A Virus in Misc?

Discussion in 'Support' started by Chris_Crime, Jun 15, 2007.

  1. Chris_Crime

    Chris_Crime Rookie

    Joined:
    Mar 18, 2007
    Messages:
    3,807
    Likes Received:
    0
    Nortons reads a virus in Mala's topic in Misc., at least for me.

    Maybe it's not affecting everyone, so this is just a heads up.

    details
    http://www.symantec.com/security_respon ... 14-2838-99

    "CONGRATULATIONS ON SILENT PLAYERS...."
    Code:
    http://www.gamerevolution.com/forum/viewtopic.php?t=6268
    topic url

    Edit:
    it seems to be multiple topics in Misc; maybe the whole Misc board?

    am I the only one getting the prompt for a Chinese language pack?
     
    #1
  2. maca2kx

    maca2kx Rookie

    Joined:
    Jul 24, 2002
    Messages:
    10,782
    Likes Received:
    0
    Hmm, I'm not getting anything. I don't use Norton though, I have avast!, ZoneAlarm and Spybot running persistent checks.

    Sam
     
    #2
  3. Chris_Crime

    Chris_Crime Rookie

    Joined:
    Mar 18, 2007
    Messages:
    3,807
    Likes Received:
    0
    ^^ okay, this may just be me then.

    happened in Grandmasters as well.

    [​IMG]
     
    #3
  4. malakian

    malakian Rookie

    Joined:
    Nov 8, 2002
    Messages:
    7,625
    Likes Received:
    0
    Some smart ass moron of a mod decided to edit my post and badly embed a .swf. I saw it and took it out before it even loaded so I don't know what it was. It should be fine now.

    No idea on the language pack front though :S...No Chinese in it to my knowledge
     
    #4
  5. malakian

    malakian Rookie

    Joined:
    Nov 8, 2002
    Messages:
    7,625
    Likes Received:
    0
    #5
  6. Kool_Aide_Man

    Kool_Aide_Man Rookie

    Joined:
    Nov 13, 2005
    Messages:
    842
    Likes Received:
    0
    I got a Norton notification when I entered this topic...

    Edit: after posting that reply the same notification came up, and it's basically the same thing as yours.
     
    #6
  7. maca2kx

    maca2kx Rookie

    Joined:
    Jul 24, 2002
    Messages:
    10,782
    Likes Received:
    0
    Thanks for the link mala, I've edited that flash out so anyone taking a look now you're not going to see it. I'll forward the information on to joeblow and see what the hell's going on.

    Sam
     
    #7
  8. maca2kx

    maca2kx Rookie

    Joined:
    Jul 24, 2002
    Messages:
    10,782
    Likes Received:
    0
    Ok I've talked to Joe and he's checked out the code. The site the flash is coming from looks fishy so don't go to it anyone. If any of you notice a white box followed by a bunch of code that looks like this:

    [​IMG]

    PM me, TNO or joeblow with the URL to the topic straight away. If topics continue to be mysteriously edited with this then I'm going to have to remove the ability to embed videos and I already have joeblow's backing to do so.

    Sam
     
    #8
  9. masterchris

    masterchris Rookie

    Joined:
    Aug 30, 2001
    Messages:
    6,609
    Likes Received:
    0
    Wait, who is editing posts?
     
    #9
  10. maca2kx

    maca2kx Rookie

    Joined:
    Jul 24, 2002
    Messages:
    10,782
    Likes Received:
    0
    If it's not a misc mod or the post maker then we're not sure.

    Sam
     
    #10
  11. masterchris

    masterchris Rookie

    Joined:
    Aug 30, 2001
    Messages:
    6,609
    Likes Received:
    0
    What happened in the example you posted above?

    I'm missing something here :-/
     
    #11
  12. masterchris

    masterchris Rookie

    Joined:
    Aug 30, 2001
    Messages:
    6,609
    Likes Received:
    0
    Suggesting we move discussion to Covert Ops
     
    #12
  13. maca2kx

    maca2kx Rookie

    Joined:
    Jul 24, 2002
    Messages:
    10,782
    Likes Received:
    0
    Agreed, check Cov Ops for more.

    Sam
     
    #13
  14. masterchris

    masterchris Rookie

    Joined:
    Aug 30, 2001
    Messages:
    6,609
    Likes Received:
    0
    FYI, if anybody else receives this message asking them to install a language pack, click Cancel. Do not click Install.
     
    #14
  15. dUKE

    dUKE Rookie

    Joined:
    Mar 31, 1996
    Messages:
    601
    Likes Received:
    0
    ok, this is a malicious piece of code that's spreading through forums and blogs across the internet at lightning speed. check this out:

    http://www.google.com/search?q=MSSHAMOF

    all these sites are infected.

    oh, and now us too. :(

    we're on the case.
     
    #15
  16. maca2kx

    maca2kx Rookie

    Joined:
    Jul 24, 2002
    Messages:
    10,782
    Likes Received:
    0
    IMPORTANT!!!

    Ok guys all GMs are aware of the problem and we're working on sorting it out and figuring out how it happened in the first place. In the mean time if you find out that your signature has the HTML code (basically if it starts with <embed and contains a link to a website you probably don't recognise that's it, delete from <embed to embed>). Also, do NOT go to the website, I haven't been there but Joe has and he says it definitely looks fishy so I'll say again, do NOT go to the website, just delete all the code from your signature.

    Sam
     
    #16
  17. Chris_Crime

    Chris_Crime Rookie

    Joined:
    Mar 18, 2007
    Messages:
    3,807
    Likes Received:
    0
    So after this passes, will we get embedded video back? Obviously doing what's best for the boards is the only choice, and It's not a big deal, but I was just wondering.


    ATTENTION, DO NOT CLICK CANCEL. Press ctrl alt del and End Task on 'http :// www .gamerevolution. com - Game Revolution:'. Pressing Cancel is just the same as pressing Install.

    trust me, i learned the hard way...
     
    #17
  18. tyler

    tyler Rookie

    Joined:
    Nov 12, 2005
    Messages:
    248
    Likes Received:
    0
    Thanks for the info Chris. That should help to save some people.

    Just so everyone knows HTML is off for the weekend. One of our staff will do a database check two or three times a day to remove the infection from wherever it has popped up. It spreads pretty fast...
     
    #18
  19. LinksOcarina

    LinksOcarina Rookie

    Joined:
    Nov 8, 2005
    Messages:
    12,038
    Likes Received:
    0
    is it still safe to travel on here or no though?
     
    #19
  20. joeblow

    joeblow Rookie

    Joined:
    Feb 26, 2007
    Messages:
    496
    Likes Received:
    0
    I believe so.

    It's spreads and adds stuff to our database but it's not damaging.

    Seems to have hit MySpace now. :shock:
     
    #20

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice