[Latest] Possible Infection

FriendlyFire

NoScript saved you. The whole thing was an iframe which had an incomplete address. On page execution, a small javascript would complete the script if a counter was set to a certain value. That means not everyone who visited the page have been infected and anyone with disabled Javascript would not have been infected.

Trent

Did it ask you to download & execute a file or did it use some browser flaw to do a drive by attack that didn’t require user interactions?

Worfeh

It was a flash thing, so allmost anyone with the flash plugins enabled could be infected.

cheeseontoast

im not infected lol

Tunicle

It may be worth listing which programs detect the infection.

From above so far I guess Spybot does.

English version of above rootkit revealer
http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx

Worfeh

Avast and Avira do to.

Chips

Was it an issue to do with Joomla being out of date or an addon likewise being insufficient?

Worfeh

Our version is not out of date and we run the latest patches, but still … we have an idea what caused it, we don’t know exactly witch bothers me somewhat.

M0tah

Was *nix vulnerable as well, or was it Windows only?

Worfeh

Windows only.

I found out what it whas after i booted up in Linux and it started to ask me stuff about installing crap.