View Full Version : Trojan in another ad



bond90
12th December 2007, 01:39
Hi to all personnel of the site, I wanted to report a problem; in one of the ad which appear after the loading of a page, my antivirus found a trojan:a file was trying to download itself to the computer, it was called "c.wmf"; in addiction, the trojan was found in some elements of the page
here is the log of the antivirus

11/12/2007 23.05.20 AMON file C:\DOCUME~1\xxxx\IMPOST~1\Temp\0vvuuwpv.wmf modified variant of Win32/Exploit.WMF trojan horse
11/12/2007 23.05.06 IMON file [Only registered and activated users can see links] modified variant of Win32/Exploit.WMF
11/12/2007 23.05.05 IMON file [Only registered and activated users can see links] HTML/Exploit.IESlice. trojan horse
11/12/2007 23.05.01 IMON file [Only registered and activated users can see links] JS/Redirector.A
11/12/2007 23.05.00 IMON file [Only registered and activated users can see links] JS/TrojanDownloader.Small.CN

Hope this will help you, thanks for your priceless service

m4sta
12th December 2007, 01:46
Yeah like this what i postet not so long ago
30 minutes ago
[Only registered and activated users can see links]

bond90
12th December 2007, 01:49
Yeah like this what i postet not so long ago
30 minutes ago
[Only registered and activated users can see links]

In fact I said "another ad" ;) :)

m4sta
12th December 2007, 02:03
But the trojan is located on the same site afcmoney.org. Hope they delete the site from ads becouse this is quite anoying

bond90
15th December 2007, 17:06
Seems the staff doesn't mind about us...I know advertising is needed to keep this great service alive, but this shouldn't affect the usage of the site...I think it should be removed, for the reputation of the forum itself...Hope they will consider it...

SuYoG
15th December 2007, 17:18
@ bond90 we already working on it wait 2 admin or master mods reply !

bond90
16th December 2007, 12:34
@ bond90 we already working on it wait 2 admin or master mods reply !

Thanks SuyoG for your reply, mine was only a provocation, waiting for a reply...

-=[tp12]=-
16th December 2007, 12:36
Thanks SuyoG for your reply, mine was only a provocation, waiting for a reply...

Your prob must have been solved now...
As some of the ads have been removed...
You still facing the prob...:?:

bond90
16th December 2007, 12:45
Your prob must have been solved now...
As some of the ads have been removed...
You still facing the prob...:?:

Yesterday I was still facing the problem; today I don't know; I've seen an ad from the same group, but the antivirus didn't warn me; however, I'm on another computer with avg instead of nod32...I'll try with my pc asap; thanks for your help again, I'll let you know there

-=[tp12]=-
16th December 2007, 12:47
Yesterday I was still facing the problem; today I don't know; I've seen an ad from the same group, but the antivirus didn't warn me; however, I'm on another computer with avg instead of nod32...I'll try with my pc asap; thanks for your help again, I'll let you know there

Sure mate...
Awaiting for your reply...

valuz
17th December 2007, 10:52
I am still facing the problemm.In 2 minutes now it tried 3 times starting the download of this file.A bit confusing.

Cliddo
17th December 2007, 11:18
I also have the trojan problem in the ads. :(

bond90
17th December 2007, 17:24
I'm very sorry tp12...
here's new report


17/12/2007 15.14.21 AMON file C:\DOCUME~1\xxx\IMPOST~1\Temp\4o8f4qan.wmf modified variant of Win32/Exploit.WMF trojan horse quarantined. deleted Event occurred on a file modified by application: C:\PROGRA~1\Mozilla Firefox\firefox.exe. File has been quarantined.you may close this window.
17/12/2007 15.14.13 IMON file [Only registered and activated users can see links] modified variant of Win32/Exploit.WMF trojan horse
17/12/2007 15.14.12 IMON file [Only registered and activated users can see links] HTML/Exploit.IESlice.I trojan horse connection aborted
17/12/2007 15.14.10 IMON file [Only registered and activated users can see links] JS/Redirector.A trojan horse connection aborted
17/12/2007 15.14.09 IMON file [Only registered and activated users can see links] JS/TrojanDownloader.Small.CN trojan horse connection aborted

the address is the same as before, all of them belong to afcmoney.org....hope
a solution will be found...

F2504x4
3rd March 2008, 01:47
They say a picture is worth a thousand words


[Only registered and activated users can see links]

[Only registered and activated users can see links]

3com
3rd March 2008, 04:19
nah never found that.....clean ur temp folder...looks on ur screenshot...there is no such trojan on forum