I think there is a trojan horse injected here

[Chugi]

[SLIDE]http://lulzimg.com/i22/8845f6.jpg[/SLIDE]


[SLIDE]http://lulzimg.com/i22/2b21e1.jpg[/SLIDE]

the thread is this:

ThemaPoster - Ultimate Tutorials

 

[SuicidalMedia]

HttpFox shows nothing here...

 

[cgworld]

it could be your browser !!

 

[Chugi]

happens only on this page mate..i dunno

 

[soft2050]

happens only on this page mate..i dunno

mate, download the file

Dont execute it

And check the referrer info.

What is it?

Is it same in all other browsers too.

 

[SuicidalMedia]

Actually, it does.. It gives me NS_BINDING_ABORTED for those "dropbox.com" images...

 

[Ashleyuk1984]

I'm not finding any downloadable content on that page? Bit strange, might be just your own system ? :-(

--- edit ---

Interesting find Jason.

 

[SuicidalMedia]

It's definitely not his system, just check out in HttpFox screenshot how dropbox.com redirects to that IP from Israel, that's actually hosting the trojan.

 

[Lifetalk]

It's clean. Checked the http headers, nothing out of the ordinary. It's more than likely your own system.

EDIT: Dropbox images are clean, too.

 

[Chugi]

Lifetalk, when i go to the images url it redirects me to those files...

find it hard to believe it is only me...dunno :S

 

[Lifetalk]

Probably DNS poisoning, which is why YOU are getting redirected, and not us.

Try it via a proxy.

 

[Dom]

looks clean from here.

 

[Chugi]

ok, my hosts file has not ben edited, and i also flushed my dns cache..if it is dns poisoning, i guess its from my ISP's dns server..:S

gonna check bout the proxy issue also

 

[Lifetalk]

DNS poisoning does NOT occur at user level. Check it via a proxy, any proxy, and confirm

 

[SuicidalMedia]

DNS poisoning is very possible, but does anyone else have this problem?

 

[Chugi]

Lifetalk, with a proxy I still see the bind in HttpFox but the download popup does not occur.

Does this mean my ISP's DNS server got poisoned? :S
I don't have any forwarders or conditional forwarders..

 

[SuicidalMedia]

@Chugi
You're from Israel too? As the IP with the trojan is from Israel.

 

[Sp32]

Nothing bad being shown from my end.

 

[Lifetalk]

Lifetalk, with a proxy I still see the bind in HttpFox but the download popup does not occur.

Does this mean my ISP's DNS server got poisoned? :S
I don't have any forwarders or conditional forwarders..

Yep, most likely. Maybe wait it out for a few hours or a day and it SHOULD resolve.

 

[SuicidalMedia]

Problem solved, this has nothing to do with WJunction!