Jump to content
SAU Community

Recommended Posts

its the reverse placebo effect.

there used to be the problem on the board, hence this topic, but its since been fixed. however some people dont realise its been fixed, and hence are thinking its somehow still happening :(

God I hope so... I've had enough of working on SAU to last me another 6 months, and I'm still not finished. :D

Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/2/#findComment-2302766
Share on other sites

  • Replies 95
  • Created
  • Last Reply

Top Posters In This Topic

Fingers xed... I saw the boards down today at work, logged on later in the day no problems.

Just logged on at home (11.28pm, 3/7) and I had the exploit blocked (I'm hoping from a locally cached version of the page, but I haven't logged on from here for a week?)

Anyway, I know you'll still be monitoring it - just thought I'd let you know.

Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/2/#findComment-2302820
Share on other sites

it will be a patching problem not entirley on the IVB side. Wait for dicrosoft to patch it properly Ie wise and Ivb to run out the kink's i bet over a few weeks . IVB the will be still very worried about it and a few features will no doubt be not functioning for saftey ! .

Microsoft let out a Doossie with one of there upgrades that found pirate copies of Xp . since then alot of people are unpatched and there are lots of conflicts.

Edited by ishh
Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/2/#findComment-2302830
Share on other sites

No, haven't received it before... Was only reading about the Billion boards being affected by it this morning, didn't even blink as to why the SAU boards were down (stocktake was a b!tch.)

Silly me didn't check the timestamp in the temp file before it was removed... I've reloaded the page & IE many a time anyway - hasn't reappeared.

Who knows, peculiarity of Apache or one of the various proxies I'm running through I guess...

(Edit: Ugh... bloody thing is still running, back soon.)

Edited by cooks44
Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/2/#findComment-2302902
Share on other sites

Got it today at work after the site had been down... and just got it now at home. Each time my McAfee seems to have caught it, although there is a HEAP of HDD activity for quite some time and the computer slows down... (and no, I wasn't running a virus scan)

So something still creepy in there guys,

M

Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/2/#findComment-2302952
Share on other sites

The reason this security alert comes up is because of an exploit used on IE.

This utility released by Norton (antivirus software developers) can be used to disable windows scripting... if at any time you find that you need windows scripting enabled (if one of your apps won't work) you can use the same utility to re-enable it.

http://www.symantec.com/avcenter/noscript.exe

Its recommended that you turn off scripting so that no malicious websites or people can force your browser to download and run trojans/worms.

Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/2/#findComment-2302981
Share on other sites

this is more an exploit being found By your Av than Trojans loading off the SAU Page slowing down your systems hard disk.

It doesn’t mean that a Trojan is loading ... It means it has vulnerable scripting and it is possible.. < this is the message to get out !

I highly doubt that anyone got infected as it was just a generic warning from the AV reading the scripting.

Prank i would try to word a statement that states it is the vulnerability that has been found, Detected by AV not a virus or Trojan.

I am Guessing a bit there because i don’t know if anyone got infected but that’s my guess in the confusion !

For someone to achieve this they would need access to private FTp to embedded the server or an identical mirror linked with the embedded server.

Most members would have this Short cutted so the mirror would not work either.

If by the slightest chance it was mirrored then its going to jag non members surfing from an engine.

Tell the whingers that it is there old Av update that is detecting the Script.

and to please be patient.

if you can Categorically state that nothing dloaded from the page and infected anyone then this will help out a lot with the complaints you may get....

Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/2/#findComment-2303336
Share on other sites

GET FIREFOX or OPERA instead of the IE browser.... ITS not the SAU board, its because the SAU board is Invision and Ie has a big hole in it ... the same will happen on any Invision Board using an Ie browser until Microsoft do something .

Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/2/#findComment-2303398
Share on other sites

Hi guys,

Just in case it helps, the offending file that McAfee pointed at was called 0day.htm

This file goes to http://196.regvista.com/0day.htm

Maybe this would help to sniff it out?

Immediately after McAfee finds it and cleans it, McAfee is disabled! And there is a c$#@load of hard drive activity for several minutes..

Cheers,

Matt.

Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/2/#findComment-2303417
Share on other sites

yeah i got the trojan downloaded to my home machine over the weekend. i removed all the crud using adaware but my pc is now a bit fuxored unfortunately. AVG is broken so i've tried uninstalling it and installing norton but cant get through the install without it dying. :D

anyone got any advice? :P

Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/2/#findComment-2303473
Share on other sites

I thought it had gone, but alas, I just got another warning from my a/v (Avast pro).

Seems to identify it as WIN32 Trojano ...

My a/v catches it and terminates connection before there's any consequence.

This only happened for the first time on Friday I think.

Has never happened before, so I cant imagine, as previously mentioned by someone, that it's Invision, unless SAU has just changed their system over.

Also, had no old cache, i clean it almost daily, and IE is set to load new page everytime (no caching).

Anyways, not a big deal on my end, but perhaps might be helpful to track down the issue.

Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/2/#findComment-2303490
Share on other sites

i am looking at all the manual ways now....

... For a try install norton in Safe mode ... Or systems restoring before hand and repeating...

Looking into this more now I see its a fairly old exploit reworked . So until more info unfolds its a bit hard.

F8 key hold down on reboot until you get Safe mode ... then run the the install. Its tricky because you have to some how get the Av to update in safe mode

My AV rips it straight out !!! Pm me if you would like to try it .

Munkyb0y Av only finds it once its been reported. the exploits can function and go on for months before this!

Edited by ishh
Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/2/#findComment-2303497
Share on other sites

GET FIREFOX or OPERA instead of the IE browser.... ITS not the SAU board, its because the SAU board is Invision and Ie has a big hole in it ... the same will happen on any Invision Board using an Ie browser until Microsoft do something .

This is not an option for me

cheers.

Hi guys,

Just in case it helps, the offending file that McAfee pointed at was called 0day.htm

This file goes to http://196.regvista.com/0day.htm

Maybe this would help to sniff it out?

I just got the identical thing.

I've been browsing SAU for 4 hours now (from the uber protected work PC). And the Norton box just fired up @ 10:44 with the same above ^^^

I've flushed ALL the temp files etc etc etc.

And ive just done it again.

Will report back if it get it again

Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/2/#findComment-2303506
Share on other sites

Hello again.. this is a test

I am using ie 6 NO AV and nothing is connecting , Downloading or Executing .

As i mentioned before to Munky these exploits are oftern not reported for months so everyone is oblivious until there is an Alert.. Then poo fly fanward forth!

this ie exploit can be used so braodly so i still think the Sau board is fine now upgraded and more the users buggy infected Pc's ,its just that this situation Alerted alot of people that they had a problem....

For all the people with Disabled AV Try this link to actualy see what state your PC is in. Not sure if the demo will clean it! My guess is it will :D

http://www.trendmicro.com/hc_intro/default.asp

Ie is Every uni students wet dream to practice code on .... Its also the most cloaked process giving people the impression that its fine because its always running . DANGEROUS

I am still working on the manual removal... It would be good to look at the old unpatched pages ???

Bac soon ish!

Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/2/#findComment-2303636
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now



  • Latest Posts

    • What does it look like with highway driving? And yes, I had a similar thought as Duncan. It looks quite similar in my Stagea and I have made myself accept it as normal. Might have to look into it some day  
    • While I was waiting for the new parts to come in for the charge pipe and radiator I decided to do some turbo modification. The drive pressure (exhaust backpressure) was a lot higher that I thought it should be. For 32lbs of boost drive was 55lbs. The turbine housing is a 1.10AR and my turbo builder has suggested to go to a 1.25AR. To test if a larger AR would do anything to reduce drive pressure AND not spend any money I decided to hog out the divider in my current housing. I removed it from the inlet and the whole way through the housing.  After reassembly and testing it doesn't look like this modification did anything for reducing drive pressure or requiring more fuel (making more power). Oh well, it was worth a shot. We'll get some data at the track if it makes it past the 60ft. I also machined a $7 shift knob off Amazon to fit my Stillway shifter since I didn't like the Stillway shift knob. Next on the list was the radiator replacement and fabrication of a new intercooler tube that had no silicon coupler. No pictures of this - I was short on time each night after work to get this done and didn't stop to take pictures.  Next was to get the clutch disks out and replaced. Previously when installing the dogbox I had ordered a set of the same sintered iron disks I had been running because I switched to the 26-spline input shaft. I thought it was odd that they didn't have any markings or brand name on them like all my old disks had but installed them anyway. At the track I could not get the clutch to lock up using my normal strategies. After two track nights I reached out to the clutch manufacturer and ask their thoughts. They said they had to switch the material out because they were having trouble getting the original material and that this new material would not take to being slipped very well.  So out with the first set of 26-spline disks and in with the correct material 26-spline disks. While I had the trans out I added an inspection/service hole. I've wanted one of these for a while. Now I can have a look at things and change the front cover shimming when needed (clutch wear). I hustled and got the clutch change done in a few hours on a Saturday. Hopped in the car and drove home. On the way home I did a 1-3 pull. When shifting from 2nd to 3rd the core plug in the back of the cylinder head popped out and dumped all the coolant. Thankfully I was only 30 seconds from home and coasted it there. Datalog showed nothing unusual and 2.5psi of coolant pressure. That plug has been in there since 1992 but I guess it worked its way out. Pulled the trans AGAIN and replaced the plug, JB welded it in, and made a brace. Also deleted the head drain I had added in during the bearing issue fiasco.  I am currently changing my boost control plumbing to make it cleaner. After that is done I'll make another attempt at getting past the 60.
    • Are you 100% sure this isn't tune related?
    • 140-150 across the board. At this point hoping the grounding harness fixes it. My grounds are all tied to the chassis and none to the battery. For SR and KA that’s never been a problem for me but had a few other guys here and Reddit who told me RB really like a very solid ground setup tied to the battery so going to try that next, I’m stumped if that doesn’t do it. Never had a car have spark and fuel and not fire off before. Only thing I can think is the spark is intermittent/weak because of grounds nothing else really makes sense at this point 
    • I am having close to the same issue. Can you help me with what wire you grounded to get your pump to trigger?
×
×
  • Create New...