Exploit Toolkit Website 33 Attack

I got another attacked as soon as I clicked on the e-mail link to this thread. Once again it was Exploit Toolkit Website 33. What I've read up on it says that the website is loaded with an infected Iframe. Every time that the infected website is visited, a malware program tries to run and exploit your computer for vulnerabilities in Java, Adobe Reader and Adobe Flash Player. Make sure those programs are up to date. If your anti virus is up to date it should block the program from running. If not a password stealing trojan will be launched onto your computer.

Got the Blackhole AVG pop up for the first time today myself
I run Firefox and have yet to load the 24.0 update due to some screwy acting things the last week or so.

Originally Posted by LauraB

For the 3rd time today, my AVG blocked a threat. Not 4 minutes ago, I clicked on an ad for Bufo alvarius adults posted by a "Bruce Banner" and got the latest threat blocked. I, too, only got the threats here.

Unfortunately, I didn't look closely at the threat, so can't ID ... but I use AVG, Spybot S&D, Malwarebytes and CCleaner, and use all regularly. (Can you call me paranoid? lol)

Everything I've read on the net says that someone, a hacker, has loaded a malware program on Fauna through an infected IFrame that looks to load a password stealing trojan thorough computer programs like Java, Adobe Reader, Adobe Flash Player, etc. For the past 3 days Norton has blocked attacks on my computer every time I login into the main page at Fauna. I also get attacked when I login to respond to this thread. I feel sorry for those who anti virus-software is not up to date as they will get infected.

where did you find the reference Blackhole /Malware and Fauna ?

The distribution is wide spread and pretty much random


http://cve.mitre.org/cgi-bin/cvename...=CVE-2013-0422

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurit yManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114. CVE-2013-0422 covers both the JMX/MBean and Reflection API issues. NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks. NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11. If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue.

Load and run this and see what the Log shows on your system
If you have never used Filehippo,it and its downloads are clean and safe,Ive used them
for many things well over a decade

http://www.filehippo.com/download_hijackthis/

I keep getting flashplayer encountered an error and if I dont hit dismiss quickly it locks up the browser for 1 to 3 min. Only on this site does it happen. Been going on for about a week. None today yet though.

Originally Posted by Snakepliscan

Everything I've read on the net says that someone, a hacker, has loaded a malware program on Fauna through an infected IFrame that looks to load a password stealing trojan thorough computer programs like Java, Adobe Reader, Adobe Flash Player, etc. For the past 3 days Norton has blocked attacks on my computer every time I login into the main page at Fauna. I also get attacked when I login to respond to this thread. I feel sorry for those who anti virus-software is not up to date as they will get infected.

Well, I just had the server people run a scan on my server looking for signs of a hacker or some other form of being compromised and there were no problems found at all. So as best I can tell, my server is clean.

Sorry, but I can't fix something if it's not broken on my end.

Just for the record, here's the log file results of the scan the server techs did:

Hi Rich,

We can confirm that there are no infected files under the server. Please find below the output of server scan.

----------- SCAN SUMMARY -----------
Known viruses: 2676123
Engine version: 0.97.6
Scanned directories: 19219
Scanned files: 868458
Infected files: 0
Data scanned: 48360.62 MB
Data read: 67229.73 MB (ratio 0.72:1)
Time: 11433.293 sec (190 m 33 s)

My AVG hasn't caught anything.....