halfliferadio.com virus

[jo1]

today I went to halfliferadio.com in IE, through the numerous popups a setup file pup.exe is magically downloaded to my program files directory, it is installed automatically, from what I can tell it created 4 exe's (do.exe in c:\, over.exe in c:\program files, and pup.exe in c:\windows, the new exe's it created were then automatically executed, over.exe running as it was in my task manager while pup.exe failed due to a missing vb dll I believe

I have searched for this and can't find anything, anyone know anything about this?

Do not visit the site unless you have all of the latest security updates or a different browser.

 

[Joker81]

never press Yes to anything to an untrusted site.

 

[jo1]

there was NO clicking neccessary, it does this without any interaction

 

[Anubis]

adaware
http://www.lavasoftusa.com/

spybot
http://security.kolla.de/


update them both first and then run them both. so this liek once a week

 

[jo1]

it must exploit a vulnerability in IE

 

[jo1]

adaware did not flag it, that is why i think it may be a virus or something

 

[Medea]

Originally posted by: jo1
it must exploit a vulnerability in IE

Ditto.

 

[Freejack2]

Have you gone to windowsupdate.microsoft.com and put on every critical update available for your computer? (I assume you're running windows)
If not go and do that. There are a number of exploits out there that have been patched.
Mind you there are a number that haven't been patched...

 

[TechnoKid]

Also run CWShredder.

 

[jo1]

I installed a patch for IE and it no longer is able to execute from the popup, although it tries... I can't believe halfliferadio allows such a thing

 

[LinuxIdiot]

There is apparently a couple of ther programs you may want to look for http://www.computing.net/windows2000/wwwboard/forum/54380.html \

Also ->> http://www.stbernard.com/products/support/updateexpert/uetechfaqs/UpdateEXPERT6.x/Installation/UE0150.htm

PUP.exe
Added in 6.1 to support the "packaged updates" feature. This allows UpdateEXPERT and its remediation database to be updated in an isolated (non-internet connected) network.

 

[Joker81]

I guess I didn't have the problem since I have a popup blocker.