gold4rs.com is a virus!

[ssylass]

it may still be defaced or not, im not checking the url.

 

[Jimmy]

Me thinks that they got hacked.

 

[ssylass]

Me thinks that they got hacked.

i think i read somewhere that a gold4rs employee accepted his java app a short while ago, i kinda say owned tbh..

 

[ssylass]

This Is Using A Java Exploit!!!!!! It Will Auto-download Even If You Dont Accept It!!! Do Not Visit Gold4s!!!

 

[Zerk D Beast]

dang -.- and i just clicked on the banner for the win 200 dollars and ags banner on sythe a couple of hours ago
so that means im virused now?

 

[ssylass]

dang -.- and i just clicked on the banner for the win 200 dollars and ags banner on sythe a couple of hours ago
so that means im virused now?

did it show up the page with the java applet? if it did, then yes you are.

 

[Ix L33T Ix]

You are wrong, there is no virus. I just visited there site and ran 2 full scans on my computer.

 

[Zerk D Beast]

did it show up the page with the java applet? if it did, then yes you are.

don't really know :\ all i did was check out their prices on stuff and then just left. What do you mean by a java applet? which side is it on?

 

[ssylass]

You are wrong, there is no virus. I just visited there site and ran 2 full scans on my computer.

click the banner.
i posted on another forum and some people the java app didnt show up,
when it doesnt show up it uses the exploit.

BTW your virus scanner doesnt help... files can be FUD'd which makes all anti virus not detect it.


EDIT:

del C:\Windows\System32\Mswindows\explorer.exe
shutdown -r -t 01

.bat file to automatically delete the virus.

 

[Zerk D Beast]

I do not have a mswindows file or folder in my system32 folder, so does that mean im alright?

 

[Conviction]

I wouldn't advise traveling to their url even to look, untill you get the "Ok" that everything is calmed down.

 

[Syed]

Find and delete these registry keys:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\utorrent
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices\utorrent ​
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\utorren ​t
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\utorrent

Then copy and paste this into a notepad file and save it as a .bat file:

del C:\Windows\System32\Mswindows\explorer.exe
shutdown -r -t 01

Also check msconfig/startup for anything that has "TBOT" in it and delete it.

Also: Download HiJackThis and scan. Put a check on anything related to HKCU and HKLM then click the "Fix" button.
Download MBAM and do a full system scan.

 

[Rhodesy]

ask sythe to remove gold4rs advertisements.

 

[Conviction]

Thumbs up to go there now. It's safe IMO. No more Java exploit.

 

[Benwise]

I told him but he said without 100% evidence, he won't remove the banner. He doesn't want to jeopardize the advertisements with 'rumors'.

If anyone can provide actual evidence, please do.

 

[1234567ASDF]

Will anyone try this, though?

What happened to them?

 

[krackajack]

So if there givng out a virus why are they still on the banner of sythe?

 

[I Own You All]

So if there givng out a virus why are they still on the banner of sythe?

This:

I told him but he said without 100% evidence, he won't remove the banner. He doesn't want to jeopardize the advertisements with 'rumors'.

If anyone can provide actual evidence, please do.

 

[Rhodesy]

So if there givng out a virus why are they still on the banner of sythe?

There isn't enough evidence as ben has clearly said.

 

[Syed]

They no longer have the virus on their site, they are clean. If you went on it yesterday I recommend you do what I said.