Jump to content
SAU Community

Trojans?

Driver
 Share

Recommended Posts

ookami Experienced

ookami

Posted
Posted
I thought it had gone, but alas, I just got another warning from my a/v (Avast pro).

Seems to identify it as WIN32 Trojano ...

My a/v catches it and terminates connection before there's any consequence.

This only happened for the first time on Friday I think.

Has never happened before, so I cant imagine, as previously mentioned by someone, that it's Invision, unless SAU has just changed their system over.

Also, had no old cache, i clean it almost daily, and IE is set to load new page everytime (no caching).

Anyways, not a big deal on my end, but perhaps might be helpful to track down the issue.

We use Avast on our server (Avast Server Edition) at work and yeah just about every trojan they find it labels it as a win32:trojano.

GET FIREFOX or OPERA instead of the IE browser.... ITS not the SAU board, its because the SAU board is Invision and Ie has a big hole in it ... the same will happen on any Invision Board using an Ie browser until Microsoft do something .

I have to stick with IE for compatability reasons and yes it appears to be SAU as other Invision Boards I've been to today, aren't affecting any of my virus scanners. The trojan doesn't appear as often as it was late last week, as I've only seen it twice in the 20 odd times I've either refreshed or been to the board today.

Link to comment
Share on other sites
  • Replies 95
  • Created
  • Last Reply

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

ish Proficient

ish

Posted
Posted (edited)

ok .. i have found a way to trigger it on cue to dload with IE

Its intermitant depending on how you navigate your Ie browser

I think this is better closed up again (forum) because Patching is not sufficent yet until its understood how it loads and got into the code. people that dont understand things will get all nasty again.

So better closing the hole again so they cant blame...

I am no mod or admin here so i can only reco what i would do gang.

later

back in a few hours ish!

Edited by ishh
Link to comment
Share on other sites
Beer Baron Grand Master

Beer Baron

Posted
Posted
i am looking at all the manual ways now....

... For a try install norton in Safe mode ... Or systems restoring before hand and repeating...

Looking into this more now I see its a fairly old exploit reworked . So until more info unfolds its a bit hard.

F8 key hold down on reboot until you get Safe mode ... then run the the install. Its tricky because you have to some how get the Av to update in safe mode

My AV rips it straight out !!! Pm me if you would like to try it .

Munkyb0y Av only finds it once its been reported. the exploits can function and go on for months before this!

thanks mate, i will try this stuff tonight when i get home. i'm a bit noob with security, viruses etc. :nyaanyaa:

Link to comment
Share on other sites
ish Proficient

ish

Posted
Posted

Whoa ...Well Done Prank!!!... its gone :nyaanyaa: i cant even get it to trigger now ...

For those that did get infected and AV crashed, try that link i splashed before. It did clean it surprisingly for free!

Link to comment
Share on other sites
ookami Experienced

ookami

Posted
Posted
Whoa ...Well Done Prank!!!... its gone :) i cant even get it to trigger now ...

For those that did get infected and AV crashed, try that link i splashed before. It did clean it surprisingly for free!

If your anti virus couldn't get rid of it and the trojan got round it, you need to either 1)update your virus scanner a damn lot more or 2)get a decent virus scanner. If some free net thing can get rid of it and a PC based one can't you've got security problems :blink:

Link to comment
Share on other sites
CruiseLiner Mentor

CruiseLiner

Posted
Posted

hey guys mines still going through that 169vista site or whatever when i bring up sau homepage. and saying trojan infected yada yada

how exactly do i make sure ive deleted all the old internet files/cache and whatever else needs to be done to get rid of it for good?????

its giving me the shits at the moment

Link to comment
Share on other sites
sewid Grand Master

sewid

Posted
Posted

I thought it was gone but again i'm getting these trojan alerts in IE.

As to the person who suggested switch to another browser, I cannot install another browser on some of the PC's here due to the corporate policy.

Link to comment
Share on other sites
ish Proficient

ish

Posted
Posted

Re occur! this is what i was worried about ...

Prank. i mentioned in your PM my bigger fears of how this may be happening.

Until you find whats loading it or re Writting, it will keep coming bac unfortunatly.

Dam i would luv to be a NEt admin at the moment ... i would Argue the Mozilla and be a hero in the work place by doing nothing !

Link to comment
Share on other sites
ish Proficient

ish

Posted
Posted (edited)

no it's not R31Nismoid.... I am sitting here triggering it again like I showed Prank ...

triggered virus several times just then over the last few min's to see .

detected: Trojan program Trojan-Downloader.HTML.Agent.ao Script: http://www.skylinesaustralia.com/forums/in...=124658&hl=[2]

detected: Trojan program Trojan-Downloader.HTML.Agent.ao Script: http://www.skylinesaustralia.com/forums/in...=124503&hl=[2]

detected: Trojan program Trojan-Downloader.HTML.Agent.ao Script: http://www.skylinesaustralia.com/forums/in...s&lastdate=[2]

detected: Trojan program Trojan-Downloader.HTML.Agent.ao Script: http://www.skylinesaustralia.com/forums/in...194entry2306194[2]

detected: Trojan program Trojan-Downloader.HTML.Agent.ao Script: http://www.skylinesaustralia.com/forums/in...24535&st=40[2]

detected: Trojan program Trojan-Downloader.HTML.Agent.ao Script: http://www.skylinesaustralia.com/forums/in...=124803&hl=[2]

It re writes the code which is why i think what i think in Pranks PM. i am not going to Blurt it out here !

Edited by ishh
Link to comment
Share on other sites
R32 TT Mentor

R32 TT

Posted
Posted
no it's not R31Nismoid.... I am sitting here triggering it again like I showed Prank ...

triggered virus several times just then over the last few min's to see .

Yup, I afraid its still in there guys. Got it just now as I clicked to read this thread...

Link to comment
Share on other sites
R31Nismoid Grand Master

R31Nismoid

Posted
Posted
no it's not R31Nismoid.... I am sitting here triggering it again like I showed Prank ...

Thats nice...

Still doesnt detract from the fact that it is fine for me, which... is what i initially said.

Doesnt mean its right for other people, i never said it was right for anyone else.

Im just giving more feedback on what ive already said

Link to comment
Share on other sites
Nismo_Boy Grand Master

Nismo_Boy

Posted
Posted

Still had a major issue after you guys said it was removed, crashed my computer even after a complete cache refresh, spy wear check and removal as well as a full virus scan.

Virus would not allow to transfer documents, wouldn’t allow to run any programs in hope of finding the problem and removing it again.. Kept getting access denied, you do not have permission when trying to open Anti virus program, spy wear remover ect.

We ended up having to do a full system recover, which has seemed to fix it now. What ever happened, was worse the seconded time around.. An came from this site at some point.

Jus thought I would let you guys know.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing


  • Latest Posts

    • Dose Pipe Sutututu
      Misfire/stalling issues

      By Dose Pipe Sutututu · Posted

      The stock one will outperform any aftermarket standard position exhaust manifold. If you don't believe me, do a back to back test (same turbo, same boost, same timing) and you'll be super surprised.
    • Chris_Guthrie
      Misfire/stalling issues

      By Chris_Guthrie · Posted

      Any recommendations on a decent replacement manifold that doesnt break the bank or require additional mods for the stock turbo setup? I figure if I'm going to pull the manifold off anyway to fix the studs might as well replace it. 
    • Chris_Guthrie
      Misfire/stalling issues

      By Chris_Guthrie · Posted

      So I checked the turbo out today. Very minimum play at all just enough for the oil to take up when it's running. I did find an exhaust leak at the manifold. 1 stud all the way in the front is missing and the one all the way in the back is broken off. Front has visible signs of an exhaust leak. I'll fix that soon but that's not my problem still.  I also found that the nipple coming off the turbo had the hose capped off and a hose ran from the j-pipe by the bov going to the wastegate. I removed that hose and capped that nipple and put the turbo nipple hose back on the wastegate.  There was a ton of oil residue all through the charge side of the intercooler piping going to the throttle bodg. I'm thinking that's from the pcv. Doesn't seem to be coming from the turbo that was all clean on the pipes side.  Haven't had a chance to check fuel pressure yet, haven't had time been having to pull a lot of doubles at work. I did pick up some carb cleaner to clean the iacv but wanted to make sure I had a fresh gasket in case the old one rips when I pull it off.  I'm waiting on a MAF that was supposed to be here today but delayed to Monday. Have a double Monday and Friday and work all of next weekend so going to try to find some time in the middle of the week to try that out. Did about a 10m trip around the block today and towards the end the issues were coming back. Fingers crossed on this MAF but if not just going to throw a fuel pressure gauge in and see where I'm at.  Did notice today that I can definitely hear the injectors pulsing. Very audible clicking coming from them. Assuming that's normal? Should also mean CAS is functioning somewhat properly. After it warmed up when I started it the intermittent misfires came in again. Did start doing that before it was fully warmed up. 
    • klutched
      GOT SUM's RB34

      By klutched · Posted

      This morning I carefully reinstalled the manifold and started looking at a couple of things I need to do.  Heat wrap arrived sometime today so I popped into the shed with the missus dishwashing gloves and started wrapping the first half of the dump and the screamer/plumb back.  Once I do the second half I'll be able to final fit the turbo and exhaust up.  Also pulled the harness out today and started terminating it at the ECU end. A connector is done, just need to run the remaining wires that arent in the harness - 12v, gnd and couple I/O
    • Dose Pipe Sutututu
      Rear suspension upgrades

      By Dose Pipe Sutututu · Posted

      A31 is pretty much the same thing without HiAIDS I mean CAS, no improvement lol. Not to late to send it.
×
×
  • Create New...