Army.ca Hacked

[kratz]

Ok,

Almost any sub-forum or post I read on Navy.ca now wants to download a file. My computer blocks the attempt and a mesage pops up.
This started two days ago in a few forums and is now extended to all of the sub-forums.
Is this a change to the site that I should accept or this a virus?

 

[Nfld Sapper]

Haven't noticed anything on the army.ca side of the house.... have you scanned your system?

 

[2010newbie]

Nothing on milnet.ca either. I checked a couple posts on Navy.ca and I wasn't getting any download warnings.

 

[The Bread Guy]

Nothing on milnet.ca either. I checked a couple posts on Navy.ca and I wasn't getting any download warnings.

Same here as of this post.

 

[MJP]

Ok,

Almost any sub-forum or post I read on Navy.ca now wants to download a file. My computer blocks the attempt and a mesage pops up.
This started two days ago in a few forums and is now extended to all of the sub-forums.
Is this a change to the site that I should accept or this a virus?

I had this before as well.  It is malware of some sort and a run of Ad-Aware solve it for me.

Ad-Aware

 

[Mike Bobbitt]

kratz, I've had one other user report the same thing... it may be that both of you are suffering from the same malware, but I've taken it as a sign to check over the system. So far it's clean.

What sort of file is it asking you to download? (I still recommend you don't actually download it...)

 

[dapaterson]

File is "xd_proxy.css"

Content is:

.app_content_51546247891 a.uiLinkSubtle { display: none; }
.app_content_51546247891 a.UIImageBlock_ICON_Image { display: none; }


#bootloader_Zvucx { height: 42px; }


Windows XP Pro SP_3, IE 7.

 

[kratz]

Thank you for the tips everyone.
I'm in the middle of a virus check (nothing so far).
I've also cleared my history/cookies, just to be sure.
I've scanned for the "xd_proxy.css" file and it can not be found.

Mike,

That is part of the reason I posted. Just in case anyone else was having the problem. The pop-up is not letting me see/read what it is that wants to dowload. The item appears at random. It has been hard to get it to appear twice in the same location.

 

[Scott]

I reported this to Mike yesterday but it hasn't happened since I brought it up in the staff forum. I also haven't run a system scan but am going to start one right away.

I do not know what type of file it was, I just dismissed it, the two times it happened to me, as a bug.

 

[dapaterson]

See:

http://forum2.aimoo.com/computerhelp/WINDOWS-PC/RE-xd_proxy-css-showing-up-on-my-laptop-1-939256.html

Looks like it's a known issue with Facebook's "Like" button and IE.

 

[Mike Bobbitt]

Thanks for the info... I have disabled the "like" button here for now, hopefully that will resolve the issue.