Infection threat?

[catteeclan]

Every time I sign in here Nod32 is popping up with a threat warning.

http://koren.in/x/midi.jar 1955 OSX/Exploit.Smid.B.trojan
http.//koren.in/x/pdfnew.php?src=tb&id=766 1464 PDF/Exploit.gen trojan
Both these infections came up this morn.
First couple of tries to get on this morning came back with page not valid?

[ian porter]

thanks

It's something we're aware of and Dave is looking into it as we speak.

Ian

[Lumiya]

The admin are already aware of the issue and it's being looked into. More info as we find it. If though the virus checker has found it it means you are safe and looking at the age of the exploit all virus scanners will catch it..

[DaveS]

I still haven't got to the bottom of how this happened yet but I have found the infection and I have cleaned it.

I am still investigating though to get to the bottom of what's happened.
What I do know is that the site was targeted between 06:00 - 08:30 this morning which then resulted in the templates that are used being compromised.

Just a plea from me though to ensure that you have antivirus software loaded and that is kept up to date on your pc. It is absolutely essential in this day and age.

[Wee Jack]

When I tried to logon to XRV this morning from my work laptop a nasty hit my machine disguised as "Security Tool" very professional looking page and it looked like it was running a virus scan but it was running far too fast for a virscan program so I knew it was a scam, however - and here is the sneaky bit - when I closed it down with the regular click on the red cross on the top right hand side of the page , my machine died - I could not access anything. I have just had a total wipe and rebuilt of my system. The experts here ( I work for the largest global player in the IT industry!! yes that one !!!) say that it was particularly sneaky and the "run" button was hidden behind the "close" button.

Sneaky bastards !! be careful out there folks it's a jungle full of sad little wire pullers who get a kick out of this ****e.

[catteeclan]

Shame they don't put their expertise into something more constructive.

Wasn't sure if you mods knew about it is the only reason I posted. (Thanks for putting it in the right place).

[Sharribee]

Better to post up just in case we haven't noticed it, some of us were getting problems and some not so your heads up was really important

Thank you

[Lumiya]

Yep.. (btw you're welcome as I moved it )

If anyone experiences a major problem or has a virus/security warning when accessing xrv then they should ethier post in this forum, use the contact us link (found at the bottom of every page) or if need be email the admin (a d m i n @ x r v . o r g . u k)

Even if we already know about it a simple report can give us more and perhaps crucial information to cure it faster.

Thanks everyone from the Admin

[Steve T]

My experience this morning . . .
The PC at work threw up a virus threat at about 8.30am. bo.heap was the name that I remember from the report that was generated after I "popped" onto xrv. The machine had a bit of a hissy fit but after a shut down, pause with power off, re-start, it started playing again.

[DaveS]

When I tried to logon to XRV this morning from my work laptop a nasty hit my machine disguised as "Security Tool" very professional looking page and it looked like it was running a virus scan but it was running far too fast for a virscan program so I knew it was a scam, however - and here is the sneaky bit - when I closed it down with the regular click on the red cross on the top right hand side of the page , my machine died - I could not access anything. I have just had a total wipe and rebuilt of my system. The experts here ( I work for the largest global player in the IT industry!! yes that one !!!) say that it was particularly sneaky and the "run" button was hidden behind the "close" button.

Sneaky bastards !! be careful out there folks it's a jungle full of sad little wire pullers who get a kick out of this ****e.

really??? That seems a bit extreme.
I run Kaspersky and it just reported the attempt and that it had blocked it.
Throughout the day I've been back on the page several times to see what was happening and the behaviour of what it was doing. So I've put myself back in the firing line some 20 times before I worked out what was causing it and deleted it.