myMPxPlayer.org
MyMPxPlayer.org has now moved to
MyMPx.org
     
Home • Forum • Downloads • Gallery/Photos • Check your PM • Log in
         
Board Navigation
Go to the homepageHome
Index of the forum.Forum
Downloads
View uploaded imagesGallery/Photos
Check articles uploaded to the websiteKnowledge Base
Links CategoriesLinks
Donate to myMPxPlayer.orgSupport Us

Search through forums.Search Site
Search through downloadsSearch Downloads

Frequently Asked Questions.FAQ
Read the rules of this websiteRules
View website statisticsStatistics
See who is online at this time.Online Users
Members of our staffStaff

Advertisement

Chatbox

There are 0 user(s) on chat now:

[ Login to join chat ]


Virus problem on MyMpxPlayer site ?!? Question
Post new topic

Reply to topic
 
Author Message
knob
MPx-a-lolics Anonymous
MPx-a-lolics Anonymous

United Kingdom European Union
PostPosted: Sat Nov 22, 2008 10:15 am   Post subject: Fight Virus problem on MyMpxPlayer site ?!? Question Back to top 

There seems to be a virus disguised as a .pdf opening when I access the Mympxplayer site. Shocked

My AVG antivirus at home is not showing any problems but when I tried to access this site from work Symantic flagged it up and quarantined as a bloodhound type with a .pdf extension. Shocked

Has anyone else noticed this? Has anyone else found that adobe reader opens up briefly each time you access this site? Question

I will post a copy of the virus log when I can get hold of it

_________________
-----------------------------------------------------------------------------------------------------------
Download Post  No rating  
Th3_uN1Qu3
MPx-a-lolics Anonymous
MPx-a-lolics Anonymous

Romania European Union
PostPosted: Sat Nov 22, 2008 2:51 pm   Post subject:   Back to top 

I don't have Adobe Reader, never will. Foxit Reader FTW.

Also, Norton is a rather poor antivirus, not to mention it's a major resource hog. I haven't experienced any problems while visiting this site, just that it's slow as always.

_________________
For my dreams i hold my life...

MEIZU M6SL Cool <> black <> 4GB <> 2.4 inch TFT <> Touchpad <> XviD 20FPS <> 25 hours battery (music) <> Wolfson DAC Very Happy <> Sony earbuds
Resigned: SigmaTel STMP3504 <> 2GB <> 1.5 inch TFT
Bye-bye Actions! (at least for now)
Download Post  No rating  
Hotboxx
MPx Junkie
MPx Junkie

Belgium
PostPosted: Sat Nov 22, 2008 5:15 pm   Post subject:   Back to top 

There must be something wrong, when I opened this website I was also offered to download/open a PDF file.

Download Post  No rating  
makd511
MPx-a-lolics Anonymous
MPx-a-lolics Anonymous

United Kingdom UK England
PostPosted: Sat Nov 22, 2008 7:58 pm   Post subject:   Back to top 

mm, not me, i am using firefox, are you lot IE??

Download Post  No rating  
knob
MPx-a-lolics Anonymous
MPx-a-lolics Anonymous

United Kingdom European Union
PostPosted: Sun Nov 23, 2008 2:55 am   Post subject:   Back to top 

Theres something fishy, I'm on Opera, and no Th3_uN1Qu3, I'd too wouldn't touch Norton's, I'll give Foxit a try, you're right, acrobat is a memory pig Wink

I just happened to notice as my employer uses Norton's.

Removed Adobe, i'm on Foxit now (It's great BTW)

Now when I'm enter this site I get an offer to download/open file "pdf.pdf"
using Foxit from site "klickup.com"
.
You know, as the ancient computer saying goes "when the admin's away the spambots and virusus play". Shocked

_________________
-----------------------------------------------------------------------------------------------------------
Download Post  No rating  
Hotboxx
MPx Junkie
MPx Junkie

Belgium
PostPosted: Sun Nov 23, 2008 5:41 am   Post subject:   Back to top 

makd511 wrote (View Post): ›
mm, not me, i am using firefox, are you lot IE??


I use FF also

Download Post  No rating  
lolita
MPx-a-lolics Anonymous
MPx-a-lolics Anonymous

China
PostPosted: Sun Nov 23, 2008 7:53 am   Post subject:  Re: Virus problem on MyMpxPlayer site ?!? Question Back to top 

No problem here.

Using IE6.

_________________
I am no longer affiliated with Actions Semiconductor Co. Ltd. Do not ask me for firmware.
Download Post  No rating  
Th3_uN1Qu3
MPx-a-lolics Anonymous
MPx-a-lolics Anonymous

Romania European Union
PostPosted: Sun Nov 23, 2008 8:06 am   Post subject:   Back to top 

Opera here too, no random PDFs popping up... I'll investigate that site see what it's about.

Edit:

Quote: › Server Type: Apache/2.2.3 (CentOS)
IP Address: 70.38.25.62
IP Location: California - Santa Ana - Adverttraffic
Response Code: 200
Domain Status: Registered And Active Website


Looks like an advertising website... Maybe that's where all the spambots are coming from? Confused

The website itself looks like this:


Whatever i type in that search box will just return "no results found". Also, trying to access "http://klickup.com/pdf.pdf" results in a 404 not found. Could you tell me exactly the path that the bogus PDF file is coming from? I'd like to take a look.

_________________
For my dreams i hold my life...

MEIZU M6SL Cool <> black <> 4GB <> 2.4 inch TFT <> Touchpad <> XviD 20FPS <> 25 hours battery (music) <> Wolfson DAC Very Happy <> Sony earbuds
Resigned: SigmaTel STMP3504 <> 2GB <> 1.5 inch TFT
Bye-bye Actions! (at least for now)
Download Post  No rating  
knob
MPx-a-lolics Anonymous
MPx-a-lolics Anonymous

United Kingdom European Union
PostPosted: Mon Nov 24, 2008 2:19 pm   Post subject:  Re: Virus problem on MyMpxPlayer site ?!? Question Back to top 

I got it wrong, the site is called klikvp.com Embarassed , it's still happening though, usually just once when I first enter the site :-


_________________
-----------------------------------------------------------------------------------------------------------
Download Post  No rating  
Th3_uN1Qu3
MPx-a-lolics Anonymous
MPx-a-lolics Anonymous

Romania European Union
PostPosted: Mon Nov 24, 2008 4:32 pm   Post subject:   Back to top 

Alright, hang on while i trace it.

Edit:

Quote: › Server Type: Apache/2
IP Address: 195.24.78.242
IP Location: Luxembourg
Response Code: 200
SSL Cert: localhost expires in 9866 days.
Domain Status: Registered And Active Website


I accessed the site and it is a "pay per click search engine". That is, yes, MORE ADS. But klikvp.com/pdf.pdf doesn't exist either, nor does klikvp.com/pdf_1_~1.pdf. Again, please post the full path where that PDF is coming from.

Edit: More info:
http://mtekk.weblogs.us/archives/enemy-of-the-spammers/klikvpcom-exploite/
http://www.coolsmartphone.com/news4321.html

Sounds like a spammer with bad intentions, using SQL injection. We must do something about it. Right now i'm doing more scans of the server, looking for ways to "spam the spammer".

_________________
For my dreams i hold my life...

MEIZU M6SL Cool <> black <> 4GB <> 2.4 inch TFT <> Touchpad <> XviD 20FPS <> 25 hours battery (music) <> Wolfson DAC Very Happy <> Sony earbuds
Resigned: SigmaTel STMP3504 <> 2GB <> 1.5 inch TFT
Bye-bye Actions! (at least for now)
Download Post  No rating  
knob
MPx-a-lolics Anonymous
MPx-a-lolics Anonymous

United Kingdom European Union
PostPosted: Mon Nov 24, 2008 5:28 pm   Post subject:   Back to top 

Couldn't find the path, its seems to be coming straight from klikvp.com.


_________________
-----------------------------------------------------------------------------------------------------------
Download Post  No rating  
Th3_uN1Qu3
MPx-a-lolics Anonymous
MPx-a-lolics Anonymous

Romania European Union
PostPosted: Mon Nov 24, 2008 5:34 pm   Post subject:   Back to top 

Well, that's the typical download dialog, the full path isn't shown. Strange thing is that i'm still not getting it.

One thing you could do is save it (must be Save not Open, you don't wanna open it anyway), then look at the Transfers tab. Select it with your mouse and look at the bottom, it'll display the path.

_________________
For my dreams i hold my life...

MEIZU M6SL Cool <> black <> 4GB <> 2.4 inch TFT <> Touchpad <> XviD 20FPS <> 25 hours battery (music) <> Wolfson DAC Very Happy <> Sony earbuds
Resigned: SigmaTel STMP3504 <> 2GB <> 1.5 inch TFT
Bye-bye Actions! (at least for now)
Download Post  No rating  
knob
MPx-a-lolics Anonymous
MPx-a-lolics Anonymous

United Kingdom European Union
PostPosted: Mon Nov 24, 2008 5:42 pm   Post subject:  Re: Virus problem on MyMpxPlayer site ?!? Question Back to top 

Got the sucker, the path is -http://klikvp.com/xxx/xxx/pdf.pdf-
here's the contents of the .pdf just 3.17k.

Quote: › content deleted.


I can make it popup if I reboot my router so I get a different ip address, then it "thinks" I'm another user.
(btw I reboot my router every day so maybe that's why I get it coming up more often)


Last edited by knob on Wed Nov 26, 2008 12:44 pm; edited 2 times in total

_________________
-----------------------------------------------------------------------------------------------------------
Download Post  No rating  
Th3_uN1Qu3
MPx-a-lolics Anonymous
MPx-a-lolics Anonymous

Romania European Union
PostPosted: Tue Nov 25, 2008 2:11 pm   Post subject:   Back to top 

I have a static IP, maybe that's why it never comes up for me.

That looks like a lame javascript exploit. Can't understand what it does really, but Foxit seems unaffected by it, it just opens a blank page and no modifications are made to the system. Tested in a virtual machine running XP SP2.

_________________
For my dreams i hold my life...

MEIZU M6SL Cool <> black <> 4GB <> 2.4 inch TFT <> Touchpad <> XviD 20FPS <> 25 hours battery (music) <> Wolfson DAC Very Happy <> Sony earbuds
Resigned: SigmaTel STMP3504 <> 2GB <> 1.5 inch TFT
Bye-bye Actions! (at least for now)
Download Post  No rating  
admin
Site Admin
Site Admin

New Zealand
PostPosted: Tue Nov 25, 2008 9:00 pm   Post subject:   Back to top 

Thanks everyone for your help into looking at this.

I don't get the pop up though.
I also checked it from computers in Cambodia during my holiday and didn't see the popup to download the pdf file either.

I'm using IE 7 with Acrobat.

I'll do some searching and find out WHY it's happening....

_________________
Thanks,
Binh (admin)

MyMPxPlayer.org has now moved to MyMPx.org
Download Post  No rating  
Sponsored Links
Display posts from previous:      
 


 Jump to:   

  View previous topic View printer-friendly version Search Display number of posts for each poster in this topic Export topic thread to a text file View next topic

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum



Protected by phpBB Security phpBB-Amod :: phpBB Security ©  Has Blocked 229,168 Exploit Attempts.
Site running IntegraMOD with phpBB :: FI Theme :: All times are GMT - 4 Hours ]
[Page generation time: 0.4073s (PHP: 57% | SQL: 43%) | SQL queries: 163 | GZIP enabled | Debug off]

MyMPxPlayer.org hosted by Webair.