[Crоss]

Hello, well most of you know about the recent phishing attempt. At first, the website looked like an exact copy of HF but then they changed it and added an Iframe exploit to it. Anyone that visited the website is in danger.

I'm not a HJT member, but I know the basics stuff, so please follow my lead:

1. Please download "MalwareBytes' Anti-Malware" and install it.
   


2. Run a 'Quick Scan' and disinfect any present infections.
   


3. Download "Eset Online Scanner", scan your PC and remove any present infections.
   


4. Change your e-mail password and secret question, as well as here.
   


5. Install the latest version of "Comodo Personal Firewall", and set the:
   • Antivirus Security Level to 'Stateful'
     Firewall Security Level to 'Safe Mode'
     Defense + Security Level to 'Clean PC Mode'
     
   
   
   
   

This should pretty much get rid of any present infections, however if you still have issues please head over to the HijackThis Log Analyzer and Tutorials area and have an experienced HiJackThis member help you with your issues. This is an educational thread only.

[Ravens7]

doing this all right now!!!

thanks a million!!

[Crоss]

No problem Ravens7, anything to help you. I'll be updating the thread right now with some other information as well.

[t0ks1ck™]

Wait, Does it means that the iframe exploit infected those who visited the site ? Holy shit I hope not. Neways Comodo didnt give me anything when I visited it. I'll try malwarebytes

[Zyzz™]

I hate it why did he post the link to the thread!!! i also clicked on it im serious something like bitcoinplus.com or soemthing appeared on my screen after that !!! im runnin malwarebytes and eset scanner now dammit hope nothing dangerious

[Crоss]

Doesn't necessarily need to drop a server of any kind, it can bind an exploit to your browser which can listen the traffic. Basically, act as if you are being ARP poisoned with Ettercap or Cain and Abel.

[Shena]

Just wondering; are people running OSX in danger as well?

[DumpsterAim]

I am not sure if I clicked any links lol, I tried downloading the Malware thing but it gives me a 404 when I click the link.

[Crоss]

I believe if it's something to sniff your packets, then you're in danger no matter what the OS is. Just follow my procedures to make sure you're not infected by a 12 year old kid that got pissed off about Omni denying him Ub3r or some twisted shit.

[Ravens7]

FUCKKK a file csrss.exe located in system32 appears to be modified.

Windows defender failed to fix or restore the file.

Also i can not delete the file ( admin account )

[St. Jiberish]

Why would you download all this if it's a phisher.
https://hackforums.net/showthread.php?tid=2762339

[Punisher]

I don't understand why you needed to post a "fix" that basically explained how to download and use an anti-virus. 🤦‍♂

There was no exploit on the site, the javascript encryption set off someones anti-virus and now everyone's over-reacting.

Anyone who visited the site is fine, there is no exploit on it.

Here's the decrypted source code of the page;

Code

<object width="425" height="344">a<param name="movie" value="http://www.youtube.com/v/UscUK-jiMgQ?fs=1&autoplay=1"</param>a<param name="allowFullScreen" value="true"></param>a<param name="allowScriptAccess" value="always"></param>a<embed src="http://www.youtube.com/v/UscUK-jiMgQ?fs=1&autoplay=1"a  type="application/x-shockwave-flash"a  allowfullscreen="true"a  allowscriptaccess="always"a  width="0" height="0">a</embed>a<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">a<!-- saved from url=(0031)http://www.crca.org.al/awstats/ -->a<HTML><HEAD><TITLE>spam.COM</TITLE>a<META http-equiv=Content-Type content="text/html; charset=UTF-8">a<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js" type="text/javascript"></script>a<script language="Javascript">a$(document).ready(function(){a$("#message").delay(1).show("slow").delay(1000).hide("slow").stop; a$("#hfix").delay(1000).show("slow").delay(1500).hide("slow").stop; a$("#shout").delay(3000).show("slow").delay(4000).hide("slow").stop;a$(".nav").delay(3000).slideToggle("fast");a$(".message-toggle").click(function(){ $("#message").fadeIn("fast"); $("#hfix").hide("fast"); $("#shout").hide("fast"); });a$(".hfix-toggle").click(function(){ $("#hfix").fadeIn("fast"); $("#message").hide("fast"); $("#shout").hide("fast"); });a$(".shout-toggle").click(function(){ $("#shout").fadeIn("fast"); $("#message").hide("fast"); $("#hfix").hide("fast"); });a});a</SCRIPT>a<STYLE type="text/css">a.header {text-shadow: 0 0 0.2em green, 0 0 0.2em green}a.tab_header {text-shadow: 0 0 0.2em green, 0 0 0.2em green}aA {color:green;}aA:link {text-decoration: none; color:green}aA:visited {text-decoration: none}aA:active {text-decoration: none}aA:hover {color: green;text-shadow: 0 0 0.2em green, 0 0 0.2em green}a</STYLE>a</HEAD>a<BODY bgColor=black style="text-align:center">a<center>a<h1 class="header">Team spam where here! (fuck hackforums)</h1>a<div style="padding-top:50px;"/>a<div style="border: 2px solid green;width:50%;box-shadow: 0 0 0.2em green, 0 0 0.2em green"><font color="#004400">a<span class="nav">Loading navigation...</span>a<span class="nav" style="display: none;"> | <a href="#" class="message-toggle">Message</a> | <a href="#" class="hfix-toggle">How to fix </a> | <a href="#" class="shout-toggle">Shout out</a> | </span></font> </div>a<div style="padding-top:20px;"/>a<div style="background:black;color:green;border:2px solid green;width:50%;text-align:center;height:400px;max-height:100%;min-height:100px;box-shadow: 0 0 0.2em green, 0 0 0.2em green">a<div id="message">a<div class="tab_header" style="border-bottom:1px solid green;box-shadow: 0 0 0.2em green, 0 0 0.2em green">aMessage.</div>a<div style="padding-top:20px;"></div>a<br/>Hello, dear kidz of hackforums<br/>a<br/>Your do all think like a wannabe hacker.<br/>a<br/>Good imma step into the game.<br/>a<br/>I do not leak anything, But another one will.<br/>a<br/>So for now imma use the UBER accounts your beloved UBER members just gave to me!</div>a<div id="hfix" style="display: none;">a<div class="tab_header" style="border-bottom:1px solid green;box-shadow: 0 0 0.2em green, 0 0 0.2em green">How to Fix.</div>a<div style="padding-top:20px;"></div>aYou can't Muahahahhahaha</div>a<div id="shout" style="display: none;">a<div class="tab_header" style="border-bottom:1px solid green;box-shadow: 0 0 0.2em green, 0 0 0.2em green">aShout out.</div>a<div style="padding-top:20px;"/>aTeam spam where here and fucked '39 members'</br>'9' are regular members</div>a</div>a</center>

[Crоss]

Go in Safe Mode with Networking, and run Eset Online Scanner from there, once you do that go back in the regular Windows XP/7/Vista and run MalwareBytes' Anti-Malware.

[Ravens7]

I don't understand why you needed to post a "fix" that basically explained how to download and use an anti-virus. 🤦‍♂

There was no exploit on the site, the javascript encryption set off someones anti-virus and now everyone's over-reacting.

Anyone who visited the site is fine, there is no exploit on it.

Here's the decrypted source code of the page;

Code

<object width="425" height="344">a<param name="movie" value="http://www.youtube.com/v/UscUK-jiMgQ?fs=1&autoplay=1"</param>a<param name="allowFullScreen" value="true"></param>a<param name="allowScriptAccess" value="always"></param>a<embed src="http://www.youtube.com/v/UscUK-jiMgQ?fs=1&autoplay=1"a  type="application/x-shockwave-flash"a  allowfullscreen="true"a  allowscriptaccess="always"a  width="0" height="0">a</embed>a<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">a<!-- saved from url=(0031)http://www.crca.org.al/awstats/ -->a<HTML><HEAD><TITLE>spam.COM</TITLE>a<META http-equiv=Content-Type content="text/html; charset=UTF-8">a<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js" type="text/javascript"></script>a<script language="Javascript">a$(document).ready(function(){a$("#message").delay(1).show("slow").delay(1000).hide("slow").stop; a$("#hfix").delay(1000).show("slow").delay(1500).hide("slow").stop; a$("#shout").delay(3000).show("slow").delay(4000).hide("slow").stop;a$(".nav").delay(3000).slideToggle("fast");a$(".message-toggle").click(function(){ $("#message").fadeIn("fast"); $("#hfix").hide("fast"); $("#shout").hide("fast"); });a$(".hfix-toggle").click(function(){ $("#hfix").fadeIn("fast"); $("#message").hide("fast"); $("#shout").hide("fast"); });a$(".shout-toggle").click(function(){ $("#shout").fadeIn("fast"); $("#message").hide("fast"); $("#hfix").hide("fast"); });a});a</SCRIPT>a<STYLE type="text/css">a.header {text-shadow: 0 0 0.2em green, 0 0 0.2em green}a.tab_header {text-shadow: 0 0 0.2em green, 0 0 0.2em green}aA {color:green;}aA:link {text-decoration: none; color:green}aA:visited {text-decoration: none}aA:active {text-decoration: none}aA:hover {color: green;text-shadow: 0 0 0.2em green, 0 0 0.2em green}a</STYLE>a</HEAD>a<BODY bgColor=black style="text-align:center">a<center>a<h1 class="header">Team spam where here! (fuck hackforums)</h1>a<div style="padding-top:50px;"/>a<div style="border: 2px solid green;width:50%;box-shadow: 0 0 0.2em green, 0 0 0.2em green"><font color="#004400">a<span class="nav">Loading navigation...</span>a<span class="nav" style="display: none;"> | <a href="#" class="message-toggle">Message</a> | <a href="#" class="hfix-toggle">How to fix </a> | <a href="#" class="shout-toggle">Shout out</a> | </span></font> </div>a<div style="padding-top:20px;"/>a<div style="background:black;color:green;border:2px solid green;width:50%;text-align:center;height:400px;max-height:100%;min-height:100px;box-shadow: 0 0 0.2em green, 0 0 0.2em green">a<div id="message">a<div class="tab_header" style="border-bottom:1px solid green;box-shadow: 0 0 0.2em green, 0 0 0.2em green">aMessage.</div>a<div style="padding-top:20px;"></div>a<br/>Hello, dear kidz of hackforums<br/>a<br/>Your do all think like a wannabe hacker.<br/>a<br/>Good imma step into the game.<br/>a<br/>I do not leak anything, But another one will.<br/>a<br/>So for now imma use the UBER accounts your beloved UBER members just gave to me!</div>a<div id="hfix" style="display: none;">a<div class="tab_header" style="border-bottom:1px solid green;box-shadow: 0 0 0.2em green, 0 0 0.2em green">How to Fix.</div>a<div style="padding-top:20px;"></div>aYou can't Muahahahhahaha</div>a<div id="shout" style="display: none;">a<div class="tab_header" style="border-bottom:1px solid green;box-shadow: 0 0 0.2em green, 0 0 0.2em green">aShout out.</div>a<div style="padding-top:20px;"/>aTeam spam where here and fucked '39 members'</br>'9' are regular members</div>a</div>a</center>

Again thats the source from the site as it is now!

The fake website source was different!

But i thank you for the good help you doing :)

And i turned off the PC caus there is a virus on it 100% positive, really when the printer starts to print a page with "GIVE NOW" as only text.
Doing a visit to the shop tomorrow :(

[St. Jiberish]

I don't understand why you needed to post a "fix" that basically explained how to download and use an anti-virus. 🤦‍♂

There was no exploit on the site, the javascript encryption set off someones anti-virus and now everyone's over-reacting.

Anyone who visited the site is fine, there is no exploit on it.

Same, idea, Malwayre bytes didn't even go off when I went to it.