Google redirect virus

[mitchntx]

And everything points to this site is the place I got it.

It started yesterday when an Adobe Acrobat update popped up. It got past ESET NOD32, AdAware and Spy-Bot.

The log files pointed to www.aicmctexas.com/ ... and then some long alpha-numeric string.

The symptoms were a re-direct after clicking a link brought up by Google. And then it began just sucking down resources until the machine locked up.

The bad thing is it affected ALL the major search engines. So it made finding a fix difficult to nail down. I wound up having to hover the mouse over the link and the actual address was shown in the status line at the bottom of the window. I wrote it down and manually typed it in and it would go t the site.

But, after about 3 or 4 minutes, the machine would lock and would require a complete power off and reboot.

I finally found a dozen or so recent posts of where Hitman 3.5 was able to eradicate the trojan. And it took 3 attempts.

Merry Freaking Christmas ...

Hitman 3.5 was a free download and a 30 free trial.

Just an FYI ...

[David Love AI27]

some guy sent me a message on Facebook a couple of days ago that my virus protection picked up... I hope I didn't infect you with my PMs... I haven't had any problems here but it might have been a trojan horse... I'll have my puter checked after Christmas...

[mitchntx]

I don;t think it came through via PM.

I think it was probably one of the attachments I DLed.

[Alien]

Of note, at my work (which already has a fairly strict electronic security policy; don't try say "shit" in an e-mail :roll: ) aicmctexas.com is now blocked as being a malicious website. Now what am I supposed to do all day?

[David Love AI27]

don't say "shit" in an e-mail

How about "talkin" shit??

[kbrewmr2]

Of note, at my work (which already has a fairly strict electronic security policy; don't try say "shit" in an e-mail :roll: ) aicmctexas.com is now blocked as being a malicious website. Now what am I supposed to do all day?

my company is a bit more open, same deal... you guys get "websensed" now. Fix it, get in contact with Websense to let them know its fixed, and it should get changed

[mitchntx]

Firefox now shows this site to be a malicious site and blocks it.

I'm sure it will be so from work.

This is what Google is saying about AICMCTexas.com.

If we're looking to grow, this needs to be ddressed.

[Todd Covini]

See!!?? I told you all that negative energy posting was going to drive people away!! Now someone brought a Trojan horse into our mix! :D

This would never have happened if we all kept our rose colored glasses on and just kept sipping our Kool-Aid. Sheesh. I tell ya...

http://www.southdacola.com/blog/wp-content/uploads/2009/09/rose_colored_glasses.jpg

[j3ffbrooks]

It seems a virus was uploaded through a module on the main site which then installed a script into each folder. I've gone through and deleted the script as well as closed the holes in the main site.

I've also contacted Google and taken the steps to get the site taken off the blacklist. Seems to be working this morning.

Sorry for the inconvenience.

JB

[Boudy]

Thanks Jeff.

Boudy

[Rob Liebbe]

Yep, thanks Jeff.

[mitchntx]

A little more information ....

Apprently this little beggar, along with a few others, exploits a JAVA hole in the recent versions of Adobe Acrobat and Adobe Acrobat Reader.

If you are getting notices about updating Acrobat Reader ... DON'T do it till Adobe patches the holes.

If you have updated to v8 (I think), do this ... regardless of which version, do this.

open up any adobe PDF file.

Select Edit
Select Preferences

In the Preferences menu window, highlight

JavaScript

and uncheck the "Enable Acrobat JavaScript" check box.


This should keep you relatively safe.

[Al Fernandez]

Thank you Jeff!!! :D

[kbrewmr2]

still websensed as "malicious" but I can at least read at home now

[AllZWay]

Here is a link to more about the Google virus story for those tech geeks that like to read this kind of stuff.

This is very interesting and scary stuff.

http://www.downloadsquad.com/2010/02/04/jaw-dropping-and-life-changing-details-about-the-china-versus-go/

http://www.wired.com/threatlevel/2010/02/apt-hacks/

[mitchntx]

The boot sector of my system drive was corrupted.

It was ugly.

[cjlmlml]

The boot sector of my system drive was corrupted.

It was ugly.


Mitch, nobody cares.


Best Wishes,

Your Good friend,

CL

[mitchntx]

The boot sector of my system drive was corrupted.

It was ugly.


Mitch, nobody cares.


Best Wishes,

Your Good friend,

CL

Just because you are getting zero sleep and will be 65 when she graduates high school doesn't mean you have to take out your anger on "your good friends".

I'm here for you, Chrissie ...

[David Love AI27]

The boot sector of my system drive was corrupted.

It was ugly.

What were the symptoms?... mine is running slower and takes longer to boot up...

[mitchntx]

The boot sector of my system drive was corrupted.

It was ugly.

What were the symptoms?... mine is running slower and takes longer to boot up...

After about 10 minutes the system would lock.
A tremendous amount of HD activity.

[Todd Covini]

Yup....I got it too.

[ShadowBolt]

I went to read Al's event report and my anti-virus caught the same thing as it did when this was around. I'm not a computer guy (I can just turn it off and on) but I know it said the same thing as last time. Good luck.


JJ