Virus attack after log in
- Thread starter JCAUPS1
- Start date
Kegger
R.I.P. 1/12/1966 - 6/1/2017
I got hit but AVG caught it, I have installed NoScript on my Firefox about a week ago an no other issues since.
(previously AVG saw something about once a day)
For those who have got hit, or still getting hit, You NEED to stop scripts from running, use Firefox an NoScript.
---------
I'm saying for those that have gotten hit and are repeatedly in trouble, at least till all the problems are solved.
(that's what I would do)
(previously AVG saw something about once a day)
For those who have got hit, or still getting hit, You NEED to stop scripts from running, use Firefox an NoScript.
---------
I'm saying for those that have gotten hit and are repeatedly in trouble, at least till all the problems are solved.
(that's what I would do)
24HACKER
Super Member
Had to get my computer fixed - got hit with a virus - had been running Firefox and he installed NoScript - will see how this works -
33&athird
Turn on & Tune in
Certainly is a pain. Don't know if it helps, but I got another just now:
voctit . com/news 178.17.163.189
Probably doesn't help, since I posted the same IP address several pages back, though the offending website seems to change names a lot (/news is a reoccuring theme). Doesn't seem to be limited to any one page...though I will admit i'm getting less alerts now than I was, it seems:scratch2:
Not sure about the cookie thing mentioned earlier. Whenever norton gets bored, it clears out cookies automatically...not sure how many, or it it makes any difference.
voctit . com/news 178.17.163.189
Probably doesn't help, since I posted the same IP address several pages back, though the offending website seems to change names a lot (/news is a reoccuring theme). Doesn't seem to be limited to any one page...though I will admit i'm getting less alerts now than I was, it seems:scratch2:
Not sure about the cookie thing mentioned earlier. Whenever norton gets bored, it clears out cookies automatically...not sure how many, or it it makes any difference.
petehall347
the brandy coffee man
there are 20 domains hosted at that address ...http://www.domaintools.com/research/reverse-ip/?hostname=178.17.163.189
spartanmanor
Lunatic Member
I have no idea what AK makes from the ads they run but I have to ask if it is worth the troubles it is causing the members here. just my .02.
Never had a problem here. Good security software is a good thing...
Chrome has this capability built in.:thmbsp:
Lwrs10
Super Member
Ok I hope I am good now.
Installed Chrome. It got past Firefox with Noscript. Installed MSE fully updated. Installed all windows updates before I even thought about getting on here. Made sure Java is up to date, as well as Flash.
I also ghosted my drive after all of this, so if it happens again all I have to do is ghost it back.
FWIW only my laptop was getting attacked. Can't explain that one except a few programs installed on my laptop are not installed on my desktop.
Installed Chrome. It got past Firefox with Noscript. Installed MSE fully updated. Installed all windows updates before I even thought about getting on here. Made sure Java is up to date, as well as Flash.
I also ghosted my drive after all of this, so if it happens again all I have to do is ghost it back.
FWIW only my laptop was getting attacked. Can't explain that one except a few programs installed on my laptop are not installed on my desktop.
Excellent!! Keep us posted over the next few days. I'm running XP on this box and Win7 on another, both with Chrome, current MSE, current Java. I've never even had a hit. Fingers crossed for ya!
lico
Super Member
I was wondering how come I got hit twice in the past week with the "XP security 2012" scan or whatever it calls itself. I normaly don't run with an active virus checker, slows things down - other than Microsoft Security Essentials which is essentially worthless at detecting anything until after the fact. ComboFix is the best utility out there for cleaing up problems, along with System Restore in Windows if anybody else is still seeing a problem.
The AK bulletin board software may be clean - but as a webmster familiar with this kind of stuff, it's more likely there is some type of embedded <SCRIPT> tags in the SQL database stored due to an SQL injection attack that is getting pulled up when folks log in, it's not from ads being served on the site, most ad networks aren't going to let that happen.
Once in place, something like this can be very hard to find. I like AK very much so I visit a lot, the admins here need to dig a little deeper and root out the issue, 'cause I still think it's around. At least it was 2 days ago.
The AK bulletin board software may be clean - but as a webmster familiar with this kind of stuff, it's more likely there is some type of embedded <SCRIPT> tags in the SQL database stored due to an SQL injection attack that is getting pulled up when folks log in, it's not from ads being served on the site, most ad networks aren't going to let that happen.
Once in place, something like this can be very hard to find. I like AK very much so I visit a lot, the admins here need to dig a little deeper and root out the issue, 'cause I still think it's around. At least it was 2 days ago.
Kegger
R.I.P. 1/12/1966 - 6/1/2017
For all those saying something, More needs to be done, and you are "frustrated".
AK has multiple people/sources working on the issue around the clock, and there
frustrated just as much if not much more then you are, there going through "hell"
with all of this and trying to keep the site going without an total bleep meltdown.
This is a Serious problem that AK is taking Seriously, keep posting any issues but
rest assured no one is slacking here trying to get to the bottom of this situation.
It has not been happening with just log in either, some have got it surfing pages.
(and it seems we are not the only site having this same issue)
AK has multiple people/sources working on the issue around the clock, and there
frustrated just as much if not much more then you are, there going through "hell"
with all of this and trying to keep the site going without an total bleep meltdown.
This is a Serious problem that AK is taking Seriously, keep posting any issues but
rest assured no one is slacking here trying to get to the bottom of this situation.
It has not been happening with just log in either, some have got it surfing pages.
(and it seems we are not the only site having this same issue)
Uncle Paul
Super Member
Thanks for the update - that helps. I trust that the efforts will eventually be successful, but at the same time its not acceptable to have to take extreme measures like a virtual machine to access AK for more than the short term.
So, for now no more work access, and only brief check ins to see the status of resolving this issue. Not angry or frustrated, just can't keep removing viruses from my computer until I finally get one I can't remove.
Good luck in your efforts.
For the record the ONLY site that keeps giving me viruses is AK. I just finished removing the "XP antivirus" virus (for about the 10th time), which is the only one from AK that actually gets through. This particular virus is getting smarter and now won't even let you run another program unless you kill it first in taskmanager.
For any of you on this site that get it, here is how I remove it:
1) restore to an earlier restore point
2) run combofix to remove the rootkit that the virus installs.
To kill the virus long enough to run applications, open taskmanager and look for apps with 3 letter names. One of them will be the virus scanner. The 3 letter name is random. Just keep killing until the scanner shuts down, then act. it will pop back up in a few minutes, just kill it again (the name will be the same this time).
whoaru99
Epic Member
Personally, I no longer consider a VM an extreme measure. It's considerably easier to implement and fix (delete infected and rename backup) than just about any virus removal process. All my browsing is now done through VM.
lico
Super Member
VM is somewhat extreme. If you are a Comcast user, you can install free AV software that works at blocking the problem.
Once installed, I had a couple of of reported hits today using AK, but wasn't able to catch the page that is pulling it up (with view source). Seems to be related to closing out everthing and logging back in, though, that's when it hit me both times. I'll keep trying to catch it - we need to cleanup AK!
Once installed, I had a couple of of reported hits today using AK, but wasn't able to catch the page that is pulling it up (with view source). Seems to be related to closing out everthing and logging back in, though, that's when it hit me both times. I'll keep trying to catch it - we need to cleanup AK!
whoaru99
Epic Member
I still have to disagree about VM being extreme. What's extreme is reloading a complete system from a virus/malware attack when using a VM would prevent the malware ever getting into your real computer in the first place.
VM player and the appliances are all free too. It's less work than trying all the different protections and add-ins to try to protect the protections out there, and as mentioned earlier the fix is 15 seconds. Delete the infected appliance and rename your backup copy or download a new one in a couple minutes. Which is also no big deal because your main machine isn't broken.
VM player and the appliances are all free too. It's less work than trying all the different protections and add-ins to try to protect the protections out there, and as mentioned earlier the fix is 15 seconds. Delete the infected appliance and rename your backup copy or download a new one in a couple minutes. Which is also no big deal because your main machine isn't broken.
Last edited:
Similar threads
