Viruses?

[Anonymous]

An MP2Kmag visitor wrote to tell me you have a virus infection on your server.. in his words -

Just wanted to let you that something strange, and somewhat dangerous happened to me while browsing through a link presented on the site. ItÃÃâ€*’Ãâ€Â*â€â†žÂ¢ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¢ÃƒÆ ’Æ’Ãâ€*’¢Ãà ‚¢Ã¢â€šÂ¬Ã… ¡Ã‚ÂÂà ‚¬ÃƒÆ’Ãâ€*բ̈ †â€™Ãƒâ€šÃ‚¢ÃƒÂ¢Ã¢â‚¬Å¡Ã‚¬Ãà ¢â‚¬Â¦Ãƒâ€šÃ‚¾ÃƒÆ’‚ ¢s not related to the site at all, since the problem really is with the site linked to, and the link comes from the Ads by Google portion located at the right side of the screen, but I thought that you may know if something can be done about it. The problem is that right now there is a link to a thing called ÃÃâ€*’Ãâ€Â*â€℠¢ÃƒÆ’ƒâ€šÃ‚¢Ãà †â€™Ãƒâ€*բ̮šÃ‚¢ÃƒÂ¢Ã¢â‚¬Å¡Ã‚¬Ã…à ‚¡Ãƒâ€šÃ‚ ¬ÃƒÆ’Æ’Ãâ€*ՉۮšÃ‚¦ÃƒÆ’¢â‚ƚ¬Ã…“MapPoint Batch ProcessorÃÃâ€*’Ãâ€Â*â↚¬â„¢Ãƒƒâ€šÃ‚ ¢ÃƒÃâ€*’¢Ã ƒÂ¢Ã¢â€šÂ¬Ã …¡Ã‚Ã ¡Ãƒâ€šÃ‚¬ÃƒÆ’Ãâ€*’ââ ¡Ã‚¬Ã…¡? which I wanted to check out. It currently links to:
http://pagead2.googlesyndication.com/pagead/iclk?sa=l&ai=AXe_ByLhoBxckHQpuwGQy_WK-CIPuUXg95KKkBAcj3GgPDs_q3HAAQb4ABQwAuGBAAc3d35SbwJ zatF2ZuM2btBQMyADe2ADMfF2cAAQAAgGd0BnOv8yd3dnLtBnM r1WYn5yYv12LA0aOBA&num=3&adurl=http://www.tufat.com/mappoint.php&client=ca-pub-651774421821838

which in turn redirects you to http://www.tufat.com/mappoint.php

This is no problem, except that nothing is returned at that address except the message: ÃÃâ€*’Ãâ€Â*â€℠¢ÃƒÆ’ƒâ€šÃ‚¢Ãà †â€™Ãƒâ€*բ̮šÃ‚¢ÃƒÂ¢Ã¢â‚¬Å¡Ã‚¬Ã…à ‚¡Ãƒâ€šÃ‚ ¬ÃƒÆ’Æ’Ãâ€*ՉۮšÃ‚¦ÃƒÆ’¢â‚ƚ¬Ã…“No input file specified.ÃÃâ€*’Ãâ€Â*ââ⠀šÂ¬Ã¢â€žÂ¢ÃƒÆ’ƒâ€šÃ‚ƚ¢ÃƒÃâ€*Ã¢â‚¬â„¢ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¢ÃƒÆ ’Ã†â€™Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡Ãƒâ€šÃ‚Â¬ÃƒÆ ’…¡Ã‚ƚ¬ÃÃâ€*’â↚¬Å¡?

Being as curious as I am, I removed the ÃÃâ€*’Ãâ€Â*â€℠¢ÃƒÆ’ƒâ€šÃ‚¢Ãà †â€™Ãƒâ€*բ̮šÃ‚¢ÃƒÂ¢Ã¢â‚¬Å¡Ã‚¬Ã…à ‚¡Ãƒâ€šÃ‚ ¬ÃƒÆ’Æ’Ãâ€*ՉۮšÃ‚¦ÃƒÆ’¢â‚ƚ¬Ã…“mappoint.phpÃÆ ’Ãâ€*’Ãâ€Â*’Ãà †â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…¡Ãƒâ€šÃ‚¢ÃƒÃ â€*’¢âà ƒÆ’¢â€šÂ¬Ã… ¡ÃƒÆ’ƒâ€šÃ‚¬Ãà †â€™Ãƒâ€*’‚? part to go to their homepage, and thatÃÃâ€*’Ãâ€Â*â€â „¢ÃƒÆ’‚¢à ƒÆ’Æ’Ãâ€*’¢Ã ¢â‚¬Ã†¦Ã‚¡Ãƒâ€šÃ‚ƚ¬ÃƒÃâ€*Ã¢â‚¬â„¢ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¢ÃƒÆ ’Ã†â€™Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡Ãƒâ€šÃ‚Â¬ÃƒÆ ’…¾Ã‚ƚ¢s when my Norton AV cried out that it detected not one or two or three, but 4 attempts from a virus to infect my pc!!

It seems that site is infected with malicious code, and if someone doesnÃÃâ€*’Ãâ€Â*â€à ¢â€žÂ¢ÃƒÆ’ƒâ€šÃ‚¢ ÃÃâ€*’¢ÃƆ™Ãƒâ€šÃ‚¢ÃƒÂ¢Ã¢â‚¬Å¡Ã‚¬Ãâ₠¬Â¦Ãƒâ€šÃ‚¡ÃƒÆ’‚ÂÃ⠀šÃ‚¬ÃƒÆ’Ãâ€*’¢Ã ƒÆ’¢â‚¬Ã ƒâ€¦Ã‚¾Ãƒâ€šÃâ₠¬Å¡Ãƒâ€šÃ‚¢t have proper protection then they may get a lot of trouble from visiting that site.

I know that perhaps this is out of your reach since the link is served by an ad service, but I hope this at least gives you a heads up on being careful when visiting that site.

Take care, talk to you later!

Anyway, so there's a couple things.

- You might want to fix the target URL in your Adwords account.
- Also, you might want to get some virus protection on your server and clean up whatever's on here?

Eric

The Magazine for MapPoint (http://www.mp2kmag.com)

hi,

TUFaT.com was hacked a few weeks ago (they embedded some viruses into various pages), but this should be fixed now.

Extra security precautions have been put into place.

thanks,
Darren