06.07.2010 20:51:19 HTTP filter file
http://ns1.plumbingfixed.com/main.php?h=marklinciyiz.biz&i=Jc2uiNYUq/igjRj7VsBPwpgXpA==&e=4 JS/TrojanDownloader.FakeAlert.NAC trojan connection terminated - quarantined EvPc\Cakar Threat was detected upon access to web by the application: C:\Program Files\Mozilla Firefox\firefox.exe.
Yukarda virusun tam kodu var.
Biraz inceleyelim bu nedir.
Bir kere bizim forumumuzda bulunan kodlara kendini eklemiş.
Kendisi bir virus değil. Bir trojan. Bizi yukarda yazdığı gibi bir virus olduğuna inandırmak istiyor.
Hemen kendi sitesine yonlendirip bize virusun bilgisayarımıza bulaştığına dair bir goruntu ve cözüm oneriyor.
Çozumu önerirde bizde kabul ettiğimizde bir trojan dosyasını indirip Mail adreslerimizi toplamaya başlıyor.
Demekki ne yapacağız. Kanmayacağız. Virus bulaştı zannedipte onun önerdiğini kabul edip bir şeyler yukletmeyeceğiz.
http://ns1.plumbingfixed.com/main.php?h=marklinciyiz.biz&i=Jc2uiNYUq/igjRj7VsBPwpgXpA==&e=4Yukardaki adresi browdwrimize kopyalayıp entere basalım ve bakalım.
Ekranda kabul ette desek vazgeçte desek bize sanki bize ait bir bilgisayarın virus bulaşmış hali gösteriliyor.
En üstteki yazdığım satırda bunun bir FakeAlert.NAC trojan yani SAHTE ALARM olduğunu belirmiştim.
Siz genede iyi bir virus programı kullanmıyorsanız bunu denemeyin...........
Ben Eser Nod antivirus Business versiyonunu kullanıyorum. Üstüne tanımam. Üstelik AĞAYA BELEŞ..
(Ozelden mesaj beklenir.
)
Buraya kadar anlattıklarım kansere aspirin tedevisi.
Kemoterapi için ne yapabiliriz.
Biz site kullanıcıları olarak iyi bir antivirus programı kullanacağız. Şimdilik.
Benim virus programım uyarmıyor. Bana bulaşmaz gibi kendimizi aladatmayalım.
Benim virüs programım her siteye girdiğimde bu trojanı buluyor ve bloklayıp etkisiz hale getiriyor. Hemde her girişimde.
Biz adminler ve en önemlisi cem tekin adminimin yapması gereken siteyi komple backupla indirip aşağıdaki normal kullanıcıları pek ilgilendirmeyen komplex kodu backupta aratıp temizleyip tekrar server'a geri yuklemeliyiz.
İşte o Muazzam kod.
Lutden bundan sonrasını normal kullanıcılar okumasın mazallah temmuz sıcaklarında adamın beyni buharlaşır.
<span style="color: #000000;">New additions of malicious and rogue sites for June 28, 2010 which may compromise your PC Security. Some may contain ‘driveby’ downloads, trojans, backdoor bots, rootkits, rogue programs (PUP... Show complete text’s) and all are to be considered a threat.</span>
<span style="color: #000000;">Also bear in mind that many of these use ‘fast flux’ techniques and may not resolve as they disappear from one domain and appear on another. These sites could harm your computer so it is advised to keep well away from them or add them to your <a href="
http://www.freepcsecurity.co.uk/2009/01/21/hostsxpert/" target="_blank"><span style="color: #0000ff;">Hosts file</span></a> so that they are blocked.</span>
<span style="color: #000000;">For DNS WildCard domains such as 'xorg.pl' and 'hpg.com.br' consider using using a proxy auto-config (PAC) file, further details can be found at </span><a href="
http://www.SecureMecca.com" target="_blank"><span style="color: #0000ff;">SecureMecca.com</span></a> <span style="color: #000000;">and please take the time to read the articles and further download links are on the site in Zip and 7-Zip format. </span>
<span style="color: #000000;">Downloads are available in French and English:</span>
<a href="
http://www.SecureMecca.com/Downloads/proxy_fr.txt" target="_blank"><span style="color: #0000ff;">French Download click here</span></a>
<a href="
http://www.HostsFile.org/Downloads/proxy_en.txt" target="_blank"><span style="color: #0000ff;">English Download click here</span></a>
<span style="color: #000000;">Changelogs can be found here:</span>
<a href="
http://www.SecureMecca.com/Downloads/pdate.txt" target="_blank"><span style="color: #0000ff;">SecureMecca.com</span></a>
<a href="
http://www.HostsFile.org/Downloads/pdate.txt" target="_blank"><span style="color: #0000ff;">HostsFile.org</span></a>
<span style="color: #000000;">13666.ru
189.107.60.192
64.191.38.165
99.198.96.154
a3xoeerrr.co.cc
aahydrogen.com
alj.2288.org
amring.ru
astramani.ru
bawtsfkincool.fileave.com
bestmediastar.com
brighten.or.kr
bts.microsoftupdateserver.org
business-courses.nl
caravelavelaja.com
ccc.twain329.cn
chocomuffin.com
d.shasanguo.com
dellanoce.it
dkinteriors.co.uk
downloads.mediamade-006.com
gayforyou.interfree.it
ginsdirect.net
gloi.org
glures.com
go-thailand-now.com
greatinstant.net
icibangoua.org
iwatta.com
jonfylling.no
mnobabla.ru
moretds.org
mr-spider.110mb.com
nasasecurityonline.com
nerow.org
ns1.plumbingfixed.com
oncuciftci.net
pewreyt.com
plautdietsch.net
pogoaliceadvance.com
ruskiii.mobi
sexy67.com
shljuhtut.net
solopornvideos.in
t.11ad.com
thegetmedia.com
theowned.net
thewithstyle.com
titledownloads.mediamade-006.com
tucumansoft.com.ar
uk-microsoft.com
update-windows7.com
v.yao63.com
vintmart.com.ng
wannafuckme.co.cc
wildsou.ch
windmatik.com
www1.mysafe14.co.cc
www2.avfor.co.cc
www4.omgomg8.co.cc
xn--bj0bj06e.com
yxwm.3322.org:83
yyycejui.org
zyrel.filosottile.info</span>
<span style="color: #000000;">Removal Tools – ALL are <strong>FREE</strong>:
<a href="
http://www.freepcsecurity.co.uk/2010/06/15/browser/" target="_self"><span style="color: #0000ff;">Browser Redirects, TDSS Rootkits and Malware</span></a><span style="color: #000000;"> - Updated June 2010</span>
<a href="
http://www.bleepingcomputer.com/forums/topic308364.html" target="_blank"><span style="color: #0000ff;">RKill</span></a><span style="color: #000000;"> - use this first - kills many running malware processes which stop security apps running</span>
<a href="
http://www.malwarebytes.org/mbam.php" target="_blank"><span style="color: #0000ff;">Malwarebytes Anti-Malware</span></a>
<a href="
http://www.superantispyware.com/download.html" target="_blank"><span style="color: #0000ff;">SUPERantispyware</span></a>
<a href="
http://www.freepcsecurity.co.uk/2010/04/14/superportable/" target="_blank"><span style="color: #0000ff;">SUPERAntiSpyware Portable</span></a> <span style="color: #000000;">- Great for infected computers, no installation</span>
<a href="
http://www.safer-networking.org/en/download/index.html" target="_blank"><span style="color: #0000ff;">Spybot Search & Destroy</span></a>
<a href="
http://download.cnet.com/A-squared-Free/3000-8022_4-10262215.html" target="_blank"><span style="color: #0000ff;">A-squared Free</span></a>
<a href="
http://www.freepcsecurity.co.uk/2009/09/05/tdss-updated/" target="_blank"><span style="color: #0000ff;">TDSS and Rootkit Removal</span></a>
<a href="
http://www.freepcsecurity.co.uk/2010/04/03/google-redirect/" target="_blank"><span style="color: #0000ff;">Google and search engine redirect</span></a></span>
<span style="color: #000000;">Desktop Hijacks</span>
<a href="
http://www.freepcsecurity.co.uk/2009/08/23/remove-antivirus-pro-and-hijacking-malware/" target="_self"><span style="color: #0000ff;">SmitfraudFix</span></a><span style="color: #000000;"> - click here to read how to use and download link</span>
<span style="color: #000000;">These will be added to the <a href="
http://www.freepcsecurity.co.uk/2010/06/02/june-list/" target="_self"><span style="color: #0000ff;">June List</span></a> and also to the main List of </span><a href="
http://www.freepcsecurity.co.uk/2009/01/16/malicious-sites-0-9/" target="_self"><span style="color: #0000ff;">Malicious Sites</span></a> <span style="color: #000000;">and</span> <a href="
http://freepcsecurity.co.uk/2009/01/16/list-of-known-malicious-sites/#Rogue_programs" target="_blank"><span style="color: #0000ff;">Rogue/Fake Software</span></a> <span style="color: #000000;">at the end of each month.</span>
<p style="clear: both; padding-bottom: 0.25em; text-align: center;"><a title="Bookmark using any bookmark manager!" href="
http://www.addthis.com/bookmark.php" target="_blank"><img src="
http://s9.addthis.com/button2-bm.png" border="0" alt="AddThis Social Bookmark Button" width="160" height="24" /></a></p>
<p style="text-align: center;"><a href="
http://www.mywot.com" target="_blank"><span style="color: #0000ff;">Surf Safer, Surf with WOT - Click Here or the links below</span></a></p>
<p style="text-align: center;"><a href="
http://www.mywot.com/en/download/ie"><img class="aligncenter" title="WOT for Internet Explorer" src="
http://i198.photobucket.com/albums/aa306/cotojo/IE.jpg" alt="Internet Explorer" width="37" height="37" /></a><a href="
http://www.mywot.com/en/download/ie" target="_blank"><span style="color: #0000ff;">Web of Trust for Internet Explorer</span></a></p>
<p style="text-align: center;"><a href="
http://www.mywot.com/en/download/ff" target="_blank"><span style="color: #0000ff;"><img class="aligncenter" title="WOT for Firefox" src="
http://i198.photobucket.com/albums/aa306/cotojo/firefoxlogo.jpg" alt="Firefox" width="33" height="33" />Web of Trust for Firefox</span></a></p>
<p style="text-align: center;"><a href="
https://chrome.google.com/extensions/detail/bhmmomiinigofkjcapegjjndpbikblnp" target="_blank"><span style="color: #0000ff;"><img class="aligncenter" title="WOT for Google Chrome" src="
http://i198.photobucket.com/albums/aa306/cotojo/google-chrome-logo_1.jpg" alt="Google Chrome" width="32" height="31" />Web of Trust for Google Chrome </span></a></p>
<p style="text-align: center;"><span style="color: #0000ff;"><a href="
http://my.opera.com/PH%60/blog/2009/11/13/wot-for-opera"><img class="aligncenter" title="WOT for Opera" src="
http://i198.photobucket.com/albums/aa306/cotojo/opera_logo.jpg" alt="Opera" width="34" height="28" /></a><a href="
http://my.opera.com/PH%60/blog/2009/11/13/wot-for-opera" target="_blank"><span style="color: #0000ff;">Web of Trust for Opera</span></a></span></p>
<a rel="tag" href="
http://technorati.com/tag/Free+PC+Security"><img style="border: 0pt none; vertical-align: middle; margin-left: 0.4em;" src="
http://static.technorati.com/static/img/pub/icon-utag-16x13.png?tag=Free+PC+Security" alt="Free PC Security " /></a><a rel="tag" href="
http://technorati.com/tag/Free+PC+Security"><span style="color: #0000ff;">Free PC Security</span></a>, <a rel="tag" href="
http://technorati.com/tag/Malicious+Sites" target="_blank"><span style="color: #0000ff;">Malicious Sites</span></a>, <a rel="tag" href="
http://technorati.com/tag/Malware+Distribution" target="_blank"><span style="color: #0000ff;">Malware Distribution</span></a>, <a rel="tag" href="
http://technorati.com/tag/Dangerous+Sites" target="_blank"><span style="color: #0000ff;">Dangerous Sites</span></a>, <a rel="tag" href="
http://technorati.com/tag/Rogue+Software" target="_blank"><span style="color: #0000ff;">Rogue Software</span></a>
<a title="Web page security check by Unmask Parasites" href="
http://www.UnmaskParasites.com/security-report/" target="_blank"><span style="color: #0000ff;">Page/Site Security Report</span></a>
Saygılar.
Cem Akar.
