« previous next »
Pages: [1]

Author Topic: WARNING to TW Clanners - E IS BACK (forums virus?)  (Read 3322 times)

0 Members and 2 Guests are viewing this topic.

Offline Dizzy So 1337

  • Soldier
  • **
  • Posts: 246
WARNING to TW Clanners - E IS BACK (forums virus?)
« on: November 14, 2007, 03:53:51 pm »
This might NOT be soldat-related at all, but...

AV forums, RE forums and the Trenchwars forums seem to be infected with some kind of virus / worm / trojan, it sends me autonotifies of random posts and also sent me a wierd movie via PM.  The user that is listed as replying, and that sent the PM, is 'Messenger'.  I can't find or delete this user.

Bootz says some other clans have seen this before so I'm looking for maybe Bob, Copperkat, ex-ARC leaders, Daimarus, to help / explain / fix?

Maybe its just a local problem for me.  But in case it spreads from forums to forums by user, please don't visit the above (infected) forums or any forums if you have already suffered from the infection.

Sorry, soldatforums, but I already posted here before I realized that I might have a virus (or whatever it is).  And I haven't seen any evidence that its affecting me here in these forums.
« Last Edit: November 14, 2007, 06:50:07 pm by Dizzy So 1337 »
Logged
xfire - todhostetler
"There's nothing I wouldn't do to win. But I never hurt anyone except to stick a dogskull on a stake."

Offline Ride

  • Soldier
  • **
  • Posts: 199
    • NA Soldat Clan Website
Re: WARNING - E IS BACK (forums virus?)
« Reply #1 on: November 14, 2007, 04:02:28 pm »
You don't have the virus unless you clicked the image.

The dates on the image are of past clans that E? has destroyed.

One of them was ARC I do not know of the others
Logged
Ingame Name: TC ~ Ryde.Lf ~
Past Clans: ^Re/ ~ -eO:

Offline .Long-Range

  • Camper
  • ***
  • Posts: 455
Re: WARNING - E IS BACK (forums virus?)
« Reply #2 on: November 14, 2007, 04:03:54 pm »
Links to the forums?
Logged
For signatures, you are allowed only one image in your signature which may not be wider and taller than 300 and 125 pixels, and may not be over 20kB in file size. No BMPs are allowed.

Offline chrisgbk

  • Inactive Staff
  • Veteran
  • *****
  • Posts: 1739
Re: WARNING - E IS BACK (forums virus?)
« Reply #3 on: November 14, 2007, 04:06:18 pm »
Most likely it's an automated bot exploiting a flaw in the forum software in use by those forums. In which case, it can't spread, since theres nothing to spread.

Impossible for it to be a spreading virus/worm/etc by users, from the described symptoms. Normal people can't send messages as other users, nor can they notify you of posts as another user; what you describe is happening at an internal level, at the level of the forum software/SQL.

That's not to say that it couldn't be used to trick people into downloading a virus using one of the many, many vulnerbilities to automatically install it; in which case anything that happens on a forum is the least of your concern.

Short version: you aren't going to infect SF by visiting the mentioned forums. You also are not going to infect any other forum you visit either; this is happening at a level beyond users. But it IS possible you could get a virus by visiting the forums, particularily if you use a browser with known vulnerbilities to allow remote code download/execution.
« Last Edit: November 14, 2007, 04:11:45 pm by chrisgbk »
Logged

Offline Ride

  • Soldier
  • **
  • Posts: 199
    • NA Soldat Clan Website
Re: WARNING - E IS BACK (forums virus?)
« Reply #4 on: November 14, 2007, 04:06:56 pm »
There on every tw clan forum.. Re, Sc, Do , Av, and the Trenchwar forums

They were deleted though because they contained viruses
Logged
Ingame Name: TC ~ Ryde.Lf ~
Past Clans: ^Re/ ~ -eO:

Offline FliesLikeABrick

  • Administrator
  • Flamebow Warrior
  • *****
  • Posts: 6144
    • Ultimate 13 Soldat
Re: WARNING - E IS BACK (forums virus?)
« Reply #5 on: November 14, 2007, 04:13:51 pm »
Do all of those forums use the same forum software?  PHPBB or something?

<3 SMF
Logged

Offline Ride

  • Soldier
  • **
  • Posts: 199
    • NA Soldat Clan Website
Re: WARNING - E IS BACK (forums virus?)
« Reply #6 on: November 14, 2007, 04:17:23 pm »
Yes I believe so
PHPBB

they are
www.smfforfree3.com
www.invisionfreeforum.com
www.createforum.com

they are all of those brands I believe
Logged
Ingame Name: TC ~ Ryde.Lf ~
Past Clans: ^Re/ ~ -eO:

Offline chrisgbk

  • Inactive Staff
  • Veteran
  • *****
  • Posts: 1739
Re: WARNING - E IS BACK (forums virus?)
« Reply #7 on: November 14, 2007, 04:19:43 pm »
Quote from: FliesLikeABrick on November 14, 2007, 04:13:51 pm
Do all of those forums use the same forum software? PHPBB or something?

<3 SMF

At any rate they are freely hosted forums; so you basically get what you pay for.
Logged

Offline Sarge.us

  • Major(1)
  • Posts: 28
Re: WARNING - E IS BACK (forums virus?)
« Reply #8 on: November 14, 2007, 04:22:38 pm »
I don't believe that this is that big of a deal, but if some other people would like for this "guy" to no post in their forums ahead of tme, his ip is:

66.90.73.56 (Chicago)

So just ban it or something, not that it isn't a problem for a guy with no life to go around, but do what you want... I wouldn't worry too much.
Logged

Offline Ride

  • Soldier
  • **
  • Posts: 199
    • NA Soldat Clan Website
Re: WARNING - E IS BACK (forums virus?)
« Reply #9 on: November 14, 2007, 04:23:26 pm »
My mistake on the Forums post.. dont know alot about forum software

here is the list..
http://img158.imageshack.us/img158/1395/nextmy1.gif
« Last Edit: November 14, 2007, 04:37:07 pm by Ride »
Logged
Ingame Name: TC ~ Ryde.Lf ~
Past Clans: ^Re/ ~ -eO:

Offline FliesLikeABrick

  • Administrator
  • Flamebow Warrior
  • *****
  • Posts: 6144
    • Ultimate 13 Soldat
Re: WARNING - E IS BACK (forums virus?)
« Reply #10 on: November 14, 2007, 04:44:18 pm »
It looks like a forum worm afflicting phpbb and possibly a few other pieces of software.  It is up to the forum hosts (or in some cases, the owners of the forums) to do something about it.
Logged

Offline chrisgbk

  • Inactive Staff
  • Veteran
  • *****
  • Posts: 1739
Re: WARNING - E IS BACK (forums virus?)
« Reply #11 on: November 14, 2007, 04:49:32 pm »
Quote from: FliesLikeABrick on November 14, 2007, 04:44:18 pm
It looks like a forum worm afflicting phpbb and possibly a few other pieces of software. It is up to the forum hosts (or in some cases, the owners of the forums) to do something about it.

Of which the first recommended course of action is moving to a forum that has a "few" (read: many) fewer vulnerbilities than PHPBB. Which for a free forum is about all you can do, since often you can't update the forum software.

SMF is generally one of the more secure forums out there as long as it's the latest version.
Logged

Offline BombSki

  • Flagrunner
  • ****
  • Posts: 927
    • Climbing-soldiers.net
Re: WARNING - E IS BACK (forums virus?)
« Reply #12 on: November 14, 2007, 05:01:28 pm »
.. this is all crap. im hosting 1 forum of a TW clan, namely SC, and the user "Messenger" has indeed been spamming the board, but i had no problem banning him or deleting his posts. hes using a dynamic IP though. and yes, im using SMF, so perhaps thats it :)

To me it seems like some spamming tard, hes even made a cute gif with 'forums to own', lol.

pathetic if you ask me.

edit: right i see this list was already posted.
« Last Edit: November 14, 2007, 05:06:41 pm by BombSki »
Logged

Offline Dizzy So 1337

  • Soldier
  • **
  • Posts: 246
Re: WARNING to TW Clanners - E IS BACK (forums virus?)
« Reply #13 on: November 14, 2007, 07:07:52 pm »
Aight... well it just got a little less strange for me anyways.  One of my admins (that I thought was inactive, and is never on that early in the morning anyways) deleted the user and the posts this morning before I got on.  So that's why i couldn't find the posts or the user.
Logged
xfire - todhostetler
"There's nothing I wouldn't do to win. But I never hurt anyone except to stick a dogskull on a stake."

Offline SpiltCoffee

  • Veteran
  • *****
  • Posts: 1579
  • Spilt, not Split!
    • SpiltCoffee's Site
Re: WARNING to TW Clanners - E IS BACK (forums virus?)
« Reply #14 on: November 15, 2007, 02:35:20 am »
This guy doesn't like Trenchwar?
Logged
When life hands you High Fructose Corn Syrup, Citric Acid, Ascorbic Acid, Maltodextrin, Sodium Acid Pyrophosphate,
Magnesium Oxide, Calcium Fumarate, Yellow 5, Tocopherol and Less Than 2% Natural Flavour... make Lemonade!

Offline recruit

  • Soldier
  • **
  • Posts: 117
Re: WARNING to TW Clanners - E IS BACK (forums virus?)
« Reply #15 on: November 15, 2007, 03:28:22 am »
So if we play on a trench server , or coms get infected?
Logged

Offline EnEsCe

  • Retired Soldat Developer
  • Flamebow Warrior
  • ******
  • Posts: 3101
  • http://enesce.com/
    • [eC] Official Website
Re: WARNING to TW Clanners - E IS BACK (forums virus?)
« Reply #16 on: November 15, 2007, 03:31:15 am »
No, you wont get a virus from playing in ANY Soldat server. You guys just need to stop using free hosts, stop using phpBB (Everyone knows it has more holes than cheese), and stop giving this guy attention; your feeding him.
Logged

Offline Boots

  • Veteran
  • *****
  • Posts: 1146
  • I Am Iron Man
Re: WARNING to TW Clanners - E IS BACK (forums virus?)
« Reply #17 on: November 15, 2007, 03:33:15 am »
I tried to tell them to keep it low, LAst time it jus tcaused havoc.. Lock this plz.
Logged
That girl's a genius
Whoa oh oh oh oh oh oh
I think she's serious
Whoa oh oh oh oh oh oh

Offline Daimarus

  • Soldier
  • **
  • Posts: 136
  • Believe me, I can kill you with my Spas...
    • SC forums
Re: WARNING to TW Clanners - E IS BACK (forums virus?)
« Reply #18 on: November 15, 2007, 03:40:34 am »
Short story: Messenger made few posts on old ARC forums, even in MEMBERS sector... it was strange, cause nobody could get there unless he had a permission from Admin.

Me and guy called CopperKat thought that it may be something more than a stupid spam message and investigated EVERYTHING from it... every single frame... we found few hidden messages in the animation

All of hem said that "E?" will be the end... of YOU

on 24th may ARC forums were owned. you can see (single frame) this date in the Big Skull frame

That guy is back... me and Copper are working on it and I think that we've found almost everything hidden in it.

As EnEsCe said, paying attention to him is only a food for him... but if Dizzy already did that, we will just continue...
Logged
My SPAS-12 doesn't like most of people. He can mistakenly shoot your brain out of your head and splash it on the nearest wall.

Offline FliesLikeABrick

  • Administrator
  • Flamebow Warrior
  • *****
  • Posts: 6144
    • Ultimate 13 Soldat
Re: WARNING to TW Clanners - E IS BACK (forums virus?)
« Reply #19 on: November 15, 2007, 12:24:15 pm »
Quote from: EnEsCe on November 15, 2007, 03:31:15 am
No, you wont get a virus from playing in ANY Soldat server. You guys just need to stop using free hosts, stop using phpBB (Everyone knows it has more holes than cheese), and stop giving this guy attention; your feeding him.
Logged
Pages: [1]
« previous next »