Domain forwarding issue

[-Oz-]

Yes, the .exe files were not modified.  It could only embed in the web pages itself.

[GreyDude]

Looks like the culprit script is back.  Tried to access the GPSFileDepot site from IE and again get rerouted.

Access from Firefox is OK

[Boyd]

DAMN.... I'm afraid you're right. I was just redirected to http://ustreamtvonline.rr.nu/2f/

Using the activity monitor in Safari, I once again see the same embedded links on GPSFileDepot pages...

[Seldom]

When I tried to log in the first time I was re-directed to a site that helpfully informed me I had lots of viruses.  It's domain ended in .de .  Second IE login worked OK.  Then when I tried to post this message in IE I got repeated "page timed out" messages.  I'm sending it from Firefox.

[jbensman]

IE Not working Firefox is

[-Oz-]

Grr, running the cleaner now.  I have to think the exploit is in the forums because I can't get to certain pages around here.  Looks like the forums will have to get a clean install.

[-Oz-]

Fixed again.  It left behind a backdoor in the map upload part of the site that I missed. That has been removed now too.

[jbensman]

test

[jbensman]

I was not able to post on the forums (got times out) not send emails, messages or log out on IE or Firefox.  I tried clearing cache and history and still nothing.  I shut down IE and restarted it.  It then allowed me to log off and log back in.  It seems to be working now.

[-Oz-]

Those symptoms (the login/logout/register) all occurred while I was changing security settings.  It broke some of the session data so until the browser cache was cleared there were anomoloies.  Hopefully all the backdoors were found but I still may need to do major work on the forum software since it isn't custom builts.

[Boyd]

This might be worrisome... a trojan named BackDoor.Flashback.39 has gotten a lot of coverage recently because it can infect Macs: http://news.yahoo.com/more-600-000-macs-infected-flashback-malware-report-091608469.html

This is what caught my eye though. Look at some of the websites that are spreading this virus. They include the sites that we were being redirected to when GPSFileDepot was hacked. I guess I need to take a closer look at my Mac to see if it's been compromised. 

http://news.drweb.com/show/?i=2341&lng=en&c=14

Systems get infected with BackDoor.Flashback.39 after a user is redirected to a bogus site from a compromised resource or via a traffic distribution system. JavaScript code is used to load a Java-applet containing an exploit. Doctor Web's virus analysts discovered a large number of web-sites containing the code. The recently discovered ones include:

    godofwar3.rr.nu
    ironmanvideo.rr.nu
    killaoftime.rr.nu
    gangstasparadise.rr.nu
    mystreamvideo.rr.nu
    bestustreamtv.rr.nu
    ustreambesttv.rr.nu
    ustreamtvonline.rr.nu
    ustream-tv.rr.nu
    ustream.rr.nu

[-Oz-]

I hope it hasn't been compromized.  The kicker is that this is how lots of windows machines get infected (through Java).  While I was deployed my media center got infected through Java which was super ridiculous because it rarely browses the internet.  Java and flash are becoming the bane of my existence.