Home•Fairfax General Forum•Arrest/Ticket Search•Wiki new•Pictures/Videos•Chat•Articles•Links•About
Off-Topic :  Fairfax Underground fairfax underground logo
Welcome to Fairfax Underground, a project site designed to improve communication among residents of Fairfax County, VA. Feel free to post anything Northern Virginia residents would find interesting.
Goto Topic: Previous•Next
Go to: Forum List•Back to Forum•Post New Topic•Search•Log In•Print View
Trojan horse downloader...
Posted by: inkahootz ()
Date: May 08, 2009 10:12AM

How come there is a Trojan horse downloader embedded in this site?

http://safeweb.norton.com/report/show?url=http:%2F%2Fwww.fairfaxunderground.com%2Fforum%2Fread%2F2%2F182955.html

edit by Cary: Account password compromised, disabled by administrator.

Options: Reply•Quote
Re: Trojan horse downloader...
Posted by: Gravis ()
Date: May 08, 2009 10:14AM

har har. -_-


"the wisdom of the wise will perish, the intelligence of the intelligent will vanish."095042938540

Options: Reply•Quote
Re: Trojan horse downloader...
Posted by: inkahootz ()
Date: May 14, 2009 08:18AM

Watch out Spunky...DANGER...DANGER!!!!!!

http://safeweb.norton.com/report/show?url=fairfaxunderground.com

Options: Reply•Quote
Re: Trojan horse downloader...
Posted by: Vince(1) ()
Date: May 14, 2009 12:06PM

Im sure your statement is true....probably what Grupis has planned for me next.

Options: Reply•Quote
Re: Trojan horse downloader...
Posted by: MrMephisto ()
Date: May 14, 2009 01:12PM

So why don't you leave or stop being a knob gobbler? It's a really simple choice.

--------------------------------------------------------------
13 4826 0948 82695 25847. Yes.

Options: Reply•Quote
Re: Trojan horse downloader...
Posted by: Gravis ()
Date: May 14, 2009 02:49PM

i looked into it and the image used to propagate the trojan was likely posted without any intended malice, likely picked up from another forum/google images. anyway, it seemed fine to me but then i cracked it open with a hex editor and saw the trojan downloader appended at the end that likely exploits some parsing error in IE (6?). anyway, it creates an invisible (1px by 1px) iframe which downloads something from http://www.ciudad.com.ar/ar/popunder/p_submit.asp?site=personales.ciudada.com.ar which is now a 404. so there is no longer a threat of any kind. it appears the image was uploaded in january of this year.

attached is a cleaned version of the image.


"the wisdom of the wise will perish, the intelligence of the intelligent will vanish."095042938540



Edited 1 time(s). Last edit at 05/14/2009 02:50PM by Gravis.
Attachments:
thread sucks.jpg

Options: Reply•Quote
s
Posted by: inkahootz ()
Date: May 14, 2009 04:28PM

s



Edited 1 time(s). Last edit at 06/01/2010 02:18PM by inkahootz.

Options: Reply•Quote
Re: Trojan horse downloader...
Posted by: m and m ()
Date: May 23, 2009 02:30PM

tro-jan is safe. it is like having sex with a hiv hooker. safe as tuna. speaking of tuna, i love tuna on WHITE bread. I even like yeast.

Options: Reply•Quote


Go to: Forum List•Back to Forum•Search•Log In
Your Name: 
Your Email (Optional): 
Subject: 
Attach a file
  • No file can be larger than 75 MB
  • All files together cannot be larger than 300 MB
  • 30 more file(s) can be attached to this message
Spam prevention:
Please, enter the code that you see below in the input field. This is for blocking bots that try to post this form automatically.
 **         ********  ********   **         **    ** 
 **    **   **        **     **  **    **   ***   ** 
 **    **   **        **     **  **    **   ****  ** 
 **    **   ******    ********   **    **   ** ** ** 
 *********  **        **         *********  **  **** 
       **   **        **               **   **   *** 
       **   ********  **               **   **    **
This forum powered by Phorum.