Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie

Is this REAL-> keller1@mm_ie virus

Options
  • 01-11-2003 6:28pm
    #1
    trazix
    Closed Accounts Posts: 60 ✭✭


    When i visit www.compustore.ie i get a small alert box that says my computer is infected with the keller1@mm_ie virus the box cannot be gotten rid of by clicking X or the OK button i just have to End Task ot close the browser.

    I have searched on google for this virus name but nothing comes up is it Real or a Hoax, i have no anti virus software


Comments

  • Options
    #2
    Frank Grimes
    Registered Users Posts: 5,231 ✭✭✭Frank Grimes


    Got the same little pop up in Mozilla on Windows and Linux.
    AV software on Windows hasn't picked up anything. Google or Symantec haven't heard of this one either.
    Looks like the site's been hacked or something.


  • Options
    #3
    dahamsta
    Banned (with Prison Access) Posts: 16,659 ✭✭✭✭dahamsta


    Indeed they have. If you download the source with something like wget, you'll see that some kidiot has pasted a big horse of a Javascript into the page. Real clever. Of course that store is hosted on shop.online.ie, which doesn't bode well for the other stores hosted there. I know a guy connected with Online, I let him know.

    adam


  • Options
    #4
    Capt'n Midnight
    Moderators, Recreation & Hobbies Moderators, Science, Health & Environment Moderators, Technology & Internet Moderators Posts: 90,818 Mod ✭✭✭✭Capt'n Midnight


    It's scripting...

    <!-- BEGIN CONTENT -->
    <SCRIPT>
    <!--
    document.write(unescape("%3Cscript%20language%3D%22JavaScript%22%3E%0D%0Aalert%20%28%22you%20are%20now%20

    infected%20with%20the%20keller1@mm_ie%20virus%22%29%0D%0Aalert%20%28%22you%20are%20now%20infected%20with%20the%

    20keller1@mm_ie%20virus%22%29%0D%0Aalert%20%28%22you%20are%20now%20infected%20with%20the%20keller1@mm_ie%20virus

    repeated LOTS of times - 164KB text file zipped to 6KB

    For IE the Security/Custom option that blocks it is called software channel permissions

    (looking at it M$ have intoduced yet another standard
    the options in order are:
    - High - Low - Medium
    Why not just have them as High then Medium then Low ?)

    Now I'm worried - why does IE allow sw to download and run on it's standard settings...


  • Options
    #5
    dahamsta
    Banned (with Prison Access) Posts: 16,659 ✭✭✭✭dahamsta


    I wouldn't really call JS software Cap'n Midnight, and if they turned it off by default and awful lot of websites would stop working. However there should be some kind of protection in Javascript to prevent silly loops like this.

    adam


  • Options
    #6
    Capt'n Midnight
    Moderators, Recreation & Hobbies Moderators, Science, Health & Environment Moderators, Technology & Internet Moderators Posts: 90,818 Mod ✭✭✭✭Capt'n Midnight


    No it's not the JS that worries me - its the wording of the message.
    Have a look at the setting that blocked it and the help item on it...

    Yeah it's Microspeak - that strange language that looks and sounds like English but where words have different meanings. eg: "Remove All" means leaves behind settings so the when you reinstall you inherit the old problems. (Great fun if you hide the toolbars in Word at the edge of the screen and then resize the desktop)


  • Advertisement
Advertisement