Iframe on FFXIAH

[Kuuhalee]

Infected myself via Virtual Machine (Windows XP SP2; Latest Adobe Flash Updates)
Infection Method - Direct (Visited the Offending URL)

• Tested in IE6 and WAS infected.
• Tested in IE7 and was NOT infected.
• Tested in IE8 and was NOT infected.
• Tested in Firefox 3.5.6 (no add-ons) and was NOT infected.


[ Virus Scanner Information ]

http://www.virustotal.com/analisis/b6b03bccffe571af796e3a110c9ec0291d08ccee666597e3273d6033e583ac9c-1261435112

[ Virus Files and Names ]
• c:\windows\system32\<randomly-generated-name>.exe


[ Manual Virus Detection ]

- If you visited FFXIAH.COM during the infected period and are worried about whether or not you are infected, please go to Microsoft TechNet (Sysinternals) and download the Autoruns tool :

http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

- Extract the files to a directory and run 'autoruns.exe'.

NOTE : When you initially run the program, it will begin a scan. Tap the Escape button once and it will cancel the scan. Make sure that 'Verify Code Signatures' and 'Hide Signed Microsoft Entries' are selected in the 'Options' menu of the program, then execute another scan by clicking the Refresh icon.

- If you are infected, you will see the highlighted entry under the 'UserInit' section :

http://www.moofah.com/temp/media/ima...ffxiah-trj.jpg

- The filename the trojan uses is randomized, but is always placed in the 'C:\Windows\System32' file folder.


[ Prevention ]
• SandBoxie (www.sandboxie.com)
• DropMyRights (http://www.bluegartr.com/forum/showp...4&postcount=98)

[Aevis]

come on guys. beeing a mod on a board doesn't equal knowing anything about web technologies at all. she misunderstood the cause and didn't understand the problem, you can blame her for giving a false advise based on that. however beating the dead horse, taking funny pictures of it and /ranting on a different board is so 4chan.

@kuuh nvm, saw your code line too late

[BerenTebogo]

So don't comment on shit you don't know about with info that could potentially put the people you mod at risk?

Are you that fucking stupid?

[BerenTebogo]

Also, from now on just read everything I post in Jack McCoy's voice.

[Aevis]

i wonder who you're talking to in jack mccoy's voice

[Spekkio]

if you have passed CPR class, this does not give you credibility as a doctor. if you've passed the "i can find the on button on my computer" test, this does not make you qualified to give tech advice. well, outside of geek squad. there they say that linux will make your AC adapter break and void your warranty.

http://digg.com/linux_unix/Installin...voids_warranty

[ZhiGaruda]

Spoiler: show

Infected myself via Virtual Machine (Windows XP SP2)
Infection Method - Direct (Visited the Offending URL)

• Tested in IE6 and WAS infected.
• Tested in IE8 and was NOT infected.
• Tested in Firefox 3.5.6 (no add-ons) and was NOT infected.


[ Virus Scanner Information ]

http://www.virustotal.com/analisis/b6b03bccffe571af796e3a110c9ec0291d08ccee666597e3273d6033e583ac9c-1261435112

[ Virus Files and Names ]
• c:\windows\system32\<randomly-generated-name>.exe


- If you visited FFXIAH.COM during the infected period and are worried about whether or not you are infected, please go to Microsoft TechNet (Sysinternals) and download the Autoruns tool :

http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

- Extract the files to a directory and run 'autoruns.exe'.

NOTE : When you initially run the program, it will begin a scan. Tap the Escape button once and it will cancel the scan. Make sure that 'Verify Code Signatures' and 'Hide Signed Microsoft Entries' are selected in the 'Options' menu of the program, then execute another scan by clicking the Refresh icon.

- If you are infected, you will see the highlighted entry under the 'UserInit' section :

http://www.moofah.com/temp/media/ima...ffxiah-trj.jpg

- The filename the trojan uses is randomized, but is always placed in the 'C:\Windows\System32' file folder.

Very good information. Thanks.

[Kuuhalee]

For those of you who are very nervous using FFXI community sites, even with Firefox and add-ons, I would suggest using SandBoxie (www.sandboxie.com) or using DropMyRights (Windows XP and Below : http://www.bluegartr.com/forum/showp...4&postcount=98). These add another very solid layer of protection and are very difficult to penetrate.

[Mayareira]

Wow that's messed up. People should really have a security token by this time.

This shit can come out anywhere :/