Virus at Simchic - enter at your own risk

[Surelyfunke]

Hmm, surprised this hasn't been mentioned already.

If you so much as glimpse the front page of Simchic, you'll be bombarded with a ton of viruses, spyware etc. Just thought I'd give a heads up.

[ZiggyDoodle]

A stupid question perhaps, but how can you confirm this?  Do you get warnings from your a.v./firewall software?

[Surelyfunke]

It didn't happen to me personally, but others have gotten non-stop warnings from their anti-virus softwares, yes.

[selzi]

I can confirm that - just visited the website out of curiosity, and Antivirus instantly popped up with two viruses that were found. How sick is that??? Was Sim Chic hacked by some psycho? 

[Surelyfunke]

Edit: I misquoted the number. I think she said about 10 viruses detected.

[ZiggyDoodle]

Well, I just went there and got nada.  No sirens, flashing lights, warnings, etc. of any kind and I have ZoneAlarm and a good a.v. program running.

What were the names of the viruses you found, Selzi?

[gypsylady]

Here is some more info
http://www.insimenator.net/showthread.php?t=26770

[Rose Outlaw]

Where exactly is the info beside the chitchat in that thread?

[Indiasong]

Yes troyan downloader and constructor.perl infected in my quarantine .

[noname]

I got nothing when I went there, but I do have Firefox w/ NoScript.

[ZiggyDoodle]

Am running Firefox with no script as well.  Has anyone who actually experienced a virus/trojan warning passed on that info to the webmaster or owner of the site?  Certainly would be appropriate.

[Theo]

I got nothing when I went there, but I do have Firefox w/ NoScript.

And for added precaution, modify your hosts file so that the domains fdghewrtewrtyrew.biz, and clvcnt.com point to an invalid IP (like 127.0.0.1)

[Motoki]

I just went there now and a file called "xpl(1).wmf" downloaded on my work computer and attempted to open. When I checked the properties (right click on the file) Windows said in the "Security" section at the bottom the follow message:

This file came from another computer and might be blocked to help protect this computer.

Of course that could be some general CYA message for any downloaded file, but still it did download and attempt to open something without my permission.

Now having said all this, I don't think SimChic themselves are trying to give people virii. I think they just got greedy and tried to put more ads and crap like that up to make even more money and just picked one that was really scammy and sleazy.

[Surelyfunke]

FWIW, I'm also using Firefox, but I have no idea if I have NoScript installed or not. I went onto Simchic yesterday when the virus was first announced, and nothing happened. Did a couple of scans, nothing.

[Venusy]

I just went there now and a file called "xpl(1).wmf" downloaded on my work computer and attempted to open. When I checked the properties (right click on the file) Windows said in the "Security" section at the bottom the follow message:

This file came from another computer and might be blocked to help protect this computer.

I think the virus was trying to use the WMF exploit to gain access to your PC.

EDIT: Remember, there is still another way to get the files from Simchic if you must...

[ZiggyDoodle]

Absolutely delicious.  Thank you, Venusy!   

[selzi]

What were the names of the viruses you found, Selzi?

When I enter the website Antivirus gives the following message:



Then I said to delete that file, and instantly Windows tried to download the file "xpl.wmf", just like Venusy said:



Of course I said "Cancel", and immediately another virus popped up:



When I deleted that file as well everything was OK ... 

[ZiggyDoodle]

Well, I tried it again but this time from home.  No warnings from my firewall (Zone Alarm Pro) or a.v. (Symantec). 

Perhaps it has something to do with my extreme paranoid settings.

Not complaining, mind you.

[Paperbladder]

Yeah, it seems to be clean now because my AV (avast!) and Firewall (Comodo) showed nothing when I visited it earlier.  I don't believe there's a point to .wmf files, especially when .svg(z) can be viewed in most browsers now.

[Surelyfunke]

Think it's fine to go now. I'm not about to try, though. Not that I need anything from Simchic anyway

[noname]

FWIW, I'm also using Firefox, but I have no idea if I have NoScript installed or not. I went onto Simchic yesterday when the virus was first announced, and nothing happened. Did a couple of scans, nothing.

Go to Tools->Extensions for a list of all the extensions you have installed. Additionally, NoScript puts a icon in your status bar of either an "S" or an "S" with a strike through it.

[Surelyfunke]

Go to Tools->Extensions for a list of all the extensions you have installed. Additionally, NoScript puts a icon in your status bar of either an "S" or an "S" with a strike through it.

Lovely, thanks

[lordrichter]

What were the names of the viruses you found, Selzi?

When I enter the website Antivirus gives the following message:

Wow.  That virus changed your language to German!

:-)

[J. M. Pescado]

You should never name your user account after yourself. Pick a generic, meaningless name instead. In the future, black out your name if it appears in any screenshots.

[selzi]

You should never name your user account after yourself. Pick a generic, meaningless name instead.

Thanks for pointing that out to me - but honestly I don't see why ... 

In the future, black out your name if it appears in any screenshots.

My name also appears in my signature, so it's not a secret (my FULL name is, but not the first name by itself), but if that is what you're telling me I'll do that in the future, of course ...