:thumbsup

BarryP: Cool Cool, however the first page of this thread is STILL setting off Avast (I'm thinking due to Smokey's post #46 where he showed the code of the exploit)

-Loki-

Barry I know this is not your fault but to leave the forum for so long with this maleware running just aint funny. I spent a good half a day trying to get this off my comp.

Glad its sorted now

Try it now.

Edit. Just seen what I posted in another thread.

Finally was able to remove this damn thing...looks good so far.

Fucking spyware :321GFY

I was kidding around, did a hard boot from yesterday and it was gone. :winkwink:

This shit happens everywhere. Even on paysites and affiliate programs.


If you are worried about local FTP accounts being compromised (+ the keylogger), try WinPatrol monitoring.

For simpler PDF usage, use Sumatra reader.

Run browsers and software in encrypted sandboxie. As portable versions, if possible.

Don't run your OS by default in administrative mode.

Only turn javascript and flash on, when you fap off to your own tubes :)

Shit happens, thanks for getting it Berry

:1orglaugh:1orglaugh

All is good on page 1 now (hence I can quote now lol)

-Loki-

have you got it removed from your comp now ?

Glad I use NoScript and don't run javascript on GFY.com. I have had no problems because viruses cannot install themselves when you don't run javascript. GFY doesn't require JS (like a good website should not) and therefore, it displays and functions just fine without it.

ImageVenue .com has it now!

http://safeweb.norton.com/report/sho...imagevenue.com

Sorry but all 'good websites' use JavaScript :winkwink:

Is this just today? ... I havent logge don until now seeing this thread first....

Happened to me this morning ... UK time

I rebooted to safe mode and ram Malwarebytes and it fund the infection.My proxy settings in FF were normal. But upon re-boot to normal mode the infection came back twice already and I still cannot get rid of this thing! This is ending up to be a whole day wasted and I had a lot of work to do today!

I wanted to point this out again as i can unfortunately positively confirm that i found this shit injected into some of my sites.. (only those sites are affected, where i saved the account details in my ftp client). I can also confirm that this triggers some sort of "killing mood".

This is what I found in the pdf file:

What FTP client do you use?

i use FileZilla

Have you got IE installed as well cause you should check the proxy settings in that as well

I had to do it twice and also make sure you browsers are shut down when you do the scan

I posted a log of some of the crap which you can remove manually to clean your comp. It wont be exactly the same but it will be similar

Aaaand this: http://pastebin.com/Nz8iVr2M :)

I had a time with it, but finally got mallwarebytes to launch and it found 14 infections. I haven't had any problems since I rebooted...knock on wood.

And yes, you are right what a way to waste allot of time :disgust

I got hit with Antispyware Soft.
I looked up what process were running and narrowed it to uoxottgtssd.exe
I then rebooted in safe mode deleted this file, started normally and had a problem with the proxies after restarting the computer
so I rebooted again and restored my computer back 2 days. Got rid of the damn problem. I ran a couple different scans to make sure It was gone lol

Bloody damn thing. All clear now?!

D'oh got someone in the office. =)

Crossing my fingers that my warning of the exploit late last night means that Kaspersky caught it n all is well. I did see a little box about an adobe error this morning, but nothing more. Almost afraid to reboot. n for me, the warning popped off a top banner on the main page of this forum.

It took effect for me without rebooting I went to login to gfy and about 30 seconds later it popped up installed

So it looks like the exploit is from Adobe [pdf] Reader?

It's a bloated piece of shit and this isn't the first time it has been exploited...

Change to Foxit Reader... you'll never look back...

Agreed.
:thumbsup

ROFL, not surprising one bit.

FoxIt is great, but is / was vulnerable to the latest round of attacks. Just so you know.

I got hit, then contacted ICS, thanx Barry

I have AVAST, no worries, it blocked it

Well that's put a real downer on things! :winkwink: I'd better go update. :error

PS: Vendors who change the look n' feel of their software every other update, suck.

bump for answers, who is getting banned for this stunt?

Anyone running windows deserved to get hit with a virus :2 cents: