i think the site is hacked - Page 2 - TriStateTuners.com :: Home of Tristate Auto Enthusiast

///chrism3 · 08-20-2010, 08:16 PM

yes i did and am having it right now

bru91 · 08-21-2010, 12:16 AM

I had the fake "Anti-Vir" anti-virus thing happen to me while i was on TST on my work computer about a month ago. I couldn't get rid of it and ended up having to wipe out everything on my computer. And then twice today while going to the TST homepage on my laptop my Norton's blocked attempted attacks.

ScoobySTi · 08-21-2010, 02:16 AM

Quote:

Originally Posted by jpalamar

My work comp all of a sudden self installed 'Atimalware Doctor Protection Center' while on the site. It looks very similiar to Windows Security Center. Can't uninstall it ether. It keeps telling me I need to register and all that crap and I can't even close the program.

I'm running my works virus scan right now to hope I find it. So far it found about 10 cookies from TST that it is finding to be issues.

Just wanted to give a heads up.

EDIT: Now I have 3 different fake virus scans that I can't remove... everytime I try to start task manager or rededit it tell me it is trying to send my credit card info and closes it out...

Probably to late now...but to get rid of the fake Antimalware Doctor(I had it before from this site) and any other fake spyware BS for that matter do this:

-Download Malwarebytes (www.malwarebytes.org) and install

-Start Windows in Safe mode if you can(Pressing F8 while booting)

-For Windows XP go to "Start" then click "Run" type "msconfig" hit enter
-For Vista/7 click "Windows Logo" in "Search" box type "msconfig" hit enter

-Click "Startup" tab and uncheck anything that looks strange(On mine it was "Antimalware Doctor", "Iwuwetedab", "wmsdk64_32.exe")
*Note: Unchecking everything will not mess up your PC.

-Click "Apply" and close out "msconfig"

-Run "Malwarebytes" I use this at work all the time and it works great

-Reboot and you should be good to go

*Note you don't have to do this in "Safe mode" but it makes life easier, you won't have the spyware bs popping up every other second.

If you really want to get in depth with things...while in msconfig you can track down and delete where the actual file is. You can see the location under the "Command" Column

Hope this helps some people.

TJs98GT · 08-21-2010, 08:10 AM

Quote:

Originally Posted by jpalamar

My work comp all of a sudden self installed 'Atimalware Doctor Protection Center' while on the site. It looks very similiar to Windows Security Center. Can't uninstall it ether. It keeps telling me I need to register and all that crap and I can't even close the program.

I'm running my works virus scan right now to hope I find it. So far it found about 10 cookies from TST that it is finding to be issues.

Just wanted to give a heads up.

EDIT: Now I have 3 different fake virus scans that I can't remove... everytime I try to start task manager or rededit it tell me it is trying to send my credit card info and closes it out...

restore your system to a earlier date a couple weeks back. then install an updated virus scanner and scan it again

jpalamar · 08-21-2010, 11:30 AM

Don't have admin access. Can't do anything lol. I'll be having tech support re-image my computer Monday.

Protege v2.5 · 08-21-2010, 02:20 PM

Tried to start up site

-Mozilla askes if I want to install plugin
-I click no
-Assuming it still tried to install plugin even after I say no
-Norton AV blocks plugin from being installed
-This shows up on page after program is blocked.

Fatal error: Call to undefined function cmps_template_alter() in /home/tristate/public_html/forum/includes/functions.php(2953) : eval()'d code on line 3

-Java Virtual Machine program starts up?
-error message with "Unable to access jarfile \\perfectssi.in\public\photo.jpg" shows up.

Happened again at 3:44:13

Details from Norton AV

Risk Name: HTTP Malicious Toolkit Variant Activity 12

Attacking Computer: perfectssl.in(159.148.117.21, 80)

Attacker URL: perfectssl.in/ajax/exe.php?x=jjar

Source address: 159.148.117.21 (159.148.117.21)

461_SS · 08-21-2010, 06:38 PM

Just happened again, but this time i'm on my new laptop. thank god I have everything updated this time. lol. ESET Stopped it in its tracks. I'm running a disc check just to make sure. Ughh wtf is up with this site!

**TROLL** · 08-21-2010, 06:50 PM

Just want to let you know that I've been working on this and am continuing to. I have the hosting company assisting. It is not a file, but may be an injected code... I won't stop until we have things sorted out properly. Thanks for the info everyone has been submitting, we've been using it to try and narrow things down. Hopefully this will be a thing of the past ASAP.

RyanG · 08-21-2010, 07:13 PM

AVG just stopped a "threat" when I opened up a TST page.

GeforceXtreme · 08-21-2010, 07:37 PM

Just came to the TST site and oddly enough it said Java was starting up (which i thought was odd).

Few seconds later my AV kicked in saying its trying to block stuff and I now have Antivirus 2010 on my computer.

**TROLL** · 08-21-2010, 09:39 PM

If anyone who has experienced this can tell me what exact URL they were attempting to load when the trouble started I would appreciate it, thanks.

461_SS · 08-22-2010, 09:06 AM

Each time I got it I went to http://tristatetuners.com.

DaveSTi · 08-22-2010, 06:00 PM

my work IT filter has officially blocked this site as "malicious" so i will no longer be able to access it from work. whatever the problem is, i won't be able to go on here anymore other than from home.

**TROLL** · 08-22-2010, 06:08 PM

Neither myself nor the web hosting company are able to replicate any issues or find anything! I'm not saying its not happening to some, but its making it very difficult to troubleshoot. We're continuing to work on it though... just wanted to update.

05GT · 08-22-2010, 07:06 PM

Bryan,

Dunno if this helps, I would have saved the actual page that came up on my computer when it happened, but I didn't think about doing it at the time. My AV simply blocked the site from loading. I didn't get any viruses though. I would say those that did need a new anti-virus lol.

This was the other day. Hasn't happened today. All 3 in the screenshot happened upon trying to visit TST.

AutobahnRacer · 08-22-2010, 08:19 PM

I have Kaspersky also and nothing is being reported at all about TST. I run super high sensitivity and do not let Kaspersky allow or deny anything without my consent.

Something is obviously triggering somewhere, who knows, maybe there is a counter, every X'th visitor get infected.

No clue whats going on but I have luckily had no problems yet.

Just don't click any links that anyone posts just Google your way to the site instead, AND stay out of picture posting threads if you are really worried about getting infected.

**Big_Jim** · 08-22-2010, 10:01 PM

how about any of the advertising banners, and the rotation of them? any chance whatever the malicious code is being in that some how?

Does anyone that browses this site with Mozilla Firefox with the add-on called Ad-Block Plus have any of the same virus/malware warnings?

Edit long shot but here goes.....

how about the ongoing issue with ascii symbols, could that be a trigger, or a sign of some sorts?

240vert · 08-22-2010, 10:57 PM

I had this happen while on my brothers computer the other night. Just typed in tristatetuners.com and then a white paged showed up that said fail and some other stuff at the top. Then the whole fake thing with 44 viruses and credit info showed up. My brother got it fixed by using the malware bytes. Really sucked though, because he spent a lot of time and money building his computer, and that happened less than a month later.

Thanks for taking this seriously and trying to get it fixed. I was afraid to attempt this site for a few days.

05GT · 08-23-2010, 12:06 AM

Quote:

Originally Posted by Carministrator

I have Kaspersky also and nothing is being reported at all about TST. I run super high sensitivity and do not let Kaspersky allow or deny anything without my consent.

Something is obviously triggering somewhere, who knows, maybe there is a counter, every X'th visitor get infected.

No clue whats going on but I have luckily had no problems yet.

Just don't click any links that anyone posts just Google your way to the site instead, AND stay out of picture posting threads if you are really worried about getting infected.

Im with you. And Kaspersky is awesome lol. I'm not getting it at all now, that screenshot was from a couple days ago when it was happening. It isn't picking anything up anymore.

Oakes · 08-23-2010, 12:17 AM

Yeah...this definitely just happened to me as well, now my netbook has a trojan virus that's tearing it apart....

It was posing as some kind of Java update/security tool.

08-20-2010, 08:16 PM	#21
///chrism3 Tri-State Post Whore Join Date: Oct 2007 Location: delran nj Member #5960 My Ride: 07 sti / 94 supra / 95 m3 iTrader: (0)	yes i did and am having it right now __________________ To view links or images in signatures your post count must be 10 or greater. You currently have 0 signatures.

08-21-2010, 02:20 PM	#26
Protege v2.5 Tri-State Addict Join Date: Mar 2008 Location: SoLanCo Member #7303 My Ride: 2016 Mazda 6 iTrader: (1)	Tried to start up site -Mozilla askes if I want to install plugin -I click no -Assuming it still tried to install plugin even after I say no -Norton AV blocks plugin from being installed -This shows up on page after program is blocked. Fatal error: Call to undefined function cmps_template_alter() in /home/tristate/public_html/forum/includes/functions.php(2953) : eval()'d code on line 3 -Java Virtual Machine program starts up? -error message with "Unable to access jarfile \\perfectssi.in\public\photo.jpg" shows up. Happened again at 3:44:13 Details from Norton AV Risk Name: HTTP Malicious Toolkit Variant Activity 12 Attacking Computer: perfectssl.in(159.148.117.21, 80) Attacker URL: perfectssl.in/ajax/exe.php?x=jjar Source address: 159.148.117.21 (159.148.117.21) Last edited by Protege v2.5; 08-21-2010 at 03:54 PM.

08-21-2010, 06:38 PM	#27
461_SS Tri-State Addict Join Date: Feb 2008 Location: Holland, PA Member #6976 My Ride: 07 Mazdaspeed 3, 95 Probe SE, 86 Monte Carlo (Racecar) iTrader: (0)	Just happened again, but this time i'm on my new laptop. thank god I have everything updated this time. lol. ESET Stopped it in its tracks. I'm running a disc check just to make sure. Ughh wtf is up with this site! __________________ To view links or images in signatures your post count must be 10 or greater. You currently have 0 signatures. There is no Replacement for Displacement! Driver of the 461 Street Stock. To view links or images in signatures your post count must be 10 or greater. You currently have 0 signatures. 2008 Mountian Speedway Street Stock Champion XBL GT: Daking Reborn

08-21-2010, 07:13 PM	#29
RyanG Tri-State Post Whore Join Date: Jan 2005 Location: Easton, PA Member #63 iTrader: (1)	AVG just stopped a "threat" when I opened up a TST page. __________________ I am Area1320 To view links or images in signatures your post count must be 10 or greater. You currently have 0 signatures.

08-21-2010, 07:37 PM	#30
GeforceXtreme Tri-State Post Whore Join Date: Apr 2005 Location: Holland, Pa Member #367 My Ride: 2000 Buick Regal GSE iTrader: (0)	Just came to the TST site and oddly enough it said Java was starting up (which i thought was odd). Few seconds later my AV kicked in saying its trying to block stuff and I now have Antivirus 2010 on my computer. __________________ To view links or images in signatures your post count must be 10 or greater. You currently have 0 signatures. - "Gods Grocery Getter is powered by an L67 3800" - *To view links or images in signatures your post count must be 10 or greater. You currently have 0 signatures.* 12.900 @ 109.91mph 2.166 60Ft (Fastest 1/4) 13.374 @ 110.01mph 2.467 60Ft (Fastest Trap)

08-21-2010, 12:16 AM	#22
bru91 Tri-State Aficionado Join Date: Aug 2005 Location: Marlton, New Jersey Member #772 My Ride: 1991 Nissan Maxima and 2010 Nissan Sentra SE-R iTrader: (0)	I had the fake "Anti-Vir" anti-virus thing happen to me while i was on TST on my work computer about a month ago. I couldn't get rid of it and ended up having to wipe out everything on my computer. And then twice today while going to the TST homepage on my laptop my Norton's blocked attempted attacks.

08-21-2010, 11:30 AM	#25
jpalamar TST Ruined My Life! Join Date: May 2009 Location: Collegeville, PA Member #13773 My Ride: 03 Corvette Z06 iTrader: (3)	Don't have admin access. Can't do anything lol. I'll be having tech support re-image my computer Monday.

08-22-2010, 09:06 AM	#32
461_SS Tri-State Addict Join Date: Feb 2008 Location: Holland, PA Member #6976 My Ride: 07 Mazdaspeed 3, 95 Probe SE, 86 Monte Carlo (Racecar) iTrader: (0)	Each time I got it I went to http://tristatetuners.com. __________________ To view links or images in signatures your post count must be 10 or greater. You currently have 0 signatures. There is no Replacement for Displacement! Driver of the 461 Street Stock. To view links or images in signatures your post count must be 10 or greater. You currently have 0 signatures. 2008 Mountian Speedway Street Stock Champion XBL GT: Daking Reborn

08-22-2010, 06:00 PM	#33
DaveSTi Tri-State Post Whore Join Date: Mar 2006 Location: Charlotte Member #1591 iTrader: (0)	my work IT filter has officially blocked this site as "malicious" so i will no longer be able to access it from work. whatever the problem is, i won't be able to go on here anymore other than from home. __________________ Member Journals: To view links or images in signatures your post count must be 10 or greater. You currently have 0 signatures. / To view links or images in signatures your post count must be 10 or greater. You currently have 0 signatures. / To view links or images in signatures your post count must be 10 or greater. You currently have 0 signatures. / To view links or images in signatures your post count must be 10 or greater. You currently have 0 signatures. / To view links or images in signatures your post count must be 10 or greater. You currently have 0 signatures. / To view links or images in signatures your post count must be 10 or greater. You currently have 0 signatures.

08-22-2010, 07:06 PM	#35
05GT The TST IT Ninja Join Date: Mar 2006 Location: PA Member #1598 My Ride: 2007 SRT8 Jeep / 2013 Shelby GT500 iTrader: (0)	Bryan, Dunno if this helps, I would have saved the actual page that came up on my computer when it happened, but I didn't think about doing it at the time. My AV simply blocked the site from loading. I didn't get any viruses though. I would say those that did need a new anti-virus lol. This was the other day. Hasn't happened today. All 3 in the screenshot happened upon trying to visit TST.

08-22-2010, 08:19 PM	#36
AutobahnRacer Tri-State Post Whore Join Date: Jun 2006 Location: TriState, PA Member #2056 iTrader: (3)	I have Kaspersky also and nothing is being reported at all about TST. I run super high sensitivity and do not let Kaspersky allow or deny anything without my consent. Something is obviously triggering somewhere, who knows, maybe there is a counter, every X'th visitor get infected. No clue whats going on but I have luckily had no problems yet. Just don't click any links that anyone posts just Google your way to the site instead, AND stay out of picture posting threads if you are really worried about getting infected. Last edited by AutobahnRacer; 08-22-2010 at 08:21 PM.

08-22-2010, 10:57 PM	#38
240vert Tri-State Aficionado Join Date: Nov 2008 Member #10173 My Ride: 93 240SX Convertible iTrader: (0)	I had this happen while on my brothers computer the other night. Just typed in tristatetuners.com and then a white paged showed up that said fail and some other stuff at the top. Then the whole fake thing with 44 viruses and credit info showed up. My brother got it fixed by using the malware bytes. Really sucked though, because he spent a lot of time and money building his computer, and that happened less than a month later. Thanks for taking this seriously and trying to get it fixed. I was afraid to attempt this site for a few days. __________________ Shake n' Bake

08-23-2010, 12:17 AM	#40
Oakes Tri-State Post Whore Join Date: Apr 2007 Location: West Chester Member #4384 My Ride: 2010 Mercedes Benz E63 AMG iTrader: (0)	Yeah...this definitely just happened to me as well, now my netbook has a trojan virus that's tearing it apart.... It was posing as some kind of Java update/security tool.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Santa's G-Mail Hacked	TurboTagTeam	Off-Topic	13	12-03-2008 11:19 PM
TST Hacked?	teh DIRT	Off-Topic	33	12-01-2006 11:52 PM
i hacked into my work computer. . .	WKderF	Off-Topic	10	12-23-2005 03:40 AM