GFY Installing Malware - Post If You've Got Hit
 

Seems like a bunch of people are getting hit and the one thing is common is GFY and that Malware Warning people are seeing.

If you've gotten hit, post here and maybe it'll get fixed when the ICS crew gets into the office today.

I got hit and was able to get rid of it using Malwarebyte's Anti-Malware app.

IE (6.0 believe it or not) warned me that it'd blocked a download this morning and I saw Java started running. This was on the log-in page itself, pre-password.

I closed everything and retried and it didnt attempt it the second time.

I just had another attempt.

On Windows 7 and Firefox, it launches Adobe Acrobat Reader and give some kind of 3D error?

Yep...definitely has something to do with Adobe, PDF and Reader.

fucking exploits

On Winxp pro and FF, same error.....

Norton caught it as a Trojan for me. Thank you Norton. :-))

I just opened up GoFuckYourself.com in FF on my Win XP Laptop and immediately got infected by one of those fake anti virus apps telling me I am infected. It would not even let me ctrl-alt-delete to open up the task manager. I did a hard reboot and opened up the task manager and keep it open before the exploit was able to launch. I am trying to use Malwarebytes to fix now and posting from my cell phone.

No trouble here on the Macs.

Yep...No issues on any of the Mac boxes. Just a Windows issue as usual.

yup got it and removed it

no trouble here yet

Same here on win xp 64

Yep. Same here.

It was a dead give away when JAVA/Adobe both launched. It's not the first time this has happened from GFY with this trojan. However, Malwarebytes typically will handle it. Had it handy from the last time.

Still, annoying all the same.
:disgust

See this also guys

http://gofuckyourself.com/showthread.php?t=967903

Glad I'm on my Mac. =)

atwleoqtssd.exe detected by SONAR
atwleoqtssd.exe accessed your network resources
whlu.exe detected by SONAR
whlu.exe modified your System Configuration

No shit, right? I've spent about 2 hours booted into Windows this week and 1/2 of it was spent trying to remove this shit. :1orglaugh

No problems here on either FF or IE and Windows 7

Adobe Flash crashed for me just now... there was a strange white box up by the mojohost banner.

Not saying anything at all, just posting my observations. Maybe it's getting installed that way by chance?

I got hit, but I think I stopped it from exploiting. Explorer 6.0, I am old school I guess..lol

This doesn't happen to me,but again i have adblock installed and no banners visible here.

Avast blocked this:

11/05/2010 12:22:49 PM h**p://91.216.3.108/ca1/main.php [L] JS:Pdfka-AET [Expl] (0)

Yeah, I figured it must be in the banners somewhere.

Two machines were hit by it. However, a third was not.

Part of it, apparently, is because of the firewall. Adobe and Java are not auto approved to do anything. So when they pop up asking for permisson via firewall pop up, I hit deny. So it prevented the infection on the one machine. The others had different configurations where Adobe and Java can auto run/update.

Just an observation.

yep same here yesterday..

The Fix:

Reboot in Safe Mode
Run Malwarebytes
Restart normal
Open your browser (IE/Chrome/FF/Opera) and change the proxy settings. Remove: IP: 127.0.0.1 Port: 5555

I saw that little white box too. I'm trying to refresh so I can view the source but I'm not seeing it anymore.

Apple was onto something? :)

does gfy host the banners themselves? or are they hotlinked from the advertiser's sites?

Can we use flash banners in our sigs? If so maybe it was a users sig.

Alright here on Firefox.

+++++++++++1

I had norton on and ran Malwarebytes - didn't find anything..

Should I use another program to check or?

Got it on my laptop. Can't say for sure that it was from here, as I had a few windows open.

No, not a sig. My first attempt was on the gofuckyourself.com page itself. I was not even logged in yet.

The page just refreshed itself, without me doing anything?
Other than that, I have not noticed anything, yet.
Had an error message earlier that Adobe Acrobat crashed in the browser. Maybe that was it...

I had a software that was installed last night called Antivirus Soft. I have norton, but that didn't help so I ran Spyware doctor and everything seem to be working fine now.