Virus problem on MyMpxPlayer site ?!? :?:

knob · #11 (**permalink**) 24th Nov 2008, 2:28 pm

Couldn't find the path, its seems to be coming straight from klikvp.com.

Th3_uN1Qu3 · #12 (**permalink**) 24th Nov 2008, 2:34 pm

Well, that's the typical download dialog, the full path isn't shown. Strange thing is that i'm still not getting it.

One thing you could do is save it (must be Save not Open, you don't wanna open it anyway), then look at the Transfers tab. Select it with your mouse and look at the bottom, it'll display the path.

knob · #13 (**permalink**) 24th Nov 2008, 2:42 pm

Got the sucker, the path is [strike:3ade9825f6]-http://klikvp.com/xxx/xxx/pdf.pdf-[/strike:3ade9825f6]
here's the contents of the .pdf just 3.17k.

Quote:

content deleted.

I can make it popup if I reboot my router so I get a different ip address, then it "thinks" I'm another user.
(btw I reboot my router every day so maybe that's why I get it coming up more often)

Th3_uN1Qu3 · #14 (**permalink**) 25th Nov 2008, 11:11 am

I have a static IP, maybe that's why it never comes up for me.

That looks like a lame javascript exploit. Can't understand what it does really, but Foxit seems unaffected by it, it just opens a blank page and no modifications are made to the system. Tested in a virtual machine running XP SP2.

admin · #15 (**permalink**) 25th Nov 2008, 6:00 pm

Thanks everyone for your help into looking at this.

I don't get the pop up though.
I also checked it from computers in Cambodia during my holiday and didn't see the popup to download the pdf file either.

I'm using IE 7 with Acrobat.

I'll do some searching and find out WHY it's happening....

admin · #16 (**permalink**) 25th Nov 2008, 9:41 pm

I replaced the main index.php and portal.php files from a backup I made in October.

Can you all test the site again and see if you get the same problem about downloading the .pdf file please?

knob · #17 (**permalink**) 26th Nov 2008, 9:41 am

That seems to have fixed the problem, welcome back admin btw. :wink:
Access to the site seems a bit faster now.

Th3_uN1Qu3 · #18 (**permalink**) 26th Nov 2008, 2:40 pm

Quote:

Originally Posted by knob";p=&quot

That seems to fixed the probem, welcome back admin btw. :wink:
Access to the site seems a bit faster now.

Have to confirm that the site runs faster

, don't know about the virus though since i've never gotten it.

admin · #19 (**permalink**) 28th Nov 2008, 12:15 am

Well, unfortunately the hackers got the better of MyMPxPlayer.org and managed to take down the whole server last night!

The server had to be rebuilt but luckily the files were also recovered as well.

The site's back up now after spending about 8-9 hours with Webair getting it sorted (and with only 2 hour sleep last night). Luckily Webair staff were awesome and rebuilt the server and got the site back up again.

I'm begging the hackers to please STOP TRYING TO HACK MyMPxPlayer.org. We are not a commerical site and this is a FREE community based site with a great bunch of members. Please don't ruin it for everyone by trying to hack the site. Please use your time for something else.

geostar · #20 (**permalink**) 28th Nov 2008, 3:24 am

was that yesterday evening for us in the uk. be cause i went on then and all i got was a blank white page