# Son launching Trojans? Apps? **URL:** \ **Category:** SON240sx Off Topic\ **Created:** [March 17, 2009, 5:46pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669 "2009-03-17T17:46:06Z")\ **Posts on this page:** 20\ **Page:** 4
**Author:** ![DJPyro](https://avatars.discourse-cdn.com/v4/letter/d/278dde/32.png) [@DJPyro](https://forums.speedlife.net/u/DJPyro)\ **Post date:** [March 19, 2009, 5:36pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/61 "2009-03-19T17:36:29Z")
I’m still getting it at work. But not at home. ---
**Author:** ![rogerthat240](https://avatars.discourse-cdn.com/v4/letter/r/839c29/32.png) [@rogerthat240](https://forums.speedlife.net/u/rogerthat240)\ **Post date:** [March 20, 2009, 5:37am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/62 "2009-03-20T05:37:56Z")
Okay so I’ve noticed it has a popup now to some mystery page (blank – i close it before it loads). ---
**Author:** ![Pete\_FXT](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/pete_fxt/32/5512_2.png) [@Pete\_FXT](https://forums.speedlife.net/u/Pete_FXT)\ **Post date:** [March 20, 2009, 5:48am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/63 "2009-03-20T05:48:04Z")
I got a pop up too. Different site: ``` http://iijyjcthr.com/ld/ment/ ``` Not much info from Norton or anyother sites after a Google search: ``` https://safeweb.norton.com/report/show?name=iijyjcthr.com ``` ---
**Author:** ![rogerthat240](https://avatars.discourse-cdn.com/v4/letter/r/839c29/32.png) [@rogerthat240](https://forums.speedlife.net/u/rogerthat240)\ **Post date:** [March 20, 2009, 6:27am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/64 "2009-03-20T06:27:39Z")
yup thats the one ---
**Author:** ![KoukiS14](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/koukis14/32/5522_2.png) [@KoukiS14](https://forums.speedlife.net/u/KoukiS14)\ **Post date:** [March 20, 2009, 7:37am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/65 "2009-03-20T07:37:37Z")
Its funny that I stumble onto this thread a couple days late. Im running FF and AVG free. Somehow still got that popup then shortly after reboot got a very nice blue screen stating a critical error just after booting into windows. Formatted and the problem is gone but its scary to think that a forum could be infected in such a way. ---
**Author:** ![Rilakkuma](https://avatars.discourse-cdn.com/v4/letter/r/cc9497/32.png) [@Rilakkuma](https://forums.speedlife.net/u/Rilakkuma)\ **Post date:** [March 20, 2009, 7:46am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/66 "2009-03-20T07:46:07Z")
I clicked a link one time and something popped up from Norton saying removing threats… I don’t rmb what it was called, but I rmb it being a trojan though. ---
**Author:** ![Gonad](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/gonad/32/5481_2.png) [@Gonad](https://forums.speedlife.net/u/Gonad)\ **Post date:** [March 21, 2009, 10:05am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/67 "2009-03-21T10:05:48Z")
I realize I did not take enough precautionary actions that I should have which resulted in this mess. A few things to note. - Our forum is running on 3.7.1 - vBulletin recentlly released a new build (3.8.1) that fixes an exploit that is likely the cause of this all happening in the first place. More on this [here](http://www.vbulletin.com/forum/showthread.php?t=301882) - What the above hijack to our scripts did is it injected Javascript code which caused any click in the browser to open a new window that takes you to a URL that launched the attack. The attack is caused by a recent PDF exploit, as seen [here](http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9128278). In a few moments i will be patching SON to latest build. Hopefully this keeps us clean (even though we’ve been safe for a few days now since I manually removed the problem) ---
**Author:** ![roast](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/roast/32/5498_2.png) [@roast](https://forums.speedlife.net/u/roast)\ **Post date:** [March 21, 2009, 12:52pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/68 "2009-03-21T12:52:01Z")
> [@Happy Birthday Stairs!!!!](https://forums.speedlife.net/t/happy-birthday-stairs/20897/58): > > I realize I did not take enough precautionary actions that I should have which resulted in this mess. > > A few things to note. > > - Our forum is running on 3.7.1 > > - vBulletin recentlly released a new build (3.8.1) that fixes an exploit that is likely the cause of this all happening in the first place. More on this [here](http://www.vbulletin.com/forum/showthread.php?t=301882) > > - What the above hijack to our scripts did is it injected Javascript code which caused any click in the browser to open a new window that takes you to a URL that launched the attack. > > The attack is caused by a recent PDF exploit, as seen [here](http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9128278). > > In a few moments i will be patching SON to latest build. Hopefully this keeps us clean (even though we’ve been safe for a few days now since I manually removed the problem) I got this in the afternoon [http://iijyjcthr.com/cgi-bin/index.cgi?mentat](http://iijyjcthr.com/cgi-bin/index.cgi?mentat) ---
**Author:** ![RED\_LINE](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/red_line/32/5656_2.png) [@RED\_LINE](https://forums.speedlife.net/u/RED_LINE)\ **Post date:** [March 21, 2009, 1:03pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/69 "2009-03-21T13:03:12Z")
same here, it’s the same thing happening again…:\ ---
**Author:** ![Gonad](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/gonad/32/5481_2.png) [@Gonad](https://forums.speedlife.net/u/Gonad)\ **Post date:** [March 21, 2009, 8:31pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/70 "2009-03-21T20:31:31Z")
Please report which page you were on if it’s still happening to you. The page will be shown in the URL (eg. forums/showthread.php, forums/index.php, etc.) I’m running in circles here looking for something that doesn’t exist. Help me out. ---
**Author:** ![RustyS13](https://avatars.discourse-cdn.com/v4/letter/r/b38774/32.png) [@RustyS13](https://forums.speedlife.net/u/RustyS13)\ **Post date:** [March 22, 2009, 10:33am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/71 "2009-03-22T10:33:29Z")
bahah thats what ya’ll get for using windows 😛 No problems at all for me I’m using debian linux and mac osx. ---
**Author:** ![Pete\_FXT](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/pete_fxt/32/5512_2.png) [@Pete\_FXT](https://forums.speedlife.net/u/Pete_FXT)\ **Post date:** [March 22, 2009, 10:46am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/72 "2009-03-22T10:46:57Z")
[http://for777daily.com/479/](http://for777daily.com/479/) Today. ---
**Author:** ![Gonad](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/gonad/32/5481_2.png) [@Gonad](https://forums.speedlife.net/u/Gonad)\ **Post date:** [March 22, 2009, 10:50am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/73 "2009-03-22T10:50:03Z")
Everyone getting these needs to do a full scan on their system. The trojan might have been on your box already and you are using an infected version of Internet Explorer. I have been using FF lately and haven’t had any problems. ---
**Author:** ![DJPyro](https://avatars.discourse-cdn.com/v4/letter/d/278dde/32.png) [@DJPyro](https://forums.speedlife.net/u/DJPyro)\ **Post date:** [March 22, 2009, 12:41pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/74 "2009-03-22T12:41:19Z")
Gonad, I was using FF when it came up. Seems ok right now… ---
**Author:** ![spd-dmn](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/spd-dmn/32/5513_2.png) [@spd-dmn](https://forums.speedlife.net/u/spd-dmn)\ **Post date:** [March 22, 2009, 1:04pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/75 "2009-03-22T13:04:44Z")
yeah, this is NOT a browser issue it’s actually a pretty serious problem it involves PDFs and an exploit found in unpatched versions of adobe reader/acrobat SON was just the launching platform, since it serves visitors a redirect to the exploit why /how SON got compromised in that way is currently being looked into in the mean time, UPDATE YOUR ADOBE READER / ACROBAT ---
**Author:** ![Pete\_FXT](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/pete_fxt/32/5512_2.png) [@Pete\_FXT](https://forums.speedlife.net/u/Pete_FXT)\ **Post date:** [March 22, 2009, 1:48pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/76 "2009-03-22T13:48:02Z")
Updated Adobe, scanned entire system. Still got: [http://bgiyjcthr.com/cgi-bin/index.cgi?mentat](http://bgiyjcthr.com/cgi-bin/index.cgi?mentat) ---
**Author:** ![Gonad](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/gonad/32/5481_2.png) [@Gonad](https://forums.speedlife.net/u/Gonad)\ **Post date:** [March 22, 2009, 7:17pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/77 "2009-03-22T19:17:42Z")
I personally use FoxIt Reader ( super fast, and it doesn’t stay in memory like Acrobat :ugh: ). Google it and download it. I believe Foxit resolved the exploit issue. > [@FS: 1981 z28 camaro](https://forums.speedlife.net/t/fs-1981-z28-camaro/15921/16): > > bahah thats what ya’ll get for using windows 😛 > No problems at all for me I’m using debian linux and mac osx. Just because I find Mac users elitests 🤣 > APPLE > 128GB Solid State Drive **[Add $450.00]** > 256GB Solid State Drive **[Add $900.00]** > > DELL > Ultra Performance: 128GB Solid State Drive [add $270 or $6/month1] > Ultra Performance: 256GB Solid State Drive [add $430 or $11/month1] > [http://store.apple.com/us/configure/MB419LL/A?mco=NDE4Mzg5MA](http://store.apple.com/us/configure/MB419LL/A?mco=NDE4Mzg5MA) > > Memory > \* 4GB 1066MHz DDR3 SDRAM - 2x2GB > \* 8GB 1066MHz DDR3 SDRAM - 2x4GB **[Add $1,000.00]** (And that’s not an additional 8GB ram - it’s going from 4GB to 8GB ---
**Author:** ![DJPyro](https://avatars.discourse-cdn.com/v4/letter/d/278dde/32.png) [@DJPyro](https://forums.speedlife.net/u/DJPyro)\ **Post date:** [March 22, 2009, 7:24pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/78 "2009-03-22T19:24:49Z")
To add to Gonad’s reply… > [@ncix](#): > > OCZ Platinum OCZ3P16004GK 4GB DDR3 2X2GB DDR3-1600 PC3-12800 CL 7-7-7-24 Dual Channel Memory Kit > $20.00 Mail In Rebate! > > Price: $139.99 CAD After rebate > » More DDR3 Desktop Memory ---
**Author:** ![driftRPS13](https://avatars.discourse-cdn.com/v4/letter/d/8edcca/32.png) [@driftRPS13](https://forums.speedlife.net/u/driftRPS13)\ **Post date:** [March 22, 2009, 7:32pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/79 "2009-03-22T19:32:12Z")
> [@who can ps my car?](https://forums.speedlife.net/t/who-can-ps-my-car/20900/21): > > rogers monitors all internet activity, you guys just figured this out now lmao… they have huve fascilities like a little city, you need even level 2 security clearance in some areas, keeping records of people, etc… so think again 😉 > > They filter data, monitor data, ports, you name it. Try running a port scanner for too long and you’ll see what happens next 😉 Same with torrents. Of course enable encryption but still. he speaks the truth. i work in these facilities installing infrastructure. it’s literally giant rooms filled with row upon row, stack upon stack of servers and crap. i don’t know shit about computers, i just install support racks and stuff. but those places kinda freak me out in a way. Big Brother is watching! PS i never once got any of these pop-ups or redirects or trojans or anything being mentioned in this thread. today was the first i’d heard of it! and i check SON daily. _shrugs_ ---
**Author:** ![spynn56](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/spynn56/32/5638_2.png) [@spynn56](https://forums.speedlife.net/u/spynn56)\ **Post date:** [March 23, 2009, 9:32am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/80 "2009-03-23T09:32:39Z")
> [@Political Science, for Dummies](https://forums.speedlife.net/t/political-science-for-dummies/20959/17): > > [http://for777daily.com/479/](http://for777daily.com/479/) > > Today. Yep same here. FF and IE. [Previous page](https://forums.speedlife.net/t/son-launching-trojans-apps/122669.md?page=3) [Next page](https://forums.speedlife.net/t/son-launching-trojans-apps/122669.md?page=5)