Author Topic: Infected website  (Read 6732 times)

0 Members and 1 Guest are viewing this topic.

Lone

  • Guest
Infected website
« on: April 15, 2009, 01:38:47 PM »
Hello, im getting really paranoid about a site i visited

*WARNING* DO NOT CLICK UNLESS YOUR REALLY PROTECTED
It goes along the lines of
*.on.nimp.org
Eg. www(dot)test(dot)on(dot)nimp(dot)org

I was wondering if this has infected my computer?
« Last Edit: April 16, 2009, 05:56:33 AM by Lone »

YoKenny

  • Guest
Re: Infected website
« Reply #1 on: April 15, 2009, 01:45:35 PM »
Welcome Lone.

avast! did its job and prevented the site form loading so nothing is on your system other than in the browser cache that should be cleaned out after you close the browser and with CCleaner or ATF Cleaner:
http://www.ccleaner.com/download <== be sure to un-chect the Yahoo toolbar if you don't want it installed
http://majorgeeks.com/ATF_Cleaner_d4949.html

Lone

  • Guest
Re: Infected website
« Reply #2 on: April 15, 2009, 01:56:37 PM »
oh ok
Cause i was just playing online and and my ping was spiking and thought virus was eating my computers soul
but i want to kno

does that site have virus that wrecks my computer??

Lone

  • Guest
Re: Infected website
« Reply #3 on: April 15, 2009, 01:57:55 PM »
oh and in logs it says VBS:Malware-gen

info??

CharleyO

  • Guest
Re: Infected website
« Reply #4 on: April 16, 2009, 01:30:30 AM »
***

First, please edit your first post to disable the active link to something like ... www(dot)test(dot)on(dot)nimp(dot)org

Also ...

Please download HijackThis from the link below. Do not download HJT to the desktop but instead download it into it's own folder on the hard drive.

Run the program but do not make any fixes and then post the log results using the "copy & paste" method. It will probably take more than one post to be able to get the complete log posted.

OR, you can post it as an attachment to your post by clicking on "Additional Options..." below left of the posting box.  Someone will review your log and then offer help.

http://filehippo.com/download_hijackthis/


***

Offline Tarq57

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3694
  • If at first you don’t succeed; call it version 1.0
Re: Infected website
« Reply #5 on: April 16, 2009, 02:48:50 AM »
Quote
First, please edit your first post to disable the active link to something like ... www(dot)test(dot)on(dot)nimp(dot)org
Man, that's one ugly site!
My eyes, my eyes, arghhh.
Even without the virus, that might be bad enough to set off the webshield, for self-protection.
 ;)
Windows 10,Windows Firewall,Firefox w/Adblock.

rdmaloyjr

  • Guest
Re: Infected website
« Reply #6 on: April 16, 2009, 03:33:52 AM »
Welcome Lone.

avast! did its job and prevented the site form loading so nothing is on your system other than in the browser cache that should be cleaned out after you close the browser and with CCleaner or ATF Cleaner:
http://www.ccleaner.com/download <== be sure to un-chect the Yahoo toolbar if you don't want it installed
http://majorgeeks.com/ATF_Cleaner_d4949.html

OpenDNS blocked it before avast! got a chance to. 8)

Lone

  • Guest
Re: Infected website
« Reply #7 on: April 16, 2009, 05:57:36 AM »
ok

i have added Hijack this log as a attachment

Lone

  • Guest
Re: Infected website
« Reply #8 on: April 16, 2009, 11:23:12 AM »
*bump*

CharleyO

  • Guest
Re: Infected website
« Reply #9 on: April 16, 2009, 11:36:09 AM »
***

An analysis of your HJT log shows the following :

We didn't detect any active process of a firewall on your system. Reasons maybe:
(1.) You are using the windows firewall or a hardware firewall.
(2.) You are using a firewall of an unknown vendor.
(3.) You are using a firewall, but for unknown reasons it is disabled
(4.) You don't use any firewall at all.
We recommend you to use a firewall.

Platform: Windows XP SP2 (WinNT 5.01.2600)
A newer version of service pack is available. Service packs increase the safety of your system. Visit Microsoft's windowsupdate site to download the newest version of the service pack.

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
Unnecessary (deactivated) entry that can be fixed. Related to Windows Live Messenger.
http://www.systemlookup.com/CLSID/3998-HTC_DLL_htc_8_1_0178_00_dll_htc_8_1_0168_00_dll_htc_8_1_01_00_dll.html


Otherwise, a good HJT log.


***

micky77

  • Guest
Re: Infected website
« Reply #10 on: April 16, 2009, 12:01:10 PM »
You have Sandboxie on your pc. If you browsed using SB you would have very little to worry about  ::). There isn,t a site on the net i would worry about, if I was sandboxed

Pedro Hin

  • Guest
Re: Infected website
« Reply #11 on: April 16, 2009, 01:41:01 PM »
You have Sandboxie on your pc. If you browsed using SB you would have very little to worry about  ::). There isn,t a site on the net i would worry about, if I was sandboxed
I don't understand how Sandboxie does this. Running a browser underSandboxie, let's say I visit a malicious site and click [OK] for my free, but malicious scan.

This scanner, as we all know will do any number of things from replacing (for example) userinit.exe, modify registry entries, maybe install a file as a critical system driver set to start even when windows starts in safe mode. If this malicious application loads, and does all of these things, does sandboxie keep it ALL contained without exception?

micky77

  • Guest
Re: Infected website
« Reply #12 on: April 16, 2009, 02:23:04 PM »
You have Sandboxie on your pc. If you browsed using SB you would have very little to worry about  ::). There isn,t a site on the net i would worry about, if I was sandboxed
I don't understand how Sandboxie does this. Running a browser underSandboxie, let's say I visit a malicious site and click [OK] for my free, but malicious scan.

This scanner, as we all know will do any number of things from replacing (for example) userinit.exe, modify registry entries, maybe install a file as a critical system driver set to start even when windows starts in safe mode. If this malicious application loads, and does all of these things, does sandboxie keep it ALL contained without exception?

Have a read of the FAQ http://www.sandboxie.com/index.php?FrequentlyAskedQuestions especially the part ' How does Sandboxie protect me, technically? '

Not all programs will run sandboxed. Quote "  Sandboxie also prevents programs executing inside the sandbox from loading drivers directly. It also prevents programs from asking a central system component, known as the Service Control Manager, to load drivers on their behalf. In this way, drivers, and more importantly, rootkits, cannot be installed by a sandboxed program. "

Also there is a possibility that malware can read sensitive info on your pc. In the paid version programs can be forced to open sandboxed, and internet access allowed to only certain programs. So that malware inside the box cannot transmit data.
Remember nothing is 100% bullet proof. There is a discussion ongoing that Comodo firewall is actually able  to pull a file out of a sandbox, infecting the pc. Although this has not been proven.
Some people on wilders have tested some nasty stuff sandboxed, as far as i am aware nothing escaped. ( yet  ;D )
« Last Edit: April 16, 2009, 02:29:29 PM by micky77 »

Lone

  • Guest
Re: Infected website
« Reply #13 on: April 16, 2009, 03:10:06 PM »
actually, i have but dont kno how the hell to use it

YoKenny

  • Guest
Re: Infected website
« Reply #14 on: April 16, 2009, 10:22:39 PM »
You have Sandboxie on your pc. If you browsed using SB you would have very little to worry about  ::). There isn,t a site on the net i would worry about, if I was sandboxed

Would You Build Your House on Sand? http://ezinearticles.com/?Would-You-Build-Your-House-on-Sand?&id=1912885

SP3 has been available for almost a year that has several Critical Security Updates but you need to disable or un-install Sandboxie to install the updates.

In IE go to Tools then Windows Updates and install all updates.

Go to Control Panel then Automatic Updates then select Automatic (recommended) or at least select Notify me but do not download or install them.