Welcome, Guest. Please login or register.

Login with username, password and session length
Forums Search:  


Author Topic: Domain forwarding issue  (Read 39275 times)

-Oz-

  • Map Maker!
  • Administrator
  • Expert Advisor
  • *****
  • Posts: 1577
  • Karma: 27
    • View Profile
    • GPSFileDepot
Re: Domain forwarding issue
« Reply #45 on: March 05, 2012, 07:37:25 PM »
Yes, the .exe files were not modified.  It could only embed in the web pages itself.
Dan Blomberg
Administrator - GPSFileDepot
GPS Units: Garmin Dakota 20, Garmin GPSMap 60csx, Nuvi 255W, Nuvi 250W, ForeRunner 110, Fenix 2, Tactix Bravo, Foretrex 401
See/Download My Maps!

GreyDude

  • Newbie
  • *
  • Posts: 2
  • Karma: 0
    • View Profile
Re: Domain forwarding issue
« Reply #46 on: March 06, 2012, 09:35:02 AM »
Looks like the culprit script is back.  Tried to access the GPSFileDepot site from IE and again get rerouted.

Access from Firefox is OK

Boyd

  • Expert Advisor
  • *****
  • Posts: 3797
  • Karma: 43
    • View Profile
Re: Domain forwarding issue
« Reply #47 on: March 06, 2012, 11:03:05 AM »
DAMN.... I'm afraid you're right. I was just redirected to http://ustreamtvonline.rr.nu/2f/

Using the activity monitor in Safari, I once again see the same embedded links on GPSFileDepot pages...

Seldom

  • Expert Advisor
  • *****
  • Posts: 1852
  • Karma: 19
    • View Profile
Re: Domain forwarding issue
« Reply #48 on: March 06, 2012, 12:16:20 PM »
When I tried to log in the first time I was re-directed to a site that helpfully informed me I had lots of viruses.  It's domain ended in .de .  Second IE login worked OK.  Then when I tried to post this message in IE I got repeated "page timed out" messages.  I'm sending it from Firefox.

jbensman

  • Expert Advisor
  • *****
  • Posts: 422
  • Karma: 7
    • View Profile
Re: Domain forwarding issue
« Reply #49 on: March 06, 2012, 02:16:36 PM »
IE Not working Firefox is

-Oz-

  • Map Maker!
  • Administrator
  • Expert Advisor
  • *****
  • Posts: 1577
  • Karma: 27
    • View Profile
    • GPSFileDepot
Re: Domain forwarding issue
« Reply #50 on: March 06, 2012, 05:26:33 PM »
Grr, running the cleaner now.  I have to think the exploit is in the forums because I can't get to certain pages around here.  Looks like the forums will have to get a clean install.
Dan Blomberg
Administrator - GPSFileDepot
GPS Units: Garmin Dakota 20, Garmin GPSMap 60csx, Nuvi 255W, Nuvi 250W, ForeRunner 110, Fenix 2, Tactix Bravo, Foretrex 401
See/Download My Maps!

-Oz-

  • Map Maker!
  • Administrator
  • Expert Advisor
  • *****
  • Posts: 1577
  • Karma: 27
    • View Profile
    • GPSFileDepot
Re: Domain forwarding issue
« Reply #51 on: March 06, 2012, 05:45:43 PM »
Fixed again.  It left behind a backdoor in the map upload part of the site that I missed. That has been removed now too.
Dan Blomberg
Administrator - GPSFileDepot
GPS Units: Garmin Dakota 20, Garmin GPSMap 60csx, Nuvi 255W, Nuvi 250W, ForeRunner 110, Fenix 2, Tactix Bravo, Foretrex 401
See/Download My Maps!

jbensman

  • Expert Advisor
  • *****
  • Posts: 422
  • Karma: 7
    • View Profile
Re: Domain forwarding issue
« Reply #52 on: March 06, 2012, 06:03:44 PM »
test

jbensman

  • Expert Advisor
  • *****
  • Posts: 422
  • Karma: 7
    • View Profile
Re: Domain forwarding issue
« Reply #53 on: March 06, 2012, 06:06:05 PM »
I was not able to post on the forums (got times out) not send emails, messages or log out on IE or Firefox.  I tried clearing cache and history and still nothing.  I shut down IE and restarted it.  It then allowed me to log off and log back in.  It seems to be working now.

-Oz-

  • Map Maker!
  • Administrator
  • Expert Advisor
  • *****
  • Posts: 1577
  • Karma: 27
    • View Profile
    • GPSFileDepot
Re: Domain forwarding issue
« Reply #54 on: March 06, 2012, 08:14:48 PM »
Those symptoms (the login/logout/register) all occurred while I was changing security settings.  It broke some of the session data so until the browser cache was cleared there were anomoloies.  Hopefully all the backdoors were found but I still may need to do major work on the forum software since it isn't custom builts.
Dan Blomberg
Administrator - GPSFileDepot
GPS Units: Garmin Dakota 20, Garmin GPSMap 60csx, Nuvi 255W, Nuvi 250W, ForeRunner 110, Fenix 2, Tactix Bravo, Foretrex 401
See/Download My Maps!

Boyd

  • Expert Advisor
  • *****
  • Posts: 3797
  • Karma: 43
    • View Profile
Re: Domain forwarding issue
« Reply #55 on: April 06, 2012, 05:11:29 AM »
This might be worrisome... a trojan named BackDoor.Flashback.39 has gotten a lot of coverage recently because it can infect Macs: http://news.yahoo.com/more-600-000-macs-infected-flashback-malware-report-091608469.html

This is what caught my eye though. Look at some of the websites that are spreading this virus. They include the sites that we were being redirected to when GPSFileDepot was hacked. I guess I need to take a closer look at my Mac to see if it's been compromised.  >:(

http://news.drweb.com/show/?i=2341&lng=en&c=14

Quote
Systems get infected with BackDoor.Flashback.39 after a user is redirected to a bogus site from a compromised resource or via a traffic distribution system. JavaScript code is used to load a Java-applet containing an exploit. Doctor Web's virus analysts discovered a large number of web-sites containing the code. The recently discovered ones include:

    godofwar3.rr.nu
    ironmanvideo.rr.nu
    killaoftime.rr.nu
    gangstasparadise.rr.nu
    mystreamvideo.rr.nu
    bestustreamtv.rr.nu
    ustreambesttv.rr.nu
    ustreamtvonline.rr.nu
    ustream-tv.rr.nu
    ustream.rr.nu

-Oz-

  • Map Maker!
  • Administrator
  • Expert Advisor
  • *****
  • Posts: 1577
  • Karma: 27
    • View Profile
    • GPSFileDepot
Re: Domain forwarding issue
« Reply #56 on: April 06, 2012, 08:17:25 AM »
I hope it hasn't been compromized.  The kicker is that this is how lots of windows machines get infected (through Java).  While I was deployed my media center got infected through Java which was super ridiculous because it rarely browses the internet.  Java and flash are becoming the bane of my existence.
Dan Blomberg
Administrator - GPSFileDepot
GPS Units: Garmin Dakota 20, Garmin GPSMap 60csx, Nuvi 255W, Nuvi 250W, ForeRunner 110, Fenix 2, Tactix Bravo, Foretrex 401
See/Download My Maps!

 

anything