[Latest] Possible Infection

[Bas]

Unfortunally, I bashed my registry till that I am not longer able to scan with Ad-Aware or Spybot without getting a crash.

But luckily, I can’t remeber that pages have poped up, PLUS, I am using NoScript (Paranoia!!) - And it saved me, I guess.

(But however, I got a “Out Of Range” crash again, but since I have this for…some weeks, I guess it is because of my Registry, HDD or RAM)

[FriendlyFire]

NoScript saved you. The whole thing was an iframe which had an incomplete address. On page execution, a small javascript would complete the script if a counter was set to a certain value. That means not everyone who visited the page have been infected and anyone with disabled Javascript would not have been infected.

[Trent]

Did it ask you to download & execute a file or did it use some browser flaw to do a drive by attack that didn’t require user interactions?

[Worfeh]

It was a flash thing, so allmost anyone with the flash plugins enabled could be infected.

[cheeseontoast]

im not infected lol

[Tunicle]

It may be worth listing which programs detect the infection.

From above so far I guess Spybot does.

English version of above rootkit revealer
http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx

[Worfeh]

Avast and Avira do to.

[Chips]

Was it an issue to do with Joomla being out of date or an addon likewise being insufficient?

[Worfeh]

Our version is not out of date and we run the latest patches, but still … we have an idea what caused it, we don’t know exactly witch bothers me somewhat.

[M0tah]

Was *nix vulnerable as well, or was it Windows only?

[Worfeh]

Windows only.

I found out what it whas after i booted up in Linux and it started to ask me stuff about installing crap.