# Son launching Trojans? Apps?

**URL:** <https://forums.speedlife.net/t/son-launching-trojans-apps/122669>\
**Category:** SON240sx Off Topic\
**Created:** [March 17, 2009, 5:46pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669 "2009-03-17T17:46:06Z")\
**Posts on this page:** 11\
**Page:** 6

<div class="post-metadata">

**Author:** ![Osad](https://avatars.discourse-cdn.com/v4/letter/o/3ab097/32.png) [@Osad](https://forums.speedlife.net/u/Osad)\
**Post date:** [March 27, 2009, 12:00pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/101 "2009-03-27T12:00:07Z")

</div>

Myself either…

---

<div class="post-metadata">

**Author:** ![Singh](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@Singh](https://forums.speedlife.net/u/Singh)\
**Post date:** [May 31, 2009, 9:28pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/102 "2009-05-31T21:28:02Z")

</div>

I got like 7 virus warnings today, each time it was when i tried clicking on the index link. Whats up with this shit?

---

<div class="post-metadata">

**Author:** ![Pants](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/pants/32/5590_2.png) [@Pants](https://forums.speedlife.net/u/Pants)\
**Post date:** [May 31, 2009, 9:34pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/103 "2009-05-31T21:34:28Z")

</div>

same i got 2

---

<div class="post-metadata">

**Author:** ![DoneDreamin](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/donedreamin/32/5678_2.png) [@DoneDreamin](https://forums.speedlife.net/u/DoneDreamin)\
**Post date:** [May 31, 2009, 9:36pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/104 "2009-05-31T21:36:11Z")

</div>

me too, and some random black box kept popping up.

---

<div class="post-metadata">

**Author:** ![Singh](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@Singh](https://forums.speedlife.net/u/Singh)\
**Post date:** [May 31, 2009, 9:38pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/105 "2009-05-31T21:38:04Z")

</div>

> [@FS: misc things](https://forums.speedlife.net/t/fs-misc-things/22289/8):
>
> me too, and some random black box kept popping up.

mmm, sounds like your computer got merked by the virus. Virus check that shit.

---

<div class="post-metadata">

**Author:** ![DoneDreamin](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/donedreamin/32/5678_2.png) [@DoneDreamin](https://forums.speedlife.net/u/DoneDreamin)\
**Post date:** [May 31, 2009, 9:40pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/106 "2009-05-31T21:40:13Z")

</div>

well, meh . my virus protector caught it everytime . and it only occured when i clicked the forum link at the topp

---

<div class="post-metadata">

**Author:** ![Gonad](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/gonad/32/5481_2.png) [@Gonad](https://forums.speedlife.net/u/Gonad)\
**Post date:** [June 1, 2009, 7:02am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/107 "2009-06-01T07:02:26Z")

</div>

Looks like our primary files were hit again with some sorta trojan that got injected into the code.

We are running the latest versions and all our stuff is pretty tightly secured so this is likely some kind of vBulletin exploit.

Anywho it should be OK for now.

---

<div class="post-metadata">

**Author:** ![willcann](https://avatars.discourse-cdn.com/v4/letter/w/51bf81/32.png) [@willcann](https://forums.speedlife.net/u/willcann)\
**Post date:** [June 1, 2009, 8:09am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/108 "2009-06-01T08:09:24Z")

</div>

i got the same when i clicked on Bings site today

---

<div class="post-metadata">

**Author:** ![Gonad](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/gonad/32/5481_2.png) [@Gonad](https://forums.speedlife.net/u/Gonad)\
**Post date:** [June 1, 2009, 9:02am UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/109 "2009-06-01T09:02:25Z")

</div>

It’s a PHP exploit it seems:

[http://blog.unmaskparasites.com/2009/04/29/another-type-of-iframe-hack-php-exploit/](http://blog.unmaskparasites.com/2009/04/29/another-type-of-iframe-hack-php-exploit/)

I noticed all the infected pages on SON/TNC/Bings had very similar \<iframe\> code injected into their primary index.php files.

In anycase I’ve cleared them all.

:/:

---

<div class="post-metadata">

**Author:** ![ahhhrt](https://avatars.discourse-cdn.com/v4/letter/a/cc9497/32.png) [@ahhhrt](https://forums.speedlife.net/u/ahhhrt)\
**Post date:** [June 1, 2009, 8:02pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/110 "2009-06-01T20:02:59Z")

</div>

Got infected. Oh wells, such is life.

---

<div class="post-metadata">

**Author:** ![Gonad](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/gonad/32/5481_2.png) [@Gonad](https://forums.speedlife.net/u/Gonad)\
**Post date:** [June 2, 2009, 7:04pm UTC](https://forums.speedlife.net/t/son-launching-trojans-apps/122669/111 "2009-06-02T19:04:11Z")

</div>

Just applied the latest security patch. Hope for the best.

Only so much more I can do at this point :/:

[Previous page](https://forums.speedlife.net/t/son-launching-trojans-apps/122669.md?page=5)
