Printable View
I am running AVG anti-virus software and I have been getting the following message when I visit that site:
Threat was blocked
File name: nbadimensions.net/sti.ph
Exploit Blackhole Exploit Kit(type 2065)
Can someone email their admin and to check it out if the message is legit?
> What you saw looks real enough . I've mentioned it within a thread about something similar .
> I googled "nbadimensions.net/sti.ph" and it shows up as someone trying to start a sports site forum ( I didn't click on any links ) .
> I figure "buddy" is now wrapping a piece of "counting" software around Lansing Heritage so that when anyone enters it , "buddy" counts a hit on his own site ( all to attract ad revenue ) .
I run Avast! and just went to the site with no problems, alerts.
GM
GM: Probably Avast doesn't know about this virus yet, don't know.
This info is if you have been infected in the first place ! But the Exploit Black hole redirect virus is real ! It runs in stealth mode.
It's a TDL3 variant of a TDSS rootkit backdoor Trojan.Check task manager if there is a svchost.exe using a lot of CPU/memory resources you may have been infected with this rootkit !!! It will load rogue security software onto your computer.The problem with these rootkits is they will install all kinds of different Malware onto your computer after initial infection of the tdss rootkit.You can research this at Bleeping computer.I go there a lot to read the (Virus, Trojan, Spyware, and Malware Removal Logs) to see what the latest threats are.If you don't know how to remove this stuff I suggest you go over there and post.They will help everyone who needs it,but can take some time as they are quite busy.
(Note that an exploit kit is a piece of software that is designed to exploit (hence the name exploit kit) a collection of known security holes present in common software. E.g. security holes in outdated java versions, outdated browsers, outdated PDF readers, etc. If a security leak is found by the exploit kit, a mechanism is activated to abuse this security leak and install some piece of malware.)
Check out this thread ! Exploit Black Hole and Redirect virus infection
or use the search feature for this trojan at Bleeping computer you should come up with 28 results. "Exploit Blackhole Exploit Kit"
Look for a free program called tdsskiller.exe ! "USE THIS INFO AT YOUR OWN RISK"
If you don't know what you are doing, "MY RECOMMENDATION" would be to go to a Malware removal site like Bleeping Computer,Geeks to Go,Major geeks,etc....
And ask for help, it's Free !!!
Hope not, it has updated at least twice today and the last one < 1 hr. before I accessed the site.Quote:
Originally Posted by Ronald Lee
GM
Just be careful of what you click on.And you should be OK.I never click on any kind of ads.
FWIW, mine is showing no CPU usage nor is anything not working properly, though haven't rebooted in a couple of weeks now if that makes a difference. Also, I just realized I've had the Altec Library open in a tab since I last rebooted, so have to wonder about whether the threat from lansingheritage is real.Quote:
Originally Posted by Altec Best
GM
Me neither, nor links from folks I don't know and occasionally email someone I know to find out if they really sent it and sometimes it turns out they're infected and didn't know it.Quote:
Originally Posted by Altec Best
GM
I scanned my computer with Melware WWW(dot)MALWAREBYTES(dot)ORG and AVG and they found nothing, I think AVG stopped it at the source. Doesn't hurt to be too careful, from my understanding some of those "root kits" are almost impossible to get rid off short of wiping the HD and reinstalling Windows.Quote:
Originally Posted by GM
I wipe my hard drive clean about every month, keeps it running fast. I just save the good stuff to my portable hard drive and it takes about an hour to clean and replace it.
The CPU/Memory usage in task manager will be near 100% if it's infected.Remember an exploit type malware means your computer has to be insecure, so if all your software has it's security updates and patches and you don't click on any suspicious links your exposure is virtually nil with this type of malware.Quote:
Originally Posted by GM
I just went over there and my browser locked up.Used Task Manager to kill application.Something maybe up there. Dunno ? Didn't want to hang around to find out.
I use AVG and I just got the exact same warning when I tried to enter their site--and it blocks the site completely. Something's definitely wrong over their--I'd say the threat/virus is real.......
Every month? That seems a bit excessive to me. I think it's a pain in the butt to setup everything the way I like it again, and import my mail, bookmarks, settings, and programs again.Quote:
Originally Posted by cradeldorf
Problem fixed. I no longer get that message.
> No, that is not correct, the problem at LHF is not yet fully fixed ( & why your AVG software has stopped warning you, is simply a mystery ).Quote:
Problem fixed. I no longer get that message.
> Browsing within the LHF site, continues to load some parts of the unauthorized code ( virus , if you will ) .
> The webmaster ( Don McRitchie ) knows about this and has asked the sites' hosting service to look into clearing it out .
<> EarlK
Hey Earl if you find out how this Exploit was introduced into the site in the first place from (Don McRitchie) would appreciate you sharing that info.A lot of these forums use the same type of software.We have to be ever vigilant these days !!!!
I'm going to contact Steven now here at Hostboard.And advise him of what seems to be circulating on other forums.
Thank You Earl !! :)
Oh yeah, you're right, there is still something wrong.Quote:
Originally Posted by Earl K
I am now getting the following message from my browser(I am using the current version of Opera 11.52), I am getting a "malware" warning when I enter each forum ie "Forum: Lansing Product DIY Forum" etc
The problem is NOT gone.
For you folks using Microsoft IE browser, be extremely careful, you could pickup this virus, because many viruses are written to take advantage of idiosyncrasies of the code in MS IE.
I THINK just using MS IE could expose you to the virus, I suggest using either Firefox or Opera in place of MS IE for now at least. The reason is that the code in Opera or Firefox is sufficiently different from MS IE to prevent the virus from running correctly, I don't really know, just conjecture.
I did sweep my computer HDs yesterday with AVG and Malawarebytes anti-malware and they found nothing so far.
Edited to add: Sorry, I forgot to mention that I upgraded my older browser; before I was 2 updates behind, that could account for the fact that my warnings have changed, because my browser is a bit different; sorry for the confusion. :(
FYI Ron AVG and Malwarebytes won't detect this on a scan,they become inacessible and load before windows does in the MBR ,it is a rootkit/bootkit therefore you need a specific Rootkit detector !!!!!! TDSSKiller,GMER,etc....Quote:
Originally Posted by Ronald Lee
I think I am good, AVG has an anti-root kit feature, I just checked it; and it warned me that it blocked it(well, I hope it did block it since it did warned me :|).Quote:
Originally Posted by Altec Best
I am also using Opera browser. If I had using MS IE, I think my chances of getting the root kit would go up, for reasons explained on my previous post.
Well if your google searches start to get redireted then you know you got the FLU !!! :Big smile:Quote:
Originally Posted by Ronald Lee
> LHF is now clear of that virus .
> John , the details of the fix are within this thread .
> Ann Cantelow is the person who has fixed the problem ( cleaned out the bad code ) .
> FWIW, I do use IE8 ( along with Norton ), therefore I'll be monitoring my own computer for a while, to see if it's picked up this malware .
cheers <. EarlK
Cool, the problem is fixed. I no longer get that malware message.
BTW: I did make a backup of my registry and generated a new check point just in case I got infected.
Ditto. Keeps the Trojans and other ruffians out.Quote:
Originally Posted by Ronald Lee
...that's just yet another reason I bought my Mac. :)
I just went to the site and no more warning message. Glad to see it's all fixed--they've got a nice forum over there and a great library too......Quote:
Originally Posted by Earl K
[QUOTE=Earl K;1826817]> LHF is now clear of that virus .
> John , the details of the fix are within this thread .
> Ann Cantelow is the person who has fixed the problem ( cleaned out the bad code ) .
> FWIW, I do use IE8 ( along with Norton ), therefore I'll be monitoring my own computer for a while, to see if it's picked up this malware .
cheers <. EarlK[/QUOTE
Thank You Earl !
FWIW I'm still using IE7 with McAfee Security Suite.I tried to update to IE 8,9,Firefox,Safari,Chrome, and none of them seem to run right all except IE7 my original browser that came with my HP Vista laptop .The one that worked the best and longest before issues arise was Firefox.But IE7 just seems to run with the least amount of problems by far on my Vista Home Premium SP2 machine.I'll be looking for a serious upgrade in the near future though as it is almost 5 years old.An eternity in the computing world.The Mac laptop is looking very nice !!!!
And here I thought it was because stealing is wrong :-PQuote:
Originally Posted by Steve Mac
OK, I do an Avast! full scan every night that includes rootkits with nothing found, use up-to-date Firefox and yet to notice any odd behavior even though I still have the one tab open to the Altec library, but still haven't re-booted; so is it something I need to worry about when I do a re-boot and if so, then what? Or must I do something before I re-boot?Quote:
Originally Posted by Altec Best
GM
I deserved that.Quote:
Originally Posted by Audio_by_Goodwill