Jump to content
SAU Community

Trojans?

Driver
 Share

Recommended Posts

ookami Experienced

ookami

Posted
Posted
I thought it had gone, but alas, I just got another warning from my a/v (Avast pro).

Seems to identify it as WIN32 Trojano ...

My a/v catches it and terminates connection before there's any consequence.

This only happened for the first time on Friday I think.

Has never happened before, so I cant imagine, as previously mentioned by someone, that it's Invision, unless SAU has just changed their system over.

Also, had no old cache, i clean it almost daily, and IE is set to load new page everytime (no caching).

Anyways, not a big deal on my end, but perhaps might be helpful to track down the issue.

We use Avast on our server (Avast Server Edition) at work and yeah just about every trojan they find it labels it as a win32:trojano.

GET FIREFOX or OPERA instead of the IE browser.... ITS not the SAU board, its because the SAU board is Invision and Ie has a big hole in it ... the same will happen on any Invision Board using an Ie browser until Microsoft do something .

I have to stick with IE for compatability reasons and yes it appears to be SAU as other Invision Boards I've been to today, aren't affecting any of my virus scanners. The trojan doesn't appear as often as it was late last week, as I've only seen it twice in the 20 odd times I've either refreshed or been to the board today.

Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/3/#findComment-2303704
Share on other sites
  • Replies 95
  • Created
  • Last Reply

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

ish Proficient

ish

Posted
Posted (edited)

ok .. i have found a way to trigger it on cue to dload with IE

Its intermitant depending on how you navigate your Ie browser

I think this is better closed up again (forum) because Patching is not sufficent yet until its understood how it loads and got into the code. people that dont understand things will get all nasty again.

So better closing the hole again so they cant blame...

I am no mod or admin here so i can only reco what i would do gang.

later

back in a few hours ish!

Edited by ishh
Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/3/#findComment-2303914
Share on other sites
Beer Baron Grand Master

Beer Baron

Posted
Posted
i am looking at all the manual ways now....

... For a try install norton in Safe mode ... Or systems restoring before hand and repeating...

Looking into this more now I see its a fairly old exploit reworked . So until more info unfolds its a bit hard.

F8 key hold down on reboot until you get Safe mode ... then run the the install. Its tricky because you have to some how get the Av to update in safe mode

My AV rips it straight out !!! Pm me if you would like to try it .

Munkyb0y Av only finds it once its been reported. the exploits can function and go on for months before this!

thanks mate, i will try this stuff tonight when i get home. i'm a bit noob with security, viruses etc. :nyaanyaa:

Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/3/#findComment-2303989
Share on other sites
ookami Experienced

ookami

Posted
Posted
Whoa ...Well Done Prank!!!... its gone :) i cant even get it to trigger now ...

For those that did get infected and AV crashed, try that link i splashed before. It did clean it surprisingly for free!

If your anti virus couldn't get rid of it and the trojan got round it, you need to either 1)update your virus scanner a damn lot more or 2)get a decent virus scanner. If some free net thing can get rid of it and a PC based one can't you've got security problems :blink:

Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/3/#findComment-2304371
Share on other sites
CruiseLiner Mentor

CruiseLiner

Posted
Posted

hey guys mines still going through that 169vista site or whatever when i bring up sau homepage. and saying trojan infected yada yada

how exactly do i make sure ive deleted all the old internet files/cache and whatever else needs to be done to get rid of it for good?????

its giving me the shits at the moment

Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/3/#findComment-2306121
Share on other sites
ish Proficient

ish

Posted
Posted

Re occur! this is what i was worried about ...

Prank. i mentioned in your PM my bigger fears of how this may be happening.

Until you find whats loading it or re Writting, it will keep coming bac unfortunatly.

Dam i would luv to be a NEt admin at the moment ... i would Argue the Mozilla and be a hero in the work place by doing nothing !

Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/3/#findComment-2306194
Share on other sites
ish Proficient

ish

Posted
Posted (edited)

no it's not R31Nismoid.... I am sitting here triggering it again like I showed Prank ...

triggered virus several times just then over the last few min's to see .

detected: Trojan program Trojan-Downloader.HTML.Agent.ao Script: http://www.skylinesaustralia.com/forums/in...=124658&hl=[2]

detected: Trojan program Trojan-Downloader.HTML.Agent.ao Script: http://www.skylinesaustralia.com/forums/in...=124503&hl=[2]

detected: Trojan program Trojan-Downloader.HTML.Agent.ao Script: http://www.skylinesaustralia.com/forums/in...s&lastdate=[2]

detected: Trojan program Trojan-Downloader.HTML.Agent.ao Script: http://www.skylinesaustralia.com/forums/in...194entry2306194[2]

detected: Trojan program Trojan-Downloader.HTML.Agent.ao Script: http://www.skylinesaustralia.com/forums/in...24535&st=40[2]

detected: Trojan program Trojan-Downloader.HTML.Agent.ao Script: http://www.skylinesaustralia.com/forums/in...=124803&hl=[2]

It re writes the code which is why i think what i think in Pranks PM. i am not going to Blurt it out here !

Edited by ishh
Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/3/#findComment-2306215
Share on other sites
R32 TT Mentor

R32 TT

Posted
Posted
no it's not R31Nismoid.... I am sitting here triggering it again like I showed Prank ...

triggered virus several times just then over the last few min's to see .

Yup, I afraid its still in there guys. Got it just now as I clicked to read this thread...

Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/3/#findComment-2306262
Share on other sites
R31Nismoid Grand Master

R31Nismoid

Posted
Posted
no it's not R31Nismoid.... I am sitting here triggering it again like I showed Prank ...

Thats nice...

Still doesnt detract from the fact that it is fine for me, which... is what i initially said.

Doesnt mean its right for other people, i never said it was right for anyone else.

Im just giving more feedback on what ive already said

Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/3/#findComment-2306273
Share on other sites
raz0r$harP.UK Grand Master

raz0r$harP.UK

Posted
Posted

Comes about 50% of the time. I can see IE trying to access something from http://196.regvista.com through the IFRAME and so I just hit stop and reload. Usually on the second or third attempt the page loads without the trojan.

Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/3/#findComment-2306451
Share on other sites
Nismo_Boy Grand Master

Nismo_Boy

Posted
Posted

Still had a major issue after you guys said it was removed, crashed my computer even after a complete cache refresh, spy wear check and removal as well as a full virus scan.

Virus would not allow to transfer documents, wouldn’t allow to run any programs in hope of finding the problem and removing it again.. Kept getting access denied, you do not have permission when trying to open Anti virus program, spy wear remover ect.

We ended up having to do a full system recover, which has seemed to fix it now. What ever happened, was worse the seconded time around.. An came from this site at some point.

Jus thought I would let you guys know.

Link to comment
https://www.sau.com.au/forums/topic/124535-trojans/page/3/#findComment-2306608
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing


  • Latest Posts

    • Haggerty
      RB25DE NEO with Haltech ECU

      By Haggerty · Posted

      I seem to the be only person that is using a Haltech 2500 on an NA motor, I've installed a Bosch DBW throttle body to the OEM intake manifold and am having problems maintaining AFR even with the wideband o2.  It will run extremely rich at idle and up to redline, but under load it will go extremely lean in the 20s and i'm essentially having to rev it over 4k and feather the clutch to get it up to speed.  I've read a few other threads of about the butterfly, it seems removing the vacuum to it is supposed to have it remain open, i've noticed no difference under 4k with the vacuum line to it plugged.  I'm hoping someone here has had luck using the NA manifold with Haltech, and if they happen to have a tune for it.  
    • sonicii
      Could it really happen......

      By sonicii · Posted

      I don't know any details, but I really wouldn't be surprised if they do it as a LHD only version, at least initially.
    • Gareth87
      What should I do next to hold the head on

      By Gareth87 · Posted

      Thanks for the replies everyone. Definitely a coolant push. Oil catch can is empty and always has been. As the engine is out now I'll be having a good look over things. I do have some detonation on the piston tops from a trigger issue back about 5 years ago. I felt it and shut off then bought a new ecu and changed the trigger. Never been an issue since. It never hurt the power, its made almost 80hp more since that incident but I will pull the bearing caps to take a look. If the bearings are damaged I will do a bottom end refresh. Head is being re conditioned at the moment and the block will be cleaned and checked to ensure it's flat. I'll go with a kameari gasket and see how it ends up. The other thing I'm not super keen on is the cylinder colours. I suspect this is from the inlet manifold. The plan will be to put it back together, retune and then stick a plazmaman billet inlet on it and retune. I'm happy with the power, if it makes a little more, then great, but I would rather just make everything more efficient at this stage.
    • MBS206
      Could it really happen......

      By MBS206 · Posted

      Maybe they'll look to do a bunch of presales to help inject some cash fast for their financial issues...
    • MBS206
      R34 25GT Engine Light 21

      By MBS206 · Posted

      Does it also misfire equally when revving?   Josh is very correct in what you should do. The coilpack harness wiring loom itself is a known problem due to its age and the number of heat cycles it has gone through. Throwing parts at a vehicle to diagnose the issue isn't a smart or good way to do it. Secondly, you may have a bad coil pack, you pop replacements in, they fix that issue, but messing with the harness breaks it, so the issue persists. So now you think "well it wasn't the coil packs" and have to continue chasing your tail, potentially swapping back in your shit coil packs and returning the good ones (yes, I've seen people do this because 'it wasn't the problem' and they want to save money). And suddenly, you've got two issues with the same symptoms...   Diagnose, don't use the spare parts shotgun.
×
×
  • Create New...