Trojan

[SilverECR33]

Hi admins,

You have a trojan in ur counter on the main page, Technical Details below.

Time Module Object Name Threat Action User Information

2/25/2007 11:15:55 AM IMON file http://bafumba.com/counter/dsb/dsb.exe a variant of Win32/TrojanDownloader.Tiny.NCA trojan

cheers,

Dale Holmes

Network Engineer.

[SilverECR33]

Oh yea, if you need anymore info, It was detected By NOD32. if you have anything else you may not have detected it. If you need more info, Pm me and i can send you a copy of the Log file.

Thanks. goodluck.

[Revhead]

Thanks Dale, this has been passed onto the relevant people

[PranK]

Should be all good now.

Will be upgrading to IPB 2.2 soon which will resolve a lot of issues.

[Jago]

i think there's some other crap on the forums pages too? Can't recall their names, but i was getting two different ones. I need to block active X and java to use the forums without getting it.

[MKDR33]

my NAV (norton antivirus) keeps on picking up Bloodhound.Exploit.96 which has a link to http://bafumba.com/counter/dsb/dsb.exe Downloader aswell, everytime i login to SAU.. and now i cant even upload on SAU or anywhere else for that matter...

anyone got a removal tool for this? or manual instructions?

[ix9]

I was getting it while surfing last night around 11pm

[ferni]

yeah, use firefox

[Jago]

i was getting sysinfo.exe and 3156340348143.exe

[R31Nismoid]

Same as above

[Ronin 09]

i was getting sysinfo.exe and 3156340348143.exe

still here

[MKDR33]

i am still getting this people.. only now its not on the main page as it was in the pic shown below, but its on other pages on SAU..

[Naife]

just opened the SA section and the virus alert went off.

files that were infected were index[8].htm VBS/Psyme trojan and index[9].htm JS/Exploit-BO.gen Trojan.

was picked up by VET.

[PranK]

f**k it... Ok... I need to get the updates done. Its coming through a hole in one of our modules...

Sorry guys, I am trying to stop it.

[R34]

Yep

Last two days get trojan virus alerts when opening SAU

[subzeroR33]

Yeah i keep getting the bloodhound exploit 96 when opening a topic.

[Yidz]

I've been getting a few of them too. What's the best way to clear them??

[NewKleer]

dont visit SAU till its fixed (subscribe to this topic perhaps)

as for clearing them, arent they caught by your anti-virus? you can always try boot in safe mode and delete them from wherever they are (c:\sysinfo.exe) and delete any references to them in startup (check msconfig from run prompt)

[SilverECR33]

looks like a few of you have it already in your computer. MKDR33 that shot shows you the file is located in your Temp files. Norton aint very good and stopping them, you will need to manually remove them if you can in safe mode.

- recommend NOD32 ftw!

[evil_weevil]

ouch - everytime I open NSW section only for me...