I am running AVG anti-virus software and I have been getting the following message when I visit that site:
Threat was blocked
File name: nbadimensions.net/sti.ph
Exploit Blackhole Exploit Kit(type 2065)
Can someone email their admin and to check it out if the message is legit?
> What you saw looks real enough . I've mentioned it within a thread about something similar .
> I googled "nbadimensions.net/sti.ph" and it shows up as someone trying to start a sports site forum ( I didn't click on any links ) .
> I figure "buddy" is now wrapping a piece of "counting" software around Lansing Heritage so that when anyone enters it , "buddy" counts a hit on his own site ( all to attract ad revenue ) .
I run Avast! and just went to the site with no problems, alerts.
GM
Loud is Beautiful if it's Clean! As always though, the usual disclaimers apply to this post's contents.
GM: Probably Avast doesn't know about this virus yet, don't know.
This info is if you have been infected in the first place ! But the Exploit Black hole redirect virus is real ! It runs in stealth mode.
It's a TDL3 variant of a TDSS rootkit backdoor Trojan.Check task manager if there is a svchost.exe using a lot of CPU/memory resources you may have been infected with this rootkit !!! It will load rogue security software onto your computer.The problem with these rootkits is they will install all kinds of different Malware onto your computer after initial infection of the tdss rootkit.You can research this at Bleeping computer.I go there a lot to read the (Virus, Trojan, Spyware, and Malware Removal Logs) to see what the latest threats are.If you don't know how to remove this stuff I suggest you go over there and post.They will help everyone who needs it,but can take some time as they are quite busy.
(Note that an exploit kit is a piece of software that is designed to exploit (hence the name exploit kit) a collection of known security holes present in common software. E.g. security holes in outdated java versions, outdated browsers, outdated PDF readers, etc. If a security leak is found by the exploit kit, a mechanism is activated to abuse this security leak and install some piece of malware.)
Check out this thread ! Exploit Black Hole and Redirect virus infection
or use the search feature for this trojan at Bleeping computer you should come up with 28 results. "Exploit Blackhole Exploit Kit"
Look for a free program called tdsskiller.exe ! "USE THIS INFO AT YOUR OWN RISK"
If you don't know what you are doing, "MY RECOMMENDATION" would be to go to a Malware removal site like Bleeping Computer,Geeks to Go,Major geeks,etc....
And ask for help, it's Free !!!
Hope not, it has updated at least twice today and the last one < 1 hr. before I accessed the site.Originally Posted by Ronald Lee
GM
Loud is Beautiful if it's Clean! As always though, the usual disclaimers apply to this post's contents.
FWIW, mine is showing no CPU usage nor is anything not working properly, though haven't rebooted in a couple of weeks now if that makes a difference. Also, I just realized I've had the Altec Library open in a tab since I last rebooted, so have to wonder about whether the threat from lansingheritage is real.
GM
Loud is Beautiful if it's Clean! As always though, the usual disclaimers apply to this post's contents.
Me neither, nor links from folks I don't know and occasionally email someone I know to find out if they really sent it and sometimes it turns out they're infected and didn't know it.
GM
Loud is Beautiful if it's Clean! As always though, the usual disclaimers apply to this post's contents.
I scanned my computer with Melware WWW(dot)MALWAREBYTES(dot)ORG and AVG and they found nothing, I think AVG stopped it at the source. Doesn't hurt to be too careful, from my understanding some of those "root kits" are almost impossible to get rid off short of wiping the HD and reinstalling Windows.
Last edited by Ronald Lee; October 30th, 2011 at 12:10 AM.
Bookmarks