i think the site is hacked

[The Alchemist]

I have secured computers. Last night I tried to come to this site, and it was flagged as tainted.

If you have fire fox, download no script application. Stops scripts from running unless you allow it.

I have more programs running than that, but a simple no script would stop these viruses.

[TJs98GT]

mine happened when logging in here:

http://www.tristatetuners.com/forum/

as well as without the "forum/"

[GeforceXtreme]

All I know is that infection tore my computer apart. I didn't have my AV protection turned on due to some work I was doing earlier.

Well got the AV 2010, which disabled safe mode and kept locking me out of everything on Windows.

It even went as far as to disable my keyboard which is the first time I have seen it do that. Also kept counting down 15 seconds to shutdown after I reboot so I had to work fast.

What a bugger that was lol.

I pretty much am not going to type in tristatetuners.com for awhile and just load up the forum section. Hope that prevents another attack to my pc.

[DelayedZ]

This is raping the **** out of my work computer, I tried to logon today and got the stupid AV 2010 virus...I'm still attempting to kill it, being on a timer is somewhat limiting to what I can do since I can't seem to find the file that is giving this a timer, lol. Other then that super exciting. I know I got it from here since its the only website I've visited today and since I just ran a full scan friday and was sitting pretty, now I run a scan and the computer has so many infections. Oh the super fun part, I'm blocked out of safe mode, so I get to figure it out the old fashion way, lol

[TJs98GT]

wow. kinda makes me worried about visiting the site at all. ill just do so from this computer only since its got the most up to date virus protection on it......or my macbook

[DelayedZ]

I ran msconfig on startup, run it right away or the virus will disable it, changed it to diagnostic start up, restarted, ran malware bytes, got most of it, now at least I can get back on normally, now I'm running full scans in safe mode.

[JankyS13]

Originally Posted by TROLL

Sorry for the troubles guys.

Again, this should be taken care of now, and I am confident that the issue is resolved. We discontinued using the part of the site that was compromised and found a more secure solution instead.

I had them remove the 2 files that threw flags last night, and I went in and cleaned up some other files we're not longer using on the server today. I will have them do another virus scan right now just to triple check things because I do take this seriously and want to make sure the site is safe to use.

more secure? I know you are using linux / unix now. glad to see that.

[JankyS13]

Originally Posted by DelayedZ

This is raping the **** out of my work computer, I tried to logon today and got the stupid AV 2010 virus...I'm still attempting to kill it, being on a timer is somewhat limiting to what I can do since I can't seem to find the file that is giving this a timer, lol. Other then that super exciting. I know I got it from here since its the only website I've visited today and since I just ran a full scan friday and was sitting pretty, now I run a scan and the computer has so many infections. Oh the super fun part, I'm blocked out of safe mode, so I get to figure it out the old fashion way, lol

its not just antivirus 2010 that is on your machine now, look in your task manager. willing to bet you see spoolsv.exe and vprinterproxy.exe running in there too. one pc I own needs to be reformated cause of this issue. does not show desktop or the task bar.

that is even after contacting M$ about that issue.

and here is there reply to fixing this problem.

Regarding current situation, I appreciate your time to perform the following steps for troubleshooting this issue.

Suggestion 1: Add explorer.exe to Windows process
=======================================
1. Please start Windows XP.
2. Press Ctrl+Alt+Del on the keyboard to launch Task Manager.
3. Click File menu and click "New Tasks (run...)".
4. In the Open box, type "explorer.exe" (without the quotation marks) and press Enter.

Please check if the issue can be resolved. If the issue persists, let's proceed to Suggestion 2.

Suggestion 2: Use Taskbar Repair Tool
=============================
1. Press Ctrl+Alt+Delete on the keyboard to launch Task Manager.
2. Click the "New Task" button in the Applications tab.
3. Type in "iexplore.exe" (without quotation marks) and click OK.
4. Download Taskbar Repair tool from the following link:

Taskbar Repair Tool
http://www.kellys-korner-xp.com/taskbarplus!.htm

Please Note: The third-party product discussed here is manufactured by a company that is independent of Microsoft. We make no warranty, implied or otherwise, regarding this product's performance or reliability.

5. Click Download Now and save the file, "TaskbarRepairToolPlus!.zip" on the Desktop.
6. After downloading the package, please open the ZIP file and execute TaskbarRepairToolPlus!.
7. Choose "Taskbar is Missing" under "Taskbar Problems".
8. Click Repair and then click Yes.

Can we get desktop and toolbar now?

If so, I would suggest performing a virus and malware scan to remove antivirus 2010.

Please refer to the following steps.

Step 1: Scan for viruses
====================
Note: If you are using a cable modem or home LAN connection, please start from item 1 below. If not, please skip items 1~3 and go to item 4 directly.

1. Restart the computer.
2. After "POST" (the Power On Self Test usually has a text mode screen at the beginning when a system boots up), keep pressing the F8 key until the Windows Startup menu appears.
3. Choose "Safe Mode with Networking" and press Enter.
4. Please open Internet Explorer and visit http://safety.live.com
5. Please click the "Full Service Scan" button and follow the instructions on screen to scan for viruses on the computer.

Step2: Scan for malwares
==================
1. Download freeware Anti-Malware Remover from
http://www.malwarebytes.org/mbam.php;

Please Note: The third-party product discussed here is manufactured by a company that is independent of Microsoft. We make no warranty, implied or otherwise, regarding this product's performance or reliability.

2. After downloading it, please double-click the downloaded file to install it.
3. After installing it, please launch it to scan and remove Trojans or viruses.

Note: I suggest downloading the free trial version.

Please restart your computer and check if everything is working fine now.

In addition, in order to resolve any urgent issue, we also provide a real-time response and even a Remote Assist—Our Phone Support. Please understand that our Web Response service is intended as an alternative to telephone technical support. I have provided information below regarding this issue, and I will be glad to assist you further, using the service as designed. If you prefer our telephone support service, please call us at the Windows XP Warranty Support number listed below.

Windows XP Warranty Support: (866) 234-6020

Monday- Friday 5:00 A.M. - 9:00 P.M. Pacific Standard Time
Saturday - Sunday 6:00 A.M. - 3:00 P.M. Pacific Standard Time

Hope everything goes well and have a nice day!

Best regards,

Bill Pan
Microsoft Windows Support Professional
---------------------------------------

[JankyS13]

and this is what the school shows in microsoft forefront client security even now, after logging onto www.tristatetuners.com

VirTool:Win32/Obfuscator.JK Threat: Severe
Category:
Tool

Description:
This program is used to create viruses, worms or other malware.

Advice:
Remove this software immediately.

Programs that may compromise your privacy or damage your computer were detected. You can still access the file without removing the threat, although this is not recommended. To do so, select "Always Allow" as the action and click the "Apply Actions" button. If this option is not available, log on as an administrator or ask an administrator for help.

Detected by:
Heuristics

Resources:
regkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\U NINSTALL\Desktop Security 2010

regkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\R UN\\SecurityCenter

regkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\R UN\\ff5ds5uwd6s6

regkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\R UN\\Desktop Security 2010

runkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\R UN\\SecurityCenter

runkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\R UN\\ff5ds5uwd6s6

runkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\R UN\\Desktop Security 2010

uninstall:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\U NINSTALL\Desktop Security 2010

file:
C:\Documents and Settings\10217924\Local Settings\Temp\m.251.tmp.exe

file:
c:\documents and settings\10217924\Application Data\Desktop Security 2010\taskmgr.dll

file:
C:\Documents and Settings\10217924\Application Data\Desktop Security 2010\securityhelper.exe

file:
C:\Documents and Settings\10217924\Application Data\Desktop Security 2010\securitycenter.exe

file:
C:\Documents and Settings\10217924\Application Data\Desktop Security 2010\Desktop Security 2010.exe

View more information about this item online
Category:
Tool

Description:
This program is used to create viruses, worms or other malware.

Advice:
Remove this software immediately.

Programs that may compromise your privacy or damage your computer were detected. You can still access the file without removing the threat, although this is not recommended. To do so, select "Always Allow" as the action and click the "Apply Actions" button. If this option is not available, log on as an administrator or ask an administrator for help.

Detected by:
Heuristics

Resources:
regkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\U NINSTALL\Desktop Security 2010

regkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\R UN\\SecurityCenter

regkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\R UN\\ff5ds5uwd6s6

regkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\R UN\\Desktop Security 2010

runkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\R UN\\SecurityCenter

runkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\R UN\\ff5ds5uwd6s6

runkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\R UN\\Desktop Security 2010

uninstall:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\U NINSTALL\Desktop Security 2010

file:
C:\Documents and Settings\10217924\Local Settings\Temp\m.251.tmp.exe

file:
c:\documents and settings\10217924\Application Data\Desktop Security 2010\taskmgr.dll

file:
C:\Documents and Settings\10217924\Application Data\Desktop Security 2010\securityhelper.exe

file:
C:\Documents and Settings\10217924\Application Data\Desktop Security 2010\securitycenter.exe

file:
C:\Documents and Settings\10217924\Application Data\Desktop Security 2010\Desktop Security 2010.exe

Category:
Tool

Description:
This program is used to create viruses, worms or other malware.

Advice:
Remove this software immediately.

Programs that may compromise your privacy or damage your computer were detected. You can still access the file without removing the threat, although this is not recommended. To do so, select "Always Allow" as the action and click the "Apply Actions" button. If this option is not available, log on as an administrator or ask an administrator for help.

Detected by:
Heuristics

Resources:
regkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\U NINSTALL\Desktop Security 2010

regkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\R UN\\SecurityCenter

regkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\R UN\\ff5ds5uwd6s6

regkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\R UN\\Desktop Security 2010

runkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\R UN\\SecurityCenter

runkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\R UN\\ff5ds5uwd6s6

runkey:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\R UN\\Desktop Security 2010

uninstall:
HKCU@S-1-5-21-2006973340-958409281-2263860534-722350\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\U NINSTALL\Desktop Security 2010

file:
C:\Documents and Settings\10217924\Local Settings\Temp\m.251.tmp.exe

file:
c:\documents and settings\10217924\Application Data\Desktop Security 2010\taskmgr.dll

file:
C:\Documents and Settings\10217924\Application Data\Desktop Security 2010\securityhelper.exe

file:
C:\Documents and Settings\10217924\Application Data\Desktop Security 2010\securitycenter.exe

file:
C:\Documents and Settings\10217924\Application Data\Desktop Security 2010\Desktop Security 2010.exe[/QUOTE]

[jpalamar]

Originally Posted by DaveSTi

my work IT filter has officially blocked this site as "malicious" so i will no longer be able to access it from work. whatever the problem is, i won't be able to go on here anymore other than from home.

Same here. I wish I knew what link I was on when it happened. If any of the mods or admin can view my thread viewing history from Friday, it happened arround 3PM though.

[05GT]

I can't believe how bad some of you got with this. You definitely need to use a better AV. I do this stuff for a living. If someone is that bad and needs help, let me know.

[AutobahnRacer]

A final solution, if you do not wish to take the course I previously suggested, use Linux or MAC instead lol.

[Oakes]

Mark. Fix my netbook. Thanks TST.

[05GT]

Originally Posted by Oakes

Mark. Fix my netbook. Thanks TST.

lol You know my number.

[JankyS13]

Originally Posted by 05GT

lol You know my number.

i don't


btw anyone else get an email from Bryan asking for their ip addy?
What can I say I don't feel comfortable on this forum now. So, I'm going to keep my butt on shiftgearz and a few others till it's completely resolved or I get a message from bryan via email.

[liquiddevil2000]

yeah i caught a trojan message the other day when trying to log in ...my pc caught it and i stayed off of it until i went on on my droid x and it went through fine

[Protege v2.5]

The 2 latest, Norton is still blocking it so I don't have an issue coming on site. I figure any info I can give will help in some way.

Both are when I first load up the site, not logged in yet. Only happens the 1st load up.

[sleepersatty99]

I got nailed with a virus last night from this site. Tha took me 2 hours to fix So i think im going to saty off of here for a while. Send me an email for when the site is cleaned and ill be back. Till then See ya around.

[Elliott18t]

Originally Posted by jpalamar

My work comp all of a sudden self installed 'Atimalware Doctor Protection Center' while on the site. It looks very similiar to Windows Security Center. Can't uninstall it ether. It keeps telling me I need to register and all that crap and I can't even close the program.

I'm running my works virus scan right now to hope I find it. So far it found about 10 cookies from TST that it is finding to be issues.


Just wanted to give a heads up.

EDIT: Now I have 3 different fake virus scans that I can't remove... everytime I try to start task manager or rededit it tell me it is trying to send my credit card info and closes it out...

**** is this why my computer at home has that?!

i just wont let my gf know since im trying to con her into a mac pro, since i need a new computer anyways.

[champ_6]

I got hit with it last night too... luckily it's an easy fix