Autotrader.com - WARNING

[Z-man]

It seems that someone has hijacked the legit autotrader website.

From the MR2 boards: (www.mr2oc.com):

MR2GTS:
warning* Autotrader website installing trojan virus on PC!
I am really pissed off about this.

I did a couple of used car searches today, and when my browser was closed and reopened, my home page was changed along with 4 trillion pop up ads appearing.

At first, I wasn't quite sure it was due to the Autotrader website, so I cleared the newly installed values from the registry and repeated the process. Once again, the trojan virus installs itself on my pc.

I've emailed Autotrader.com asking for their reasoning behind this because, until now, the site has been pretty legitimate. I would highly recommend none of you use their online services until they can verify this won't happen again.

jrw1621:
I ran into the same trouble off Autotrader. Adaware's Spy Assasin seems to have cleaned it up. Spybot could not take care of it.

mshellhamer:
I was feeling cocky and just had to see for myself. On Wed. 5/12/2004 I went to the Autotrader site. I noticed a lot of network activity after the page had finished closing. I closed all browser and email windows and still the network activity kept going. So then I got scared and disconnected. I put it out of my mind and go about my business.

Friday 5/14/2004 I logon onto my PayPal account to send 50.00 payment for the track event at Kingston and I am astounded to see a 1,450.00 transaction to one Keith Brunette from my bank account dated 5/13/2004, Thursday! WTF! I NEVER respond to those hoax emails. I delete every one and go right to the webpage and login from there to see if there's anything legit. So I'm thinking how did they get my password. It's not like it's easy to guess. It's a random mix of letters and numbers.

So I check my bank account online and it's fine, nothing was withdrawn yet, actually there isn't anything close to that amount in since I just got done paying some bills. I call PayPal and have them lock the account and start the investigation. Then I change my password to another random mix of letters and numbers.

Today, Sunday 5/16/2004, I get an email from PayPal saying I’d requested my password since I’d lost it and to click on the link supplied to retrieve the password. The bastard is trying to get the new password! So I immediately change the password again, and my Earthlink email password in case he’s been intercepting my email. Then call PayPal again to report this latest incident. Next I run a full virus scan, it finds and deletes this.

mt-13[1].htm - VBS.ObjectDataHTA dropper

What a mess. Did Autotrader do this to me? I don’t know. All I know is the day after visiting Autotrader someone tries to steal 1,450.00 from me. I thought I was so well protected; antivirus updated every 24 hrs, Zone Alarm firewall, Earthlink anti-adware, automatic Microsoft critical update notification. Just goes to show you, don’t get too cocky; you’re never as secure as you think you are.

supermr2
Dude I just had to pull my HD and reformate it at a friends house after going to autotrader.com last week. I started getting pop-ups as soon as I got on the website. I logged off IE started a new IE window downloaded adaware ran the program AND STILL HAD POP-UPs. I then went to a virus scan on-line and found two worms and a trojan virus. The program said I had to reboot to get rid of them. I did and then my computer went into a continous boot loop and would not reco. my floppy drive so I had no way to do a boot disk.

Can anyone here confirm this?
-Z-man.

[id10t]

No problems here, running Mozilla with no pop-ups allowed and Linux...

[ronin]

remember, your system is only as secure as a cracker's lack of desire to break in

[emwporsche]

crackers?

Ronin are you racist?

[ronin]

lmao!! naw, just using the proper term for malicious computer intruder instead of the term hacker which is mosconstrued constantly by the media

[BlueSkyJaunte]

I think scr1pt k1dd13 is the new term for "cracker".

[ronin]