«

[Mystvan]

Originally Posted by _r.u.s.s.

are you on drugs?

Beer is so refreshing... Ahhh!!!

[Maxor127]

Would running Sandboxie help avoid any infections from replacementdocs? And it looks like Acrobat Reader X has a "protected view" which is supposed to run PDFs in a sandbox, which might help too.

[Japo]

Yes Sandboxie should prevent it. Excepts attacks purposely designed to circumvent sandboxes, but that's unlikely. But the best solution is: do not use an administrator account with UAC disabled.

The protected mode AFAIK only blocks links clicked by the user from the PDF, and other active content. This was probably not even a valid PDF file with malicious content, but an exploit, something that uses a vulnerability in Acrobat to inject code that has nothing to do with PDF. (Again if this code hadn't been run in an administrator account with elevated privileges, nothing too bad could have happened.) If you opened this file with other PDF reader that it wasn't designed to exploit, you would probably get nothing but an error complaining that it's not a valid PDF file. But I'm just presuming, I never had a sample.

[gumpy]

Well, I went to replacementdocs.com yesterday to see if they had a manual for a game I wanted to play and then I got generic browser screen with this message:

"NOTICE: This domain name expired on 07/03/2011 and is pending renewal or deletion"

Noooooooooooooooooooooooooooooo!!!!!!!!!!!

Please don't say that replacementdocs.com is dead! Please no!

[Japo]

It's OK now.

[catchaserguns]

I also found that Replacementdocs is still down. I checked with both IE and Firefox.

[Japo]

Try www.replacementdocs.com instead of replacementdocs.com.

By the way, Opera shows a malware warning and flags the site as potentially harmful. It's not a detection, it's because there has been reports.

[Frodo]

I'm also getting the 'NOTICE: This domain name expired on 07/03/2011 and is pending renewal or deletion.' message.

[_r.u.s.s.]

it's down.. your dns records must be old japo

[gumpy]

Originally Posted by _r.u.s.s.

it's down.. your dns records must be old japo

Arrrghhhhhhhhhh!!! Nooooooooooooo!!!!