**WARNING** Somepage.com compromised **UPDATED 5/27**

[Eanae]

http://i3.photobucket.com/albums/y95...uckedagain.jpg

Return of the iframe!

Thread with information to fix the newest exploit can be found here: viewtopic.php?f=2&t=34205

If you are coming across a POL error after the play button about interface not supported, you may have the most recent "bug". Firstly search your PC for smart.dll. If you find this, see The Fix: below.

i was helping a friend and came across this in her hijackthis log as

O20 - Winlogon Notify: Fly - C:\WINDOWS\SYSTEM32\smart.dll

seemed quite suspicious so i loaded up a process scanner and came across it hooking ffxi and no other exes. after removing it, the interface error stopped.


Code:
==================================================
Module Name : smart.dll
Base Address : 0x013C0000
Module Size : 0x0000C000
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Framebuffer Display Driver
Company : Microsoft Corporation
Product Name : Microsoft? Windows? Operating System
Modified Date : 5/26/2008 11:07:07 AM
File Size : 35,840
Filename : C:\WINDOWS\system32\smart.dll
File Attributes : A
==================================================



The fix:

Download HiJackThis ( http://www.trendsecure.com/portal/en-US ... s/download ) and save to desktop.

Reboot in safe mode: Spam F8 while rebooting and choose safe mode.

Once in safe mode: Start > Run > type cmd > hit ok.

In command prompt type: regsvr32 /u C:\WINDOWS\SYSTEM32\smart.dll

Hit enter.

Once in safemode run hijackthis, choose perform a system scan.

Look for O20 - Winlogon Notify: Fly - C:\WINDOWS\SYSTEM32\smart.dll

Check it, hit fix checked.

Browse to C:\WINDOWS\SYSTEM32\smart.dll and delete the file. If the file does not delete, try restarting in normal mode and deleting it.

Reboot normally, run HiJackThis for smart.dll, it seemed to not reinstall itself tho.

mod edit: sticky + make the title larger

[Therin]

Somepage.com is olde.

[Eanae]

Somepage.com is olde.

Their search feature is still the best.

[TacoTaru]

Maybe I didn't try it enough or give it enough of a shot, but I could never find ANYTHING I wanted on somepage.

[Capo]

ffxiah power search is basically the same as somepage search, if not better

[Katoke]

Here's the solution to this problem:

STOP USING SOMEPAGE.

[ronin sparthos]

Here's the solution to this problem:

STOP USING SOMEPAGE.

and atlas for that matter since its been hit twice?

[Indalecia]

But dammit, I like the skill chart :/

[Izzy]

I wonder if it's someone on the inside of somepage putting that there? You'd think they'd fix the hole after the first time it happened.

[Jeny]

Lol, this is just getting silly now. I'm betting all the site's pages are filled with iframes by now.

[ronin sparthos]

I wonder if it's someone on the inside of somepage putting that there? You'd think they'd fix the hole after the first time it happened.

Nah its the same RMT that fucked with somepage in November, it seems like our friends at somepage didnt plug all the holes in their site.

[Suiram]

I've taken to using FFXIAH search function, too, after the last time this happened to somepage. The only thing that would make it perfect is if results weren't truncated to 100, but rather moved to an additional page or something, and if you could re-sort or refine elements of your search from the results page (although I think you can kinda do this by adjusting the URL but I'm not sure how exactly it works).

[Lordwafik]

Ya I'm using ffxiah for my stuff now rather than somepage. Sorry somepage, I loved you once but you are now full of STDs, we can no longer be together.

[Deftscythe]

Hasn't FFXIAH also been infected multiple times via google ads? It always seemed even less safe to me since you have to allow scripts for it to even work.

[Prosek]

I tried to play around with somepage to find out if it really was the source of my toon getting hacked. Right after the hack, I scanned my system with AVG, Zone Alarm, Kaspersky, and WinClam, and nothing was found. Stripped the system down, tried playing with somepage to see if any of the AV programs would detect anything. Notta.

So I went to Somepage, installed the ActiveX, and ran POL with the Somepage window open. No warnings popped up, but I did notice one difference, winlogon.exe tried to inject itself into POL (per Kaspersky), when it did not do that previously.

Is there any software that actually detects this shit?

[Kerberoz]

Hasn't FFXIAH also been infected multiple times via google ads? It always seemed even less safe to me since you have to allow scripts for it to even work.

Allowing scripts for ffxiah.com only allows scripts hosted on the actual site to run, not any of the ads.

[terranova]

I honestly have not gone to somepage and FFXI-atlus/AH/cyclopedia, since this whole shit started. About to stop using alla too since it's bound to happen. All that's left is BG-wiki and mysterytour that I'm not afraid to go to.

[#686578]

Why would you admit going to Allakhazam.

[Nekozuko]

I go there for a laugh is that wrong?

[terranova]

I just read their mission pages to see different approaches people have made and what works and what doesn't.

But with the amount of ads that pop up, Im surprised RMT hasn't planted a billion trojans in it. (Then again the site/company is owned by IGE so..)