Forum Hacked

[digitalpress]

As you may or may not know, phpBB is loaded with security issues. Just a few weeks ago, phpBB.com itself was even hacked. There is a group of folks out there who simply hate phpBB and want to exploit it's weaknesses.

Our forum has a number of patches in it to protect against past hacks, but a new one surfaced early this morning essentially plugging itself in front of the <title> tags and redirecting you to a site with an executable that is of course a trojan horse virus. This happened to dozens of popular phpBB forums almost simultaneously. Not good. Hopefully no one actually fell for that, and if you did, run your virus protection NOW.

The fix was a quick one but I haven't seen a permanent fix yet. As you know, we've also been in the process of moving the forum to a new version which allegedly manages these security issues. We'll see. For now, please accept our apologies for the inconvenience and know that we're just as aggravated by board outages as anyone! We'll always work toward a permanent fix.

For now, game ON.

[Lady Jaye]

Thank God for the firewall at work!!! All I got this morning was some error message page instead of being redirected...

[esquire]

Thank God for the firewall at work!!! All I got this morning was some error message page instead of being redirected...

Same here. Although at home I got redirected. The redirected page was quite obvious that it had not been prepared by DP. Glad to see the site back up!

[captain nintendo]

Thank God for the firewall at work!!! All I got this morning was some error message page instead of being redirected...

Same here. :)

[rarecube]

I tried my Antivirus, but is not working??
How do i get rid of it?
Cant turn of my computer.
Need help please.

[Jive3D]

yeah this POS got me this morning. I was half asleep while drinking coffee. I did a System Restore in Windows XP and I think that it's probably out - I also did an AdAware system check and found nothing. I'll do a Virus Scan when I get home as well as Spybot S&D and then maybe a web based one too.

There's no need for computers! Just game consoles! We wouldnt have to deal with this Rubbish!

[Kroogah]

The rarity guide link might still try to redirect people...I went to click on it and fortunately I only got an error message, but it was trying to send me to "www.digitpress.com:8080"

[NESaholic]

Thank God for the firewall at work!!! All I got this morning was some error message page instead of being redirected...

Same here, otherwise they would fire me at once bringning in a trojan horse,pfew!

[Iron Draggon]

Oh GREAT. I actually fell for it. No wonder the new "plugin" didn't seem to do anything. CRAP. Just what I DON'T need. I thought that it was just part of all the new changes. I wonder if I can do a system restore to get it fixed?

[Gemini-Phoenix]

Ah ha. Some of us were already one step ahead of it and spread the word to not click anything!

That probably explains why a few other forums have gone down though.


Was surprised you hadn't put up a warning on teh main page though. Glad to see it's all sorted now.

[philosophyst]

I fell for it but scanned my computer twice and it came up with no threats. My computer won't turn off though. This is horrible, what do I do? x_x

[digitalpress]

Was surprised you hadn't put up a warning on teh main page though. Glad to see it's all sorted now.

It happened while we were asleep. I took the board down as soon as I was made aware of the problem.

The virus is called "Worm/VB.CT" so check around, I hope there are virus patches to catch this one.

[Crush Crawfish]

whew, thanks for the warning! I didn't click anything suspicious, but I'm running my virus scan right now, just because I'm paranoid about stuff like this.

[Flack]

Manual removal information:

http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453085893

[nesuser2]

Thanks for the update Flack. I got on early this morning as well to find this message but was very leary. I actually thought it was coming from Mac Rumors but I was wrong. I was trying to setup the new phpbb and got nothing but problems, trying it in a test environment with php4 but i'm having nonesuchluck with sql4.1

O well, good to see a link go up. I didn't click the link but i was very close to!

[hydr0x]

also, if you already have Spybot S&D and Ad-Aware, you should also install this one

http://www.ewido.net/en/

the free version finds some stuff both others don't, so give it a try!

[DigitalSpace]

The redirect looked funny, so the first thing I did when I came across the redirect page was a Google search - which confirmed this thing was no good.

I got a trojan last year that was a bitch to remove, so I'm always suspicious about these things now.

[Snapple]

I used to swear by Spybot S&D, but the thing is seriously outdated now. Any good anti-spyware program can catch twice as many things as S&D now.

I actually recommend Microsoft's new free anti-spyware program. It's free to download, you don't even need to own Windows. And best of all, it wasn't made by Microsoft. Apparently, it used to be an expensive anti-spyware program called Giant, but now Microsoft bought it and is giving it away as a beta program.

And as I said, it caught a couple hundred things that S&D missed the first time I ran a scan with it. It also has a resident shield that can be setup to block any changes being made trying to be made to your system or your preferences without your permission.

Usually, I'm an anti-Microsoft guy, but it's a great program.

For Adware, I still use Ad-aware. Certainly not a new program, but it's still the best free anti-adware program that I've found.

And for viruses, I use AVG, which is yet another totally free program. I'm not sure if AVG's definitions can handle this new trojan yet, because I knew that redirect page was trouble, and I'm not going to find out for myself how malicious it is.

[nesuser2]

I loaded the MS Anti-spyware and got a buttload of spyware on my server at school. It nearly brought it to a screaming hault. Anyways, Use Adaware and hijackthis is a great tool but it takes a little experience. Use firefox as well, it won't stop everything but it stops alot...even though firefox is under attack daily and popups are coming through. There will be firefox 1.1....more cracks for crackers to expand.

[Jive3D]

I did the system restore RIGHT AWAY b/c I was suspicious of the thing the entire time. But I was still a moron and installed it.

I was successful in shutting down my PC after that too, think there's a good chance that I got rid of it?

Boy am I stupid in the mornings.

[Iron Draggon]

OK, what's up with the changes that it made to my TCPIP.SYS file? The first thing that it did was make changes to it, and it told me that a copy of the original file was saved in the same folder with it, as TCPIP.SYS.ORIGINAL. Fine, so now I have two of these files, both of which are probably identical, and I can't find a way to get a copy of the REAL XP SP2 TCPIP.SYS file to replace both of them with, since I don't trust either one of them now. My newest restore point is over a week ago, and I really don't wanna go there. Every time I try to do system restore it just tells me that the system can't be restored anyway, so no doubt it would be a waste of time to try. All the net says about this situation is that SP2 made some changes to that file that causes problems with P2P networks, but it supposedly did this because if you keep it the old way, or use one of these modded files, it makes it easier for you to get worms and viruses and whatnot. So obviously this is why these hackers wanted that file changed on my computer. And I want it changed back. But even Microsuck doesn't seem to have a copy of the REAL file that I can download and install anywhere! So how can I fix this God-awful mess?

[Sotenga]

WHEW. I fell for it, and I ran the plugin more than once, hoping that it would actually do something. Please point at me and laugh like Nelson Muntz. >_<

But a full system scan with Norton Antivirus shows that, except for a few pieces of spyware (which are now gone), my compy is relatively safe. Dammit, gullibility was always one of my weak points.

[Cauterize]

Dammit, gullibility was always one of my weak points.

Makes two of us!

[squidblatt]

I almost installed it, but I hit cancel after I had a second thought. It still really pisses me off. There's nothing more I'd like to do then get my hands on one of these kids.

[Bluteg]

The index page of the forums were kept on my desktop since last night, so it never affected me.

[drivefast1690]

wow, good thing i didnt get anything

[Iron Draggon]

Well Norton isn't finished scanning yet, but I did a search for the files that the Trojan supposedly installs, and came up with nothing. So it seems that all that happened to me was that it changed my TCPIP.SYS file. I don't seem to have the Trojan at all, and I hope I don't. So perhaps you only got the Trojan if it was able to get through your firewall. And I don't believe that anything got through mine. If it did, then Norton should've detected it immediately, like it does when crap like that arrives in my email. Unless it's one of those new ones that disables Norton somehow, so that Norton can't detect it. Otherwise, all I seem to need to know is how to change that one file back to it's original state, and where I can get a copy of the original file. Nothing has been found on my drive C, and it's scanning my drive D now. So hopefully both drives will be clean. Because I even made the mistake of saving the .exe on my drive D and trying to install it from there to get back into the forums. Which means that it was run on both of my hard drives. So that really makes me mad, especially if I have a virus hiding on both drives!

[SoulBlazer]

Okay,

I was tired last night and went to bed early and slept for like 12 hours.

The last time I used the forum here at DP and logged off was at 11:47 PM ETZ.

I did'nt sign on again until 1 PM ETZ Tuesday.

I have a direct link sending me straight to the forum page.

Did I miss this thing all together? Is that why I have no clue what the heck anyone is talking about? :hmm:

[digitalpress]

Yeah dude, it was just a few hours early this morning.

[nesuser2]

Yes, everybody is talking about a redirect that prompted you to install some file....like install.exe or something for an update to all the traffic the site was receiving. :D

That's choppy on details...but it's what happened.

[SoulBlazer]

Woohoo!

(does the 'happy dance')

Thank God for being tired last night and taking a sleeping pill and crashing early! :D

Otherwise I make my last check here of the day around 2 AM or so.

[digitalpress]

Woohoo!

(does the 'happy dance')

Thank God for being tired last night and taking a sleeping pill and crashing early! :D

Otherwise I make my last check here of the day around 2 AM or so.

You still would have "missed it".

[SoulBlazer]

Good, I'm glad to see my luck is starting to change a little for the better these days. Now let's hope the trend keeps going. ;)

[LiquidX01]

Man I was so pissed early this morning, I started laughing. I downloaded that shit and installed it thinking nothing of it and I became suspious only after doing so.

That shit fucked with my computer pretty good...Even after thinking I completly removed it, My floppy drive began searching for something for about 20 minutes and finally stopped. The thing is there was NO DISK in the damn drive. Whatever that damn exploit was, It was apparently searching for some information. Then I restarted and checked my process and 4 suspious things showed up. I googled each one I had never seen before and realized they were all exploits...Strange thing is, Each one disappeared from my list seconds after loading and could only be seen for a few seconds after restart.

I went into chat, and P.D.F. guided me through some steps since I was basicly half asleep when it happened and couldn't think straight at all. I ran AVG just to make sure I removed it and nothing showed up after. I'm going to run that removal tool next just to be safe.

Anywho, Thank's P.D.F. for the help this morning!! :)

[jajaja]

Sad to hear this. I noticed it this morning and thought it was something real.
Of course I didnt download it, because I would never install a plugin just to visit a website and I didnt know what this plugin did.
So I thought I had "lost" this forum, but I'm glad now that I havnt :)

[Untamed]

I hit it, and a Google search didn't turn up anything.

I knew it wasn't real, but I figured I'd have a go at it anyways. Entertainment.

Downloaded and installed. Nothing.
Downloaded again and installed. Nothing.


Virus scan. Nothing.
Looked at manual remove instructions posted. I don't even have those tasks.


Hum. Odd.

[jajaja]

I hit it, and a Google search didn't turn up anything.

I knew it wasn't real, but I figured I'd have a go at it anyways. Entertainment.

Downloaded and installed. Nothing.
Downloaded again and installed. Nothing.


Virus scan. Nothing.
Looked at manual remove instructions posted. I don't even have those tasks.


Hum. Odd.

Update your antivirus if you havnt already done this. Also use a spyware remove like spybot or giant spywareremover

[Untamed]

I've already used Spybot.

To scan, I used Trendmicro's Housecall. Online scanner, and updated.

[philosophyst]

Well, I guess I have it but the only thing I notice is that I can not turn my computer off or restart it. I have ran spyware programs and my Norton Antivirus several times and came up with nothing. This is bad, I can't figure out what to do because I'm not 100% sure what I have yet.

Anyone else who has this unable to turn their computer off?

[LiquidX01]

Well, I guess I have it but the only thing I notice is that I can not turn my computer off or restart it. I have ran spyware programs and my Norton Antivirus several times and came up with nothing. This is bad, I can't figure out what to do because I'm not 100% sure what I have yet.

Anyone else who has this unable to turn their computer off?

Sorry I forgot mention that. Yes, I ran into that problem also.

The way I have removed mine was "pain in the ass" way.

1. Start scanning with a Spyware remover.

2. Run an Anti-Virus program.

3. Open Task Manager and look for suspect process' running. Google each one for a description.

4. If you know how to edit your registry try deleteing any suspect files. DON'T try it if you don't know how to. One wrong delete and your screwed!!

[Daria]

Anyone else who has this unable to turn their computer off?

Unplug your pc. Instant fix. (:

[philosophyst]

I'm wondering if that is really the only problem or if some behind-the-scenes thing is happening. I don't really know enough to be screwing around in the registry and/or deleting things. What should I do? I haven't had one thing caught with any scan of my system and I have updated (or attempted to).

Is there a chance that Norton will update and include whatever virus this is in their detection? Because it sure isn't helping right now.

[towerofsong]

glad its got sorted, hope too many people didn't fall for it

[LiquidX01]

I'm wondering if that is really the only problem or if some behind-the-scenes thing is happening. I don't really know enough to be screwing around in the registry and/or deleting things. What should I do? I haven't had one thing caught with any scan of my system and I have updated (or attempted to).

Is there a chance that Norton will update and include whatever virus this is in their detection? Because it sure isn't helping right now.

No there are other things happening in the background, What exactly they do...I don't know, But I know they are there since I saw them in my process list and then saw them disappear.

I found my Virus' using Avast 4.5 .

http://www.download.com/Avast-Home-Edition/3000-2239_4-10353376.html?tag=lst-0-1

I then checked again using AVG A-V. Have you tried using a spyware detection tool also?

[philosophyst]

Have you tried using a spyware detection tool also?

Microsoft AntiSpyware

and then the Norton as well.

[LiquidX01]

Have you tried using a spyware detection tool also?

Microsoft AntiSpyware

and then the Norton as well.

Are they both up to date? How about your Norton's anti-virus? Make sure everything is updated.

[Untamed]

Hm, I don't think the program actually executed when I ran it.

My comp is a-ok.

[izret101]

Yeah dude, it was just a few hours early this morning.

Whew did i luck out then.

I was tired early this monring and at school i would NOT have taken the time to read anything that poped up i would have just clicked Yes.

Good luck with finding a permanant solution.
People who do stuff like that are jack asses.

It would be something totally different if in a nondestructive way they had shown the weakness and gave insite what to do to fix it up.

Same goes for AA i don't use their boards but i wish them the best on their ventures as well.

[LiquidX01]

Hm, I don't think the program actually executed when I ran it.

My comp is a-ok.

It didn't look as if it executed when I ran it either. It installs without being shown....

[Jive3D]

It really is crazy though how many of us are addicted to this site and clicked okay to install something that we normally would not have, just b/c we thought it would give us access to DP. Sheesh. x_x

[philosophyst]

It's amazing how well this thing is hiding that nothing I have run picks it up. I have updated many times today from both Norton and Windows but have not been able to pick it up. Does this mean I have to manually do something. I really wish I didn't have to mess with deleting things that I have never heard of.

What to do?

Oh, I went to the link provided above by LiquidX01 and it said that it may conflict with Norton so I didn't do it. Not that Norton is doing anything for me.

[Super Mario Fan]

It's amazing how well this thing is hiding that nothing I have run picks it up. I have updated many times today from both Norton and Windows but have not been able to pick it up. Does this mean I have to manually do something. I really wish I didn't have to mess with deleting things that I have never heard of.

What to do?

Oh, I went to the link provided above by LiquidX01 and it said that it may conflict with Norton so I didn't do it. Not that Norton is doing anything for me.

I had Norton, it dosen't pick up anything. I'm glad I got rid of it.

[Jasoco]

I discovered this at about 5:30 this morning (Eastern). I knew it wasn't part of Digital Press for many reasons, but the only thing going through my head was "I'm not tired, I'm bored and now I can't even browse Digital Press!" Being a Mac user, I was completely unaffected. Even if I had downloaded the EXE, it wouldn't do nothing anyway. I was just angry I couldn't even browse the forum. :angry:

So I did my part to help. I used OS X's Terminal to "curl" the "viewtopic.php" page and look over the code when I found the badly placed META Redirect tag. At this point I knew 100% it was a trick. So I emailed Joe. I suppose Joe got a lot of email this morning. If I had a way, I would have notified everyone on the forum. I hope those of you who did get affected are able to fix your problem quickly.

I posted a topic at AtariAge anyway and they let me know, and pointed out a half dozen other similar topics, that it happened there too yesterday, but it happened during the day so Albert was able to fix it fast. I don't know what time Joe sleeps, so I don't know if he saw the email(s) right away or if he had to wake up first.

Well, glad to see Digital Press is back. Of course, I just woke up from an 8 hour nap. There's my sleep for the night.

[kainemaxwell]

I got hit with this bug this morning before I went to work. Working now to fix this issue during dinner. x_x

[NE146]

Being a Mac user, I was completely unaffected. Even if I had downloaded the EXE, it wouldn't do nothing anyway. I was just angry I couldn't even browse the forum. :angry:

You weren't unaffected.. as you said it prevented you from browsing the forum right? ;)

I downloaded the .exe as well.. took a look at it, didn't run it though. Was completely unnafected and I'm on a pc (usually). :)

[Steven]

Whew, what a lucky bug I am. I was here this morning and saw the supscious message. Now, I recently got my PC (which my anal older brother owns) with a virus (took my bro 2 hours to fix and restore) so I am now extremely cautious of what I click on and download. Last thing I need is for him to kick my ass.

I saw the redirect thing but I had to leave the house in a few, I got suspcious and I was just too lazy, heh.

Turns out I got saved! =)

Sorry to everyone who got the virus, but that one poster is right. Maybe we're TOO addicted that we'll d/l something to read the forums. Just air more caution to the wind next time around..

[Phosphor Dot Fossils]

If I had a way, I would have notified everyone on the forum.
Well, there are two alternate venues that are good for finding out or asking about this sort of thing - #vbender (where I stayed up way the hell past my bedtime until I literally couldn't stay awake any longer, trying to help figure stuff out with a lot of help from NE146) and the Classic Video Games group DP runs on Yahoo! Groups, where I also sent a notice out to everyone. I strongly recommend everyone at least sign up for the Yahoo group; it's very low traffic and it's a very good way to find out about those rare occasions when the forums go down.

So...even though I don't have the ability to unhack the forums or reboot the system, I was trying to be a traffic cop for those wondering what the heck was up. And I'm sure many of the regulars were doing the same.

[kainemaxwell]

I'm having alot of problems trying to fix this problem, can someone help please?

[atomicthumbs]

Yeah... I saw it too around 2 or 3 this morning. Glad I didn't click anything. It sure didn't look like the page was from DP. Glad to see everything is back up. Not glad to see, however, that some people here got screwed.

I hate this hacker shit. What the hell is wrong with nerds nowadays?

[Jasoco]

Nowadays? They've been doing this kind of shit for decades. I guess it's a power trip thing. They get off on bringing down a helpless server for a few hours. And if they infect a bunch of PC's, even better.

[Hugs his Mac mini]

[kainemaxwell]

Can someone help me please? Nothing I've done is working and I can't find said files in that manual deletion link posted earlier. :( :(

[ubersaurus]

I saw it, and was immediately wary when I saw the actual forum pop up first. My suspicions were further deepened when I saw atariage with the exact same message and program link, and a couple hours later, when they came back up, it confirmed what I thought.

Oh well-it gave me an excuse to go play some steel battalion ;p

[Funk Buddy]

Can someone help me please? Nothing I've done is working and I can't find said files in that manual deletion link posted earlier. :( :(

Try this page, it might help you some.

http://inetexplorer.mvps.org/Darnit.htm

[Jasoco]

Oh well-it gave me an excuse to go play some steel battalion ;pI couldn't play any games because I was busy watching the entire 7 hours of the Matrix Trilogy on HBO.

[kainemaxwell]

Can someone help me please? Nothing I've done is working and I can't find said files in that manual deletion link posted earlier. :( :(

Try this page, it might help you some.

http://inetexplorer.mvps.org/Darnit.htm

Didn't help.

[Jibbajaba]

Edit: Post deleted.

Chris

[philosophyst]

Can someone help me please? Nothing I've done is working and I can't find said files in that manual deletion link posted earlier. :( :(

Try this page, it might help you some.

http://inetexplorer.mvps.org/Darnit.htm

Didn't help.

Unfortunately it didn't help me either, this is the pits. Nothing seems to get rid of this.

[kainemaxwell]

I tried running Norton, Spybot and Adware and nothing and kinda afriad to fix this through my registry, is there any help or fixes out there???

[Videogamerdaryll]

All Right..I'm so aggravated with this..I come to this site and I get this Crap..

Is there someone here to help with this please..?

Not everyone is computer savvy..

It's had me up all night and all day.

Last night I clicked on the link and it went a few places in my computer that I don't know..
The locations of the ones I could find I deleted..

I never went fully thought the extraction but I still have the virus listed in this topic..

I tried to go through the removal process :
eTrust Spyware Encyclopedia - TrojanDownloader.Win32.VB.ct

But I can't find those files etc..

My Norton's has been disabled by it and the Email protection..
I can't seem to fix it..plus Norton's will not find the Virus.)plus I can't seem to turn Norton's off(?)

My computer will not shut down..unless I shut it off with the surge protector.

I put in Avast and the first time and after a restart it located the virus..But I really don't know what to do with it..
I chose #1 Delete it.
The scan just keeps going..and it seems it's not being removed.
I can't seem to get back to that start -up scan.

I am using the Grey Avast scan that keeps finding the virus over and over after long scans..It sat Recommended to put it in the Chest,So I did but the scan keeps coming back up with the virus.
So I delete it over and over and I'm still infected..

I use Window XP

HELP>>>

[LiquidX01]

I put in Avast and the first time and after a restart it located the virus..But I really don't know what to do with it..
I chose #1 Delete it.
The scan just keeps going..and it seems it's not being removed.
I can't seem to get back to that start -up scan.

I am using the Grey Avast scan that keeps finding the virus over and over after long scans..It sat Recommended to put it in the Chest,So I did but the scan keeps coming back up with the virus.
So I delete it over and over and I'm still infected..

I use Window XP

M'Kay...The virus installs 16 diffferent infected files onto the computer. Each time you hear the alarm sound, a different file has been found. They may all look the same, but the exact locations are different. Keep hitting delete each time your prompted to. Also make sure the scanner is set up to do a thorough scan of the hard drive. After doing all that, I would run the scanner once more to make sure.

[Videogamerdaryll]

I put in Avast and the first time and after a restart it located the virus..But I really don't know what to do with it..
I chose #1 Delete it.
The scan just keeps going..and it seems it's not being removed.
I can't seem to get back to that start -up scan.

I am using the Grey Avast scan that keeps finding the virus over and over after long scans..It sat Recommended to put it in the Chest,So I did but the scan keeps coming back up with the virus.
So I delete it over and over and I'm still infected..

I use Window XP

M'Kay...The virus installs 16 diffferent infected files onto the computer. Each time you hear the alarm sound, a different file has been found. They may all look the same, but the exact locations are different. Keep hitting delete each time your prompted to. Also make sure the scanner is set up to do a thorough scan of the hard drive. After doing all that, I would run the scanner once more to make sure.

Thanks..I will try it again..(will update situation)

[kainemaxwell]

M'Kay...The virus installs 16 diffferent infected files onto the computer. Each time you hear the alarm sound, a different file has been found. They may all look the same, but the exact locations are different. Keep hitting delete each time your prompted to. Also make sure the scanner is set up to do a thorough scan of the hard drive. After doing all that, I would run the scanner once more to make sure.
So keep running Avast till everything comes up clean??

[Funk Buddy]

Ok how about here?

http://aumha.org/secure.htm

[LiquidX01]

M'Kay...The virus installs 16 diffferent infected files onto the computer. Each time you hear the alarm sound, a different file has been found. They may all look the same, but the exact locations are different. Keep hitting delete each time your prompted to. Also make sure the scanner is set up to do a thorough scan of the hard drive. After doing all that, I would run the scanner once more to make sure.
So keep running Avast till everything comes up clean??

I ran Avast the first time and I found and deleted the infected files. I then followed up with AVG and found nothing. Just to make sure (I was paranoid) I did it once more using Avast, and nothing was found also. So I guess my first scan found everything I needed removed.

[GobopopRevisited]

:/ I downloaded the "plugin"... My Computer is sick... This sucks a large ammount of Ass.