I whois that IP address but didn't see anything unusual. But then again I guess I didn't expect to see a domain name like "hAcKeRceNtRaL.com" or a DC name like rootkit_1
Might be a malware problem
- Thread starter garenasix
- Start date
- th_trl_thread_readers 0
- Status
I whois that IP address but didn't see anything unusual. But then again I guess I didn't expect to see a domain name like "hAcKeRceNtRaL.com" or a DC name like rootkit_1
I was using the same set up when I got nailed on face book. I belonged to a group called vapors forum and clicked on someone's link...it was a showing of a new mod...I could not resist. The minute I clicked on I knew something was wrong. The windows restore virus popped in and stupid me clicked on it to repair. (Don't do it!) Anyway at the time my antivirus software did not pick it up.
Therefore I thought It was a problem on my computer...I have a custom built one. I thought it was dying or ?
I now have numerous antivirus programs on computer. I am safeguarding myself and deleted my FB account. To much stimulation anyway. I am running the firefox and all is well. Another thing I have noticed since I have had the virus attack. I seen some merchants less secure than others. For example gourmet vapor has only a 128 bit while most others run at 256bit on their SSL. I was going to order some nic fluid but changed my mind purely on this factor. (I love the nicotine base.)
Is their anyone that we can report this virus to...I mean since we have the IP address can one report it to someone who can investigate. I am not referring to this forum but someone else...I would think the government would have some type of protocol/fcc related to this type of hijack...
Sorry about the rambling.
I got hit!! Two laptops of mine got nailed. I am trying to run a recovery program to get all my pics back. It happens though.
Was it related to this forum?
It happens but it time consuming and it sucks as well. Also can cost $$.
Alex had asked me if I remembered where I was when I got the pop ups before....I was able to tell him what ECF location I had clicked on....Keep good notes for him......I think it might narrow down where he has to look.
Uba PM incoming....
Uba PM incoming....
If I am on the Net and something weird happens like a strange Pop-up or some a firewall warning, the First thing I do is disable my net connection. It might not alleviate the problem but it can many times minimize the damage.
The thing that is frustration about this to me is that I don’t have a facebook account or have any desire to go to facebook. Is there a way a person on the ECF can Opt-Out of Facebook links?
The thing that is frustration about this to me is that I don’t have a facebook account or have any desire to go to facebook. Is there a way a person on the ECF can Opt-Out of Facebook links?
FWIW running multiple anti-virus programs at once is a bad idea...they tend to slow down your PC & they also can conflict with each other. pick your best one & use it. However if you mean an anti-virus + anti-malware ok...but anti-virus + anti-virus = unnecessary pain and you're not as secure as you think you are...
Oh clarification...anti-virus plus anti-malware....just checked my programs....
You can get a free program that will wipe it out for now. Malwarebytes anti-malware. Just google...I don't link anymore due to being afraid of potential viruses attached. (I know paranoid.)
there are quite a few variants of the virus that seems to be plaguing people from the descriptions. and unfortunately some of them require manual removal (via registry hacks, etc.) some of the variants will "hide" or sometimes even "disable" your real anti-virus. the worst variant includes a browser hijacker so you can't just click a link an download anything to help you. for those you would need to get the actual URL for the file to download and type it into your web browser address bar. if you have access to a PC that isn't infected you can download the installers and burn to CD/DVD and use for the infected one. if you're somewhat "tech savvy" i highly recommend grabbing UBCD and burning it. then you can boot up from that disk and do all of your cleanup without it even loading windows (which is also the best thing for checking rootkits, etc.) you can get the UBCD from here UBCD for Windows i keep a copy handy for this type of thing. even if you can't kill the virus you can still get your most important data from the hard drive with minimal fuss.
Just use IE without add-ons. That will give you the basic browser which is all that you need for the forum here. It's icon is under System Tools on the All Programs menu.
Last edited:
5/16/2011 10:21 AM,High,An intrusion attempt by 64.72.105.3 was blocked.
Web Attack: Blackhole Toolkit Website 6,"64.72.105.3, 80",64.72.105.3/Home/index.php,
64.72.105.3,"TCP, www-http"
A mod could check the transaction logs for this time and date and see if anything looks fishy. I was logged onto the ECF when this happened.
Web Attack: Blackhole Toolkit Website 6,"64.72.105.3, 80",64.72.105.3/Home/index.php,
64.72.105.3,"TCP, www-http"
A mod could check the transaction logs for this time and date and see if anything looks fishy. I was logged onto the ECF when this happened.
Thanks Alex.
Funny thing.... hope this isn't too off track......
I just installed Java yesterday to use a hardware vendor's utility that required it (on a Windows 7 box). I used the utility, then UNINSTALLED JAVA. I did happen to notice that there is a very recent update for it. And... micorsoft has JVM's too outside of the Oracle Java. To to echo the above UPDATE EVERYTHING!!!! Your Java should probably be set to auto-update, unless you really know what you are doing. BTW IDK if the updates block the exploit... whatever it is.
I don't happen to need Java, so I don't run it. There are a few sites that require it, but meh.
Funny thing.... hope this isn't too off track......
I just installed Java yesterday to use a hardware vendor's utility that required it (on a Windows 7 box). I used the utility, then UNINSTALLED JAVA. I did happen to notice that there is a very recent update for it. And... micorsoft has JVM's too outside of the Oracle Java. To to echo the above UPDATE EVERYTHING!!!! Your Java should probably be set to auto-update, unless you really know what you are doing. BTW IDK if the updates block the exploit... whatever it is.
I don't happen to need Java, so I don't run it. There are a few sites that require it, but meh.
I have Java installed, I even write Java apps...
The main thing is shutting it off and not letting the browser have access to it when it is not needed.
You can disable addons in all browsers:
IE (Switch off of it insteaad xD) Internet Explorer add-ons: frequently asked questions
Firefox -> Addons, click Extenstions Tab
Chrome -> about
lugins
Java is owned by Oracle a gigantic company but security updates are nearly a weekly thing with them... (same with Microsoft)
Edit:
I'm going to be doing proactive monitoring of ECF to detect further threats while I am re-engineering the way ECF is ran.
The main thing is shutting it off and not letting the browser have access to it when it is not needed.
You can disable addons in all browsers:
IE (Switch off of it insteaad xD) Internet Explorer add-ons: frequently asked questions
Firefox -> Addons, click Extenstions Tab
Chrome -> about
luginsJava is owned by Oracle a gigantic company but security updates are nearly a weekly thing with them... (same with Microsoft)
Edit:
I'm going to be doing proactive monitoring of ECF to detect further threats while I am re-engineering the way ECF is ran.
It has got me three times and I just finished restoring and scanning. I had three trojans.
I posted in the V4L sub-forum asking if ECF was infected. I got two high risk intrusions just today, and it all started about 2 weeks ago. Somehow tiburonfirst saw the post and I ended up patching Java, but I might just leave it disabled. Norton blocked intrusions from 64.72.105.3 about 3 hours ago:
1. Web Attack: Malicious Toolkit Website 9
and
2. Web attack: Malicious Java Activity 5
1. Web Attack: Malicious Toolkit Website 9
and
2. Web attack: Malicious Java Activity 5
- Status
Similar threads
- Locked
