My Anti virus is now not working at all, and when I try to connect to anti virus sites like the Microsoft one on this thread I get page not found. Any ideas?

[hibbie02]

As am I, and I've had nothing, and I've ran a scan which shows nothing.

Macafee is a total waste of money!!!! This is the second time in 3 years I have has something like this and Macafee hasn't even noticed!!! Some Firewall! :grr:

[The_Todd]

The malware appears to be a rootkit. Nasty little bugger too.

Reimage looks like the most likely resolution.

[hibeemark]

I am getting the same sort of things, although I managed to get IE back up and running. My Anti virus is now not working at all, and when I try to connect to anti virus sites like the Microsoft one on this thread I get page not found. Any ideas?

Have you tried these:

[/URL]http://www.comodo.com/ (http://www.comodo.com/)

[URL]http://www.ccleaner.com/ (http://www.ccleaner.com/)

[Keith_M]

I'd like to give a recommendation to everyone using Windows.

I work in IT for a living and most of the people I speak to use ClamWin (www.clamwin.com/)as their anti virus software. It's totally free and there are also regular free updates of the virus database, which is really important.

I've got a mixture of machines, Linux and Windows, and I've been using this on my Windows PC for two years. I'd definitely recommend it.

An alternative is AVG Free, of which there are also commercial versions. This gets really good ratings on CNet. You can download it here (http://free.avg.com/gb-en/download-avg-anti-virus-free).

[HFC 0-7]

Have you tried these:

http://www.comodo.com/ (http://www.comodo.com/)

http://www.ccleaner.com/ (http://www.ccleaner.com/)

Tried comodo, when I get to the page with the button download on it, I press it and it comes up with a page not found screen. I have tried this on various other sites. I also had an old free version of a basic anti virus tool on disk. I installed it, but when I tried to update the library it said check internet connection. Basically just about every anti virus I try to download, the web page cannot be found when I click to download it.

[Jay]

Why does nobody use microsofts security essentials? It seems to have done well by me here yesterday and is free too.

[Martin]

Why does nobody use microsofts security essentials? It seems to have done well by me here yesterday and is free too.

Best around at the moment :agree:

[NOLA]

Why does nobody use microsofts security essentials? It seems to have done well by me here yesterday and is free too.

I use MSE as well as Norton internet security + haven't had any problems logging on so far:agree:

[The_Todd]

I'm now sorted. I used a combination of manual removal, Malwarebytes, Spybot, Sophos Anti-rootkit and McAfee. The infection was deep and resistant to removal.

[Golden Bear]

I'm now sorted. I used a combination of manual removal, Malwarebytes, Spybot, Sophos Anti-rootkit and McAfee. The infection was deep and resistant to removal.

You obviously know ye're way round a computer!

Luckily my Norton software picked it up right away or I'd be goosed. Java re-installed itself straight away and everything seems to be ok thankfully.

[HFC 0-7]

You obviously know ye're way round a computer!

Luckily my Norton software picked it up right away or I'd be goosed. At the same time Java re-installed itself straight away and everything seems to be ok thankfully.

Dont want to bring bad news but Java installing happened to me and later I found out the PC was infected and i am having a lot of bother with it now.

[Golden Bear]

Dont want to bring bad news but Java installing happened to me and later I found out the PC was infected and i am having a lot of bother with it now.

Not so far - fingers crossed!

I've ran a full system scan and things look ok.

[Calvin]

An alternative is AVG Free, of which there are also commercial versions. This gets really good ratings on CNet. You can download it here (http://free.avg.com/gb-en/download-avg-anti-virus-free).
Was on a course today and after it I would NEVER use AVG. Shocking piece of software.

Definitely worth spending something on Kaspersky if you are into computers or Norton if you're not.

[Jim44]

Was on a course today and after it I would NEVER use AVG. Shocking piece of software.

Definitely worth spending something on Kaspersky if you are into computers or Norton if you're not.

Surely a bit OTT in your condemnation. I've used it for years and it has never let me down. I also get the impression that it does the trick for thousands of others. By contrast I keep reading that Norton is mince, yet you seem to recommend it, albeit for computer laymen. One man's meat and all that. :dunno:

[Calvin]

Surely a bit OTT in your condemnation. I've used it for years and it has never let me down. I also get the impression that it does the trick for thousands of others. By contrast I keep reading that Norton is mince, yet you seem to recommend it, albeit for computer laymen. One man's meat and all that. :dunno:

Well other anti-virus makers are starting to write AVG removers into their software. Norton was always dodgy. Very lazily, they just put bolt-ons onto their previous products but 360 v3 is a very good internet suite and anti-virus programme for those that want no-hassle protection.

[Golden Bear]

Well other anti-virus makers are starting to write AVG removers into their software. Norton was always dodgy. Very lazily, they just put bolt-ons onto their previous products but 360 v3 is a very good internet suite and anti-virus programme for those that want no-hassle protection.

:agree:

It's well worth the money imo.

[Speedy]

I had Norton 360 for a year but got rid of it when it ran out.

I've got Avast, MalwareBytes and MSE now. I'm considering getting Norton 360 back though because I never had any problems with it.

[paullotion]

I am getting the same sort of things, although I managed to get IE back up and running. My Anti virus is now not working at all, and when I try to connect to anti virus sites like the Microsoft one on this thread I get page not found. Any ideas?

Could be your host file has been hijacked or a system file such as atapi.sys has been patched. Can you check to see if your host file is hijacked, your host file is located at:

C:\Windows\system32\drivers\ect

Then right click on your host file and choose to open with notepad.

Also upload the atapi.sys file to virustotal for a check. atapi.sys is located in C:\WINDOWS\system32\drivers

Upload the file to here.

http://www.virustotal.com/

Once finished let me know the results.

[greenlex]

Could be your host file has been hijacked or a system file such as atapi.sys has been patched. Can you check to see if your host file is hijacked, your host file is located at:

C:\Windows\system32\drivers\ect

Then right click on your host file and choose to open with notepad.

Also upload the atapi.sys file to virustotal for a check. atapi.sys is located in C:\WINDOWS\system32\drivers

Upload the file to here.

http://www.virustotal.com/ (http://www.virustotal.com/)

Once finished let me know the results.
I think your pc has been infected by the Parrot virus. :greengrin

[paullotion]

I think your pc has been infected by the Parrot virus.

And there was me thinking "Parrot virus" http://img189.exs.cx/img189/206/confused2hw.gif, a quick google search and we get this


Parrot virus: (1) obsolete term for Chlamydia psittaci; (2) SYN: Pacheco parrot disease virus.

[marleyhib]

Hate to say it but buy a Mac and if you have to use a PC do not use Internet Explorer under any circumstances.

Yeh I'm a Mac, I'm a PC, your a ****, I know I'm a juan kerr but seriously worth buying a Mac, and no I don't work for Apple.

[thebakerboy]

Concerned that virus is still around , noticed an icon I used earlier today is no longer there (green grin). I use tlaktalk's own security and it sorted problem and at £2 a month is not over priced as it seems to do what it says on the tin.

[sleeping giant]

Bit worrying that Sleeping Giant! Maybe you are not protected from malware and just have anti virus.

Kaspersky Internet Security wouldn't let me log on to Hibs Net yesterday earlier on. Attempted again last night and logged on OK. Seems fine now and no problems.

I have an AV and comodo firewall , windows defender and Malwarebytes.
Scanned again today to find nowt on my machine !

[O'Rourke3]

Been using Safari for about 18 months after a similar infection. Took 2 days to track down and remove all the malware, however IE still insisted on pointing me at phantom sites so went for a different browser. That plus Norton 360 seems to have kepts things going - teaching the kids to scan imported files first also helped.

[Viva_Palmeiras]

Sorry for my ignorance but...

For internet security why is it that ISPs sell solutions that are incomplete?

Really ****ed off as I moved from AVG to Mcafee with BT and (long story).
BT set me up remotely with Mcafee and used internet explorer (I NEVER use it) and I believe this could have been a possible route to infection.

I'm in the IT industry so its not like I'm typical Joe public, if I'm ignorant (in management so just expect things to work :greengrin), how do ISPs expect Joe Public to be any the wiser?

I'd imagine a significant number of people with mcafee will be blissfully unaware of the weakness without anti-malware.

I effing hate microsoft! Security my eye.

[Lofarl]

Firefox plus noscript addon could stop a nuclear attack :)

[jdships]

Sorry for my ignorance but...

For internet security why is it that ISPs sell solutions that are incomplete?

Really ****ed off as I moved from AVG to Mcafee with BT and (long story).
BT set me up remotely with Mcafee and used internet explorer (I NEVER use it) and I believe this could have been a possible route to infection.

I'm in the IT industry so its not like I'm typical Joe public, if I'm ignorant (in management so just expect things to work :greengrin), how do ISPs expect Joe Public to be any the wiser?

I'd imagine a significant number of people with mcafee will be blissfully unaware of the weakness without anti-malware.

I effing hate microsoft! Security my eye.



You can see from my age I am a "silver surfer" but agree with your notes.:greengrin

On my PC , I moved, on advise from my "computer man" , from Norton to AVG and from I E to Mozilla Firefox , - now no problems at all.
Bought a lap top which was operating "Vista" and "Macafee"
After many annoying "happenings" have changed that to AVG / MF - again no problems !!

You give good advice IMO
:thumbsup: