Wraith Worshippers Anonymous - Introduction, Joining And Inactivity, Rules, OOC Chat

[ciannwn]

I've been taking a look at the Freeforums site itself.Seems like a fair amount of help might be possible via their support staff and forum.

An admin ticket ( detailed desription of the hack/difficulties plus a typed-url to your site) might work best ,because then their tech experts can go look on your behalf.

Just a suggestion.

I'll have to contact Draygon about this. Her friend told her about the virus and helped her sort it out. I don't have the details.

[Bagpuss]

Hopefully she'll be able to help.

Good luck!

[Draygon]

Clearly I need to get my friend to be on here to sort out queries That or have him on reliable speed dial!

[ciannwn]

Clearly I need to get my friend to be on here to sort out queries That or have him on reliable speed dial!

All that your friend's really said at the moment is that the hosting site for the WWA forum has been hacked rather than just individual forums. This is why I'm frustrated that other people with forums there haven't mentioned it on other sites/blogs/tweets etc.

@ Bagpuss - you should be OK seeing as you didn't log in or post anything.

[Bagpuss]

I didn't find anything obvious,but I'm not a member.
I only read one google-cached thread as a lurker,then hopped it to the actual freeforums.org site to have a read of their tech stuff and blog.

( Nothing triggered an alert at either site for me if that helps.)

[Isolde]

@ Dray: I'm wondering where your friend got his info, now I've had time to look at the info on the site. I can't see anything that indicates a hack - but, better safe than sorry is a maxim I hold dear. Does he have any links to the relevant issues, and perhaps more data about what actually happened? Is it actually the host or the forums?

[Draygon]

I'll post what he sent to me about it. He foudn out about it because he als ogot hit with it, more than once as did other members of his forum.

basicly, the site itself is changed so that when you press the post button,it also "agrees" to download the script
the script then installs itself on your machine, what it dose? basicly its a keyloger that reports to a TFTP server the output, it also tracks if you make a bank transfer, and will add a £4 charge to transaction, placeing that extra money in an acount in brazill

its initialy called Toor.exe but once its installed, it could be anything for example it was on yours as a part of the java program, but it could be alot of other places to

i do know AVG dosent catch it yet, but one person has said Avast dose so bear that in mind

When I asked if he'd reported it to the site hosting staff:

and i have, and they have so far done... nothing, its not just our page being hit, and most people havent been so on the ball

as has been said, I got hit and it had hidden away in my java. I am not tech savvy and might not have been able to find it. This guy helps repair computers for a job. When he next pops up online (sincehe's down in hull and I'm not) I'll ask if he has any further news on the issue or links.

[ciannwn]

@ Draygon. Thanks. Links etc. would be helpful.

It's just as well he reported it to the hosting site because I couldn't answer any questions about it.

PS: I've just downloaded Avast so I'll do a scan later on and see if it finds anything.

[Isolde]

Java, eh? Ugh, I hate that piece of crap so much. I think it might be a good idea to update Java as well, and remove the outdated versions from your system. I've just been doing that.

[ciannwn]

I've done a full system scan with Avast and it didn't find anything. So, if it really does pick this virus up it means I'm not infected.

I've googled toor.exe virus but all I could find is that there's a program called tor.exe which some malware can use as camoflage. Am now very confused.

[Draygon]

I've done a full system scan with Avast and it didn't find anything. So, if it really does pick this virus up it means I'm not infected.

I've googled toor.exe virus but all I could find is that there's a program called tor.exe which some malware can use as camoflage. Am now very confused.

that might be it. My friend is dyslexic so sometimes he mistypes things. And tbf, that is sort of what this hack is doing.

[Draco-Stellaris]

Thanks for all the good hints! This stuff is pretty creepy. Go figure, I went and installed an anti-virus program for the first time ever! If you can't even feel safe with a Mac anymore, how far has this world come down? Anyhoo, the scanner scanned for two hours and didn't find anything out of the ordinary with Java or anything else.

Whatever it is, I hope it gets resolved and purged from the internet very soon!

[ciannwn]

It seems that Java 7 has the security flaws - I had Java 6 because I never got round to updating it. Even so, I've uninstalled it and disabled it as a Chrome plugin.

Still can't find anything about the hosting site being hacked.

@ Dray - when will your friend have further information and/or useful links? At the moment there's no way of knowing if it's safe to go back.

[Draygon]

It seems that Java 7 has the security flaws - I had Java 6 because I never got round to updating it. Even so, I've uninstalled it and disabled it as a Chrome plugin.

Still can't find anything about the hosting site being hacked.

@ Dray - when will your friend have further information and/or useful links? At the moment there's no way of knowing if it's safe to go back.

When he comes online and stays online long enough for me to talk to him. I am sorry about all this palava and worry

[ciannwn]

When he comes online and stays online long enough for me to talk to him. I am sorry about all this palava and worry

It's not your fault. Thanks for letting us know.