Doc, I think you've been hacked

TheTodd · Post by **TheTodd** » Thu Jul 23, 2009 8:12 pm

avast is telling me the following when I get here today:

File: http://emsadmin.ru/tm/
Mailware name: JS

ownloader-AU [Expl]

TheTodd · Post by **TheTodd** » Fri Jul 24, 2009 6:10 am

I see it in the code...down at the bottom. You in bed with the ruskies Doc. I know Josh wishes he was...at least in bed with one certain Ruskie.

radbag · Post by **radbag** » Fri Jul 24, 2009 6:25 am

doc sold us all out to the ruskies?

DocZaius · Post by **DocZaius** » Fri Jul 24, 2009 7:56 am

Thanks. I'll look into it.

DocZaius · Post by **DocZaius** » Fri Jul 24, 2009 7:58 am

Has anyone else detected this? I see it in the code, but it appears to be on every page.

radbag · Post by **radbag** » Fri Jul 24, 2009 9:49 am

i see nothing.

TheTodd · Post by **TheTodd** » Fri Jul 24, 2009 2:59 pm

I've seen some web sites get hacked like that before and it ends up making calls to servers in China and then trying to run code on your box. I've witnessed it myself in a demo for a security suite where you go to a realtor site for an area in Idaho and you all the sudden have 6 more processes running on your system and your registry has been altered many times.

radbag · Post by **radbag** » Fri Jul 24, 2009 3:04 pm

if you have it, would you typically run slower as a result?

TheTodd · Post by **TheTodd** » Fri Jul 24, 2009 6:56 pm

It's possible. Run this:

http://housecall.trendmicro.com/