# Son launching Trojans? Apps?

**URL:** <https://forums.speedlife.net/t/son-launching-trojans-apps/122669>\
**Category:** SON240sx Off Topic\
**Created:** [March 17, 2009, 5:46pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669 "2009-03-17T17:46:06Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Happy240sx](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/happy240sx/32/5515_2.png) [@Happy240sx](https://forums.speedlife.net/u/Happy240sx)\
**Post date:** [March 17, 2009, 5:46pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/1 "2009-03-17T17:46:06Z")

</div>

Okay, it’s happened twice now to me on two different computers. When I hit Son an app attempts to launch.

My virus gear at work caught it and quarentined it but I think whatever it was is now on this comp at home

F you Son…clean your sh!t.

---

<div class="post-metadata">

**Author:** ![Hector](https://avatars.discourse-cdn.com/v4/letter/h/43a26b/32.png) [@Hector](https://forums.speedlife.net/u/Hector)\
**Post date:** [March 17, 2009, 6:20pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/2 "2009-03-17T18:20:19Z")

</div>

son has the HIV?, i thought trojans protect u from that … HEHEHEEHE

---

<div class="post-metadata">

**Author:** ![Fobwall](https://avatars.discourse-cdn.com/v4/letter/f/7ea924/32.png) [@Fobwall](https://forums.speedlife.net/u/Fobwall)\
**Post date:** [March 17, 2009, 6:22pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/3 "2009-03-17T18:22:23Z")

</div>

Yeah SON has definitely been compromised. Where the fuck is Jack Bauer when you need him?

---

<div class="post-metadata">

**Author:** ![Ciaran](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/ciaran/32/5612_2.png) [@Ciaran](https://forums.speedlife.net/u/Ciaran)\
**Post date:** [March 17, 2009, 6:34pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/4 "2009-03-17T18:34:23Z")

</div>

shoulda pulled out sooner.

---

<div class="post-metadata">

**Author:** ![Gonad](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/gonad/32/5481_2.png) [@Gonad](https://forums.speedlife.net/u/Gonad)\
**Post date:** [March 17, 2009, 6:54pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/5 "2009-03-17T18:54:40Z")

</div>

I just removed some suspicious javascript from our main index files. :ugh:

No idea how this shit got here. :noes:

Will keep an eye out.

BTW I have a virus scanner/spyware running at home and work and didn’t see anything. I think it’s harmless but still made me go :wtf:

So I took the encrypted javascript that I found in our files, and found out all it was doing was spawning a popup to [http://akajjcthr.com/ld/ment/](http://akajjcthr.com/ld/ment/) \<-- click at yer own risk  
I went to that URL but nothing came up so meh :dunno:

---

<div class="post-metadata">

**Author:** ![touge8](https://avatars.discourse-cdn.com/v4/letter/t/d6d6ee/32.png) [@touge8](https://forums.speedlife.net/u/touge8)\
**Post date:** [March 17, 2009, 7:14pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/6 "2009-03-17T19:14:47Z")

</div>

just happened to me right now…better check it again man.

---

<div class="post-metadata">

**Author:** ![shrews](https://avatars.discourse-cdn.com/v4/letter/s/ba8739/32.png) [@shrews](https://forums.speedlife.net/u/shrews)\
**Post date:** [March 17, 2009, 7:44pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/7 "2009-03-17T19:44:36Z")

</div>

This happened to my old site one time… my host account got hacked somehow and some random script got tossed in a bunch of pages to try and spread whatever virus.

---

<div class="post-metadata">

**Author:** ![DJPyro](https://avatars.discourse-cdn.com/v4/letter/d/278dde/32.png) [@DJPyro](https://forums.speedlife.net/u/DJPyro)\
**Post date:** [March 17, 2009, 7:54pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/8 "2009-03-17T19:54:22Z")

</div>

Yeah I noticed it too.

---

<div class="post-metadata">

**Author:** ![Gonad](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/gonad/32/5481_2.png) [@Gonad](https://forums.speedlife.net/u/Gonad)\
**Post date:** [March 18, 2009, 4:55am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/9 "2009-03-18T04:55:25Z")

</div>

I just ran a diagnostics and I assure you nothing is out of place. Clear your cache or log out-log in again

---

<div class="post-metadata">

**Author:** ![DJPyro](https://avatars.discourse-cdn.com/v4/letter/d/278dde/32.png) [@DJPyro](https://forums.speedlife.net/u/DJPyro)\
**Post date:** [March 18, 2009, 6:22am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/10 "2009-03-18T06:22:37Z")

</div>

Got that pop up thing again at work today. And the cache is cleared every day.

---

<div class="post-metadata">

**Author:** ![Gonad](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/gonad/32/5481_2.png) [@Gonad](https://forums.speedlife.net/u/Gonad)\
**Post date:** [March 18, 2009, 6:36am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/11 "2009-03-18T06:36:18Z")

</div>

Someone wanna post a screenshot of what is going on? vBulletin tells me everything’s fine :dunno:

---

<div class="post-metadata">

**Author:** ![Happy240sx](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/happy240sx/32/5515_2.png) [@Happy240sx](https://forums.speedlife.net/u/Happy240sx)\
**Post date:** [March 18, 2009, 6:52am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/12 "2009-03-18T06:52:24Z")

</div>

I just cleared my history and cookies. Hit Son, selected “New posts” and this launched…

![http://www.u2ndyno.com/pics/Misc/sontrojan.JPG](http://www.u2ndyno.com/pics/Misc/sontrojan.JPG)

The url it launched is [http://akajjcthr.com/cgi-bin/index.cgi?mentat](http://akajjcthr.com/cgi-bin/index.cgi?mentat)

---

<div class="post-metadata">

**Author:** ![rogerthat240](https://avatars.discourse-cdn.com/v4/letter/r/839c29/32.png) [@rogerthat240](https://forums.speedlife.net/u/rogerthat240)\
**Post date:** [March 18, 2009, 7:00am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/13 "2009-03-18T07:00:16Z")

</div>

muhahaha son is being hacked again

Actually last night and the day before I noticed when i refresh the page, there was some kinda cookies error on line 20 or line 10 of the index page… something like that. I run firefox so no gay internet explorer javascript/activex crap for me…

---

<div class="post-metadata">

**Author:** ![Happy240sx](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/happy240sx/32/5515_2.png) [@Happy240sx](https://forums.speedlife.net/u/Happy240sx)\
**Post date:** [March 18, 2009, 7:05am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/14 "2009-03-18T07:05:09Z")

</div>

Yeah, I got that too…

---

<div class="post-metadata">

**Author:** ![Jordan](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/jordan/32/5605_2.png) [@Jordan](https://forums.speedlife.net/u/Jordan)\
**Post date:** [March 18, 2009, 7:08am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/15 "2009-03-18T07:08:38Z")

</div>

> [@SyracuseStreetRacers.com](https://forums.speedlife.net/t/syracusestreetracers-com/20611/296):
>
> I just cleared my history and cookies. Hit Son, selected “New posts” and this launched…
> 
> The url it launched is [http://akajjcthr.com/cgi-bin/index.cgi?mentat](http://akajjcthr.com/cgi-bin/index.cgi?mentat)

I got this yesterday too.

& now that you guys mention it. I was browsing SON & some other stuff on my office computer and all of a sudden all of the windows started to close and the computer re-started… is this something I should be worried about virus wise?

---

<div class="post-metadata">

**Author:** ![Tacoboy](https://avatars.discourse-cdn.com/v4/letter/t/2acd7d/32.png) [@Tacoboy](https://forums.speedlife.net/u/Tacoboy)\
**Post date:** [March 18, 2009, 7:12am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/16 "2009-03-18T07:12:12Z")

</div>

I got it at my friends house yesterday.

---

<div class="post-metadata">

**Author:** ![educated\_Idiot](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/educated_idiot/32/5684_2.png) [@educated\_Idiot](https://forums.speedlife.net/u/educated_Idiot)\
**Post date:** [March 18, 2009, 7:16am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/17 "2009-03-18T07:16:49Z")

</div>

Same… and I also had a random restart right after.

---

<div class="post-metadata">

**Author:** ![rogerthat240](https://avatars.discourse-cdn.com/v4/letter/r/839c29/32.png) [@rogerthat240](https://forums.speedlife.net/u/rogerthat240)\
**Post date:** [March 18, 2009, 7:27am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/18 "2009-03-18T07:27:52Z")

</div>

Stop using internet explorer people 🙂

---

<div class="post-metadata">

**Author:** ![educated\_Idiot](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/educated_idiot/32/5684_2.png) [@educated\_Idiot](https://forums.speedlife.net/u/educated_Idiot)\
**Post date:** [March 18, 2009, 7:43am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/19 "2009-03-18T07:43:59Z")

</div>

I’m kind of liking Google Chrome

---

<div class="post-metadata">

**Author:** ![RED\_LINE](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/red_line/32/5656_2.png) [@RED\_LINE](https://forums.speedlife.net/u/RED_LINE)\
**Post date:** [March 18, 2009, 8:00am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/20 "2009-03-18T08:00:31Z")

</div>

My Windows Live OneCare Popped Up…if you guys are protected your gonna get a password stealer trojan alert which is high risk and they opt for removal. Be Careful!

Admins, please fix this for SON240.

[Next page](https://forums.speedlife.net/t/son-launching-trojans-apps/122669.md?page=2)
