help with a trojan

santer_2

You could e-mail and explain you cannot get the site, ask if he will e-mail you when the site is repaired

DavidWGordon@verizon.net

Nothing stops me going there with 3 browsers?

waddler_8

Trying to visit the site using Opera gives a malware site warning, due to:

http://www.avgthreatlabs.com/sitereports/domain/abeforum.com

santer_2

Bit odd that only one of four browsers sees anything wrong, clicked ignore this warning and it went to the site, the anti virus didn't pop up, nor did the real time malware scanner, though am running full scans now

jamespir

its the ads on the site sometimes can cause the avast to go loopy

waddler_8

Seems like it's being cleaned up...

The Abe Forum will likely be down until sometime during the day on Thursday, the 29th at the soonest (US, East Coast time). I am working with support on our forum software to get the reply function back, and with another firm to take care of the alerts that some of us were getting. I expect this will all be cleared up soon, but until then, come check out The Abe Forum on Facebook.

waddler_8

It's back online.

The problems started with them not using up to date forum software. This was able to be hacked and a malicious javascript inserted.

This obfuscated javascript silently redirected visitors to a .php script hosted on another site (feedurbrain.com). The last time I looked, the .php script was 404'ing for me. Which is probably why when some of you visited, although Avast warned about the Javascript (JS:Redirector) - nothing more happened.

By the looks of things the .php script made a further redirection to a domain hosting the Blackhole Exploit kit. From there a number of exploit attempts are made against - amongst others - Windows itself, Browsers (IE & Firefox), Adobe products (Flash, Reader), Java Runtime etc. Should a vulnerability be found, then malware would have been downloaded and executed on your computer.

In my case an attempt to exploit the (patched) vulnerability in Help and Support Center (MS10-042) enabled me to get the file.
The file I managed to get hold of initially was later confirmed by Microsoft to be PWS:win32/Zbot

https://www.microsoft.com/security/portal/Submission/SubmissionHistory.aspx?SubmissionId=8ef2b52b-1363-44e2-b526-cdc2ab6d69a1&n=1

PWS:Win32/Zbot is a password-stealing trojan that monitors for visits to certain Web sites. It allows limited backdoor access and control and may terminate certain security-related processes.

Note the VirusTotal report (post #3) - Only 5 Anti-viruses were able to detect in initially - Almost none of the more popular AV's detected it at first.

It wasn't only the Abe Forum affected. Others were affected too.

Looking around, I'm dismayed by the number of people that ignored the warnings and attempted to visit the site, and those who actually turned off their security to visit the site - despite the warnings - because it wouldnt let them visit at all.

No wonder people get infected.

RussJK

Perhaps the others who visited the site also knew what they were doing.

RussJK

There are ways to test suspected sites without directly accessing them with a browser, e.g. a service like Wepawet:
http://wepawet.iseclab.org/

The advantage of this service is that it'll show exactly what outbound URLs are produced from the script, without us having to deobfuscate anything ourselves. OTOH it doesn't always correctly label a link as malicious when it in fact is (sometimes if the site can't be accessed for some reason), so you need to know what you're looking for. After awhile it's easy to guess exactly what exploit it's linking to, as the URLs hidden in the obfuscated script tend to be written uniformly, e.g. "example.com/index.php?tp=001245676ea" is pretty much going to be a Blackhole Exploit Kit.

Or to look at the code directly with Malzilla, which has tools to deobfuscate the script:
http://malzilla.sourceforge.net/

I'm fairly confident that both Santer and Dogmary would have been using sandboxie with appropriate restrictions when accessing the sites though.

For some reason I see a lot of Blackhole Exploit Kits on infected UK sites, usually for local businesses. Probably as Waddler suggested for this one, poorly maintained sites using older (exploitable) software.

santer_2

I have this as well, if something were to get on then threatfire stops it doing anything, that's the theory

http://www.threatfire.com/

When it does pop up for something, I leave the box unticked for remember the option, just in case a programme with access wants to use it for any other reason

waddler_8

waddler_8 wrote: »

Looking around, I'm dismayed by the number of people that ignored the warnings...

RussJK wrote: »

Perhaps the others who visited the site also knew what they were doing.

RussJK wrote: »

I'm fairly confident that both Santer and Dogmary would have been using sandboxie with appropriate restrictions when accessing the sites though.

I was referring more to the members of the affected forums than anyone on here. From the comments some obviously didn't know what they were doing and ended up infected because of it.

It doesn't help when the site admins don't know what's going on. The Abe Forums admin "There is no threat to anyone's computer. The forum is only text and pictures." suggests he didn't have a clue or didn't want to admit it - that helps no-one.