gmat club virus

Question

Updates by Praetorian:
1) This looks like a browser exploit
2) Switch to Firefox
3) Use the full name of the website to log on use https://www.gmatclub.com
4) Download and run Spybot Search and Destroy:
https://www.spybot.info/en/mirrors/index.html

I was trying to log into gmatclub.com - and a virus was actually installed on my computer yesterday evening (March 21 around 6-7pm) - Did anyone else have this problem?

was the website down because someone hacked into it?

rhyme · Answer

I doubt it came from here... You sure you went to the right address?

Nsentra · Answer

You know, same thing happened to me 5 days ago! My AV picked up a virus when gmatclub.com was loading. I look up the history when I get home. I believe, initially I had misspelled the address like https://gmtclub.com, it went to one of those domains for sale sites, can't replicate it now. Also one time when gmatclub.com was loading, on the bottom status bar I saw something to that extent, instead of the regular address. I think there is something fishy. Maybe my hosts file got screwed up, I'll check it out tonight.

johnnyx9 · Answer

That happens to me a lot, when I get to the main page my Norton Antivirus will pop up a window saying a virus was just detected. Also I am sometimes redirected from the main gmatclub.com page before I have a chance to click on "forums."

rhyme · Answer

Wierd... Could it be an ad?

kidderek · Answer

I'm on here all day/all night and no virus for me.

  - firefox user here.

gmat4us · Answer

Yes - exactly Rhyme - When I loaded https://www.gmatclub.com (i tried to twice last night since I wasn't paying attention the first time and figured I had typed the address wrong) -- but even when I made sure the address was correct something got loaded on my computer.

at the bottom left of the browser it shows two or three files being loaded onto my PC -- then the whole browser shut down -- suddenly my Firewall picked up some file called lsass.exe trying to access the internet --

My antivirus did not pick up the file, but upon further research it seems that the trojan is placed into my C:\windows\ directory -- and is given the same file name as a real windows file that should be located in the C:\windows\system32 directory --

A quick way to see if your computer was infected would be to "CTRL+ALT+DEL"" and look at your system processes running -- there should only be ONE lsass.exe file running - if there are more than one, then you have the spyware/trojan on your computer.

johnnyx9 · Answer

It redirects to random portal pages that link to ten trillion different things, 

I also get these pop-up windows:

rhyme · Answer

Looks like its an IE exploit. I wonder if it loads when I go there in firefox. 

/me tries...

Praetorian · Answer

Please download and install Spybot Search and Destroy 1.5 . It will detect and allow you to clean any trojans/malware installed.

https://www.spybot.info/en/mirrors/index.html

Run an update on the software to make sure you have the most current version.

Johnnyx9, does this happen when you type the full https://www.gmatclub.com instead of https://gmatclub.com ?

johnnyx9 · Answer

Praetorian - It didn't give me that pop-up when I tried typing in the full URL. 

I'll try installing that program, thanks for the info!

rhyme · Answer

I wonder if you didnt have something before - cause I've looked at the source and I cant find anything in there that would explain it. Praet, does this site have any connection with a russian hosting facility? That I did find, and that was wierd.

rhyme · Answer

I wonder if you didnt have something before - cause I've looked at the source and I cant find anything in there that would explain it.

Praetorian · Answer

Strange. Can you PM me the details? Do you have a name for the host?

This looked like a browser exploit to me.

rhyme · Answer

Its a browser exploit yea... I cant seem to find any links to the russian site anymore, maybe it came through as part of a google ad last time. 

I cant seem to find anything at all in teh soruce that could explain it. My best guess is that people were previously infected and it randomly pops up ...

futuredukemba · Answer

The same thing happened to me yesterday and a pop up came up asking if I wanted to install active x controls immediately I logged on the page. I killed the webpage since there was no option for NO. When I tried from home, I notice the weird page redirection also.

pelihu · Answer

Would the people experiencing problems indicate which browser they are using?

I'm using firefox and I haven't seen any errors, however I want to be sure that it isn't because firefox hasn't been able to detect the problems.

For virus protection I use Windows Live Onecare - which sucks actually. I'm going to use something different when I have the chance.

futuredukemba · Answer

I was using IE

rhyme · Answer

Its an IE exploit, so if you use firefox, nothing would happen.

Paul · Answer

Indeed I had the same virus block message from IE...

gmat club virus

Prep Toolkit

Top 5 GMAT Debrief Videos

615 to 715 in 15 Days (Ria's Strategies)

More than Quant/Verbal Abilities: Speed vs. Accuracy

745 with Only Self-Prep and GMAT Club

From 555 to 765: 210-point Improvement

Perfect 805 Score Debrief by Julia

My Rewards