Audio site Danger Trojan

[wazz]

I went to Audiogon twice this weekend and was attacked by a trojan both times. No not a mean greek. They have been running a beta version of the new website apparently. Two times scanning thru listings I was attacked by a trojan that disables antivirus and pretends to be the same. Both times I was able to spend a few hours and defeat it, but it is a PITA to remove. If you go there and get a popup about allowing site to download something to you, click out of there fast! immediately!, it will get in without you approving anything. So far they have not responded to my complaints. I was goning thru IE, not firefox or something. I don't think I will test it to see!

[Wavebourn]

Is it Windows-specific horse, or something based on flexibility of browsers and Java?

[wazz]

I believe it must have gotten in on Java, based on the line of data in the antivirus scan showing what had been fixed. I thought I got it the first time from cllcking a picture from a seller in Singapore, but the second time I was just scanning the listings like I was the first. Popup asked if I wanted to run some program from the site, I clicked cancel or deny or some such but it still took over. Another audio forum replies mentioned that others had had problems from that site very recently. I am not flaming them or something, I have been a member there for a long time but recently have not been going there much. This weekend was the first time I saw the new beta version of it. I had to run safe mode and displayed the list of programs installed, and selected "repair" for the antivirus program before it would function again. Then it did some sort of special safe mode startup and scanned everything to get rid of the trojan.

[adason]

my antivirus program warned me about the attack too, when I went to AudiogoN page
and I was not able to make posting, weird things were happening, I uploded pictures, filled out the title, zip, price, all the details, went to preview and half was it was blank...red mark all over that those fields are required, and I just filled them
it was all messed up in internet explorer
mozzila worked fine

[tvrgeek]

Has anyone notified them?

[a.wayne]

Regardless, people should stay away from Audiogon ... PERIOD !!!!

[CBS240]

Is it the Win7 2012 virus? There is a Vista version as well. It pretends to be some sort of anti-virus program that says your infected and tries to do a scan. I thought I had gotten it, but it must have already infected in other places and it slipped by. Screwed thing up pretty well. Fourtunately I backup. It is some sort of pain in the as$ to try and get rid of tho, slightly more than Freeze Frog. That one is a bit of a niusence if you ever get it.

[Zen Mod]

Tim Rawson influence ?

[mr2racer]

I had a problem with a similar program about a year ago. It started as one of those free scan programs. Best thing is to pull the plug on the computer. It seems extreme but it copies and hides really fast. McAfee was helpless. The only program I found that worked was Malwarebytes. IF it isn't in the computer. Malwarebytes is free to download. I keep a copy on a flash drive because the worm will shutdown most anti-virus software already installed on the hard drive.

[Johnny2Bad]

Originally Posted by wazz

I believe it must have gotten in on Java, based on the line of data in the antivirus scan showing what had been fixed. I thought I got it the first time from cllcking a picture from a seller in Singapore, but the second time I was just scanning the listings like I was the first. Popup asked if I wanted to run some program from the site, I clicked cancel or deny or some such but it still took over...
[snip]

From your description that sounds like a JavaScript vector.

There is no need to run Java (a multiplatform application technology from Sun Microsystems) in a web browser unless you want to run online Java applications, like some calculators. I generally disable it in all my browsers; if I come upon some need for it, I re-enable and restart the browser.

Turn it off and restart again after I'm done. You normally do not encounter Java in an average day (or week, or month) of web browsing. There are many people who have never used it in their lifetime on the 'net.

JavaScript, however, is a scripting language that runs in virtually all web pages that offer topical content, or allow you to post comments, etc. It's difficult to disable JavaScript and surf without issues; you probably could not post in a forum without it enabled.

Some plugins (eg "NoScript" for Firefox) allow you to disable JavaScript on a site-specific basis. There are broadly similar browser add-ons for most web browsers commonly used, regardless of the Operating System (OS).

But, back to the point ... Java is not JavaScript, and vice versa. They are so different they have nothing whatsoever in common with each other; the similar name is an unfortunate circumstance.

So, if you do mean JavaScript, please describe it as such. At least that way, we're not compounding the confusion that exists out there.