Forum appears to have been hacked!

[tommykl]

Interestingly, my Avast has ceased to warn me about this forum today.

Norton hasn't warned me in a few days either. I switched to Chrome yesterday, and I get the daysofyorr thing most of the time, but not always, usually going to and from the homepage and the subforums.

[Stramala]

I haven't noticed daysofyorr.com appearing at all today no matter how many forum pages I look through. Dare I say it I think we're emerging from the eye of the storm now.

[DanielPT]

I haven't noticed daysofyorr.com appearing at all today no matter how many forum pages I look through. Dare I say it I think we're emerging from the eye of the storm now.

It still shows a connection to daysofyorr.com for me...

[WeirdKerr]

I noticed something odd going onto the main site, Adobe PDF reader fires up and i get an error msg "expected a Pict object", but as ive notced a few other problems and my pc is over 5 years old and in probable need of a fresh windows install im not to bothered.... (on a side note i Use Panda anti-virus....)

[dr-baker]

By the way (for reference for those who don't have anti-virus, or for those whose anti-virus is about to run out), what is the best free anti-virus software that one can download from the internet?

[JeremyMcClean]

By the way (for reference for those who don't have anti-virus, or for those whose anti-virus is about to run out), what is the best free anti-virus software that one can download from the internet?

Spybot is pretty good, though really you should stop being so cheap and buy the best that's out there at your local tech shop.

[FullMetalJack]

The problem I have is that most anti-virus software craps itself whenever I try to run CSM for GP4. AVG on the other hand doesn't do that. However, it has also been picking up a busload of trojans over the past few weeks.

I thought I was just being cheap by using AVG, I guess it's not just me.

I know I probably am cheap, but it does the job.

[AndreaModa]

By the way (for reference for those who don't have anti-virus, or for those whose anti-virus is about to run out), what is the best free anti-virus software that one can download from the internet?

Spybot is pretty good, though really you should stop being so cheap and buy the best that's out there at your local tech shop.

Agreed. For good, decent computer protection you should be paying between £40-£50 a year. It's a lot of money, but totally worth it when you think of the value of the items its protecting. I've paid around that amount now for 4 years to McAfee and touch wood, have never had a single issue with viruses, malware, trojans or attacks on my laptop. The stuff pays for itself many times over when the life of your laptop/pc is extended by years.

[Stramala]

By the way (for reference for those who don't have anti-virus, or for those whose anti-virus is about to run out), what is the best free anti-virus software that one can download from the internet?

Spybot is pretty good, though really you should stop being so cheap and buy the best that's out there at your local tech shop.

Agreed. For good, decent computer protection you should be paying between £40-£50 a year. It's a lot of money, but totally worth it when you think of the value of the items its protecting. I've paid around that amount now for 4 years to McAfee and touch wood, have never had a single issue with viruses, malware, trojans or attacks on my laptop. The stuff pays for itself many times over when the life of your laptop/pc is extended by years.

Any suggestion you need to spend big to protect your PC is a myth. There are many paid anti-virus products out there that are aren't worth the CD they're supplied on.

My perfect, 100% free combo would be;

ANTI-VIRUS
Avira - Probably the best free anti-virus out there. AVG can be a bit weak and let trojans, worms and other nasty things slip through the cracks once in a while, whereas Avast sometimes freaks out and implodes on itself (in my experience at least). Avira on the other hand is solid as a rock, and handily comes with a root-kit remover which even some paid anti-viruses do not. It also has the highest malware detection rate of any anti-virus at 99.8%.

FIREWALL
ZoneAlarm - Effective and free. Handily, unlike many other firewall programs, it monitors both incoming and outgoing connections. In my experience, solid as a rock, unlike another popular free program called Comodo, which takes over computers like a plague.

Router - The most effective firewall of them all is your own router! Make sure its built-in firewall is turned on at all times, it is far better at blocking malicious connections than any software based firewall.

PLAN B
Malwarebytes - If somehow all your defenses are broken down and a virus infiltrates your system, Malwarebytes can still save your PC. It does not provide any real time protection against malware, but once it has entered your system there is nothing better than Malwarebytes for tracking it down and killing it off.

Absolutely everything in that list is free. Well, except the router, but let's just assume you already have one of those.


And daysofyorr.com is still appearing, but after emailing the site admins there, they've told me they removed the rouge javascript file from their servers. F1 Rejects Forum won't stop trying to load it until Jamie delves into the HTML of the website and manually deletes the line of code which attempts to fetch the file from daysofyorr.

[DanielPT]

By the way (for reference for those who don't have anti-virus, or for those whose anti-virus is about to run out), what is the best free anti-virus software that one can download from the internet?

Spybot is pretty good, though really you should stop being so cheap and buy the best that's out there at your local tech shop.

Agreed. For good, decent computer protection you should be paying between £40-£50 a year. It's a lot of money, but totally worth it when you think of the value of the items its protecting. I've paid around that amount now for 4 years to McAfee and touch wood, have never had a single issue with viruses, malware, trojans or attacks on my laptop. The stuff pays for itself many times over when the life of your laptop/pc is extended by years.

I've spent years without any kind of protection or with some free anti-virus and never had any kind of problems with them. Although I don't know if my PC was used for some hacking or if someone has a big amount of collected data on me. But then, neither do any of you...

[Klon]

ANTI-VIRUS
Avira - Probably the best free anti-virus out there. AVG can be a bit weak and let trojans, worms and other nasty things slip through the cracks once in a while, whereas Avast sometimes freaks out and implodes on itself (in my experience at least). Avira on the other hand is solid as a rock, and handily comes with a root-kit remover which even some paid anti-viruses do not. It also has the highest malware detection rate of any anti-virus at 99.8%.

The problem is sometimes Avira lets things slip by the other ones recognise immediately which is why I personally switched to Avast, although I openly admit that at least one of those slips was due to an ID:10T error, but still I would rather go with Avast but it's not like Avira ain't good.

[dr-baker]

Does anybody run two lots of antivirus, or is it adviseable to only have one (eg. both Avira and AVG)?

[Stramala]

Does anybody run two lots of antivirus, or is it adviseable to only have one (eg. both Avira and AVG)?

Two at once = bad. They will essentially be like twin brothers who constantly fight against one another. Two similar anti-virus programs do not provide double the protection.

[dr-baker]

Does anybody run two lots of antivirus, or is it adviseable to only have one (eg. both Avira and AVG)?

Two at once = bad. They will essentially be like twin brothers who constantly fight against one another. Two similar anti-virus programs do not provide double the protection.

Thanks. I thought I had heard that before, but was unsure whether advice had moved on since then or not. Clearly it hasn't...

[Wizzie]

Guys, my browser (FireFox 10.0.2) has just been taken over by some thing called textsrv. While I don't know whether it's because of the forum issues or something completely different, a quick search led me to this thread on the Kaspersky forum: http://forum.kaspersky.com/index.php?showtopic=213280

[BlindCaveSalamander]

Guys, my browser (FireFox 10.0.2) has just been taken over by some thing called textsrv. While I don't know whether it's because of the forum issues or something completely different, a quick search led me to this thread on the Kaspersky forum: http://forum.kaspersky.com/index.php?showtopic=213280

I found another thread on the Norton forums that coverewd this; a solution was found with Malwarebytes, perhaps that could help?

[golic_2004]

I think the problem's getting worse, Norton Antivirus' picked up a trojan on my PC that I'm almost certain came from here. daysofyorr is also apparently loading up more and more things, before it took only an instant, now it's taking about a second or so. I suspect somebody set up shop there and is using that as a base of operations since daysofyorr/release.js is also coming up on autocomplete for a bunch of websites (.js being an extension for javascript files, which makes sense since I believe the exploit kit was coded in Java).

tl;dr, make sure your antivirus program is fully up-to-date, if you can, turn up the settings to aggressive or high or something along those lines until this is fixed.

I have had this happen to me as well, only not on the forum but on the front page. Seems like it's been this way since the 30 days of Rubens Retrospective.

[Nuppiz]

One thing that's also bugging me is that from time to time, the whole F1Rejects page (including the forum) cannot be accessed, but I can still browse other sites like usual. Weirdly enough, at the moment the problem seems to be exactly opposite: F1Rejects has so far been the only page where I've been able to visit in the last half an hour!

[dr-baker]

One thing that's also bugging me is that from time to time, the whole F1Rejects page (including the forum) cannot be accessed, but I can still browse other sites like usual.

I get that problem every so often too. It persists for maybe up to half-a-day, then the problem disappears again...

[Stramala]

I've only been accessing F1 Rejects via my college PCs for 2 weeks now and I've not noticed any such problems. All network traffic is directed via a proxy server and they use Sophos on all workstations so it's a bit trickier for viruses to find their way into the system. I am afraid to look this up at home on my new Dell XPS which I only purchased 3 weeks ago

It will be a test of fire for your brand new PC!

I think the virus has gone from the site. McAfee detected nothing and my laptop is still working fine with no Java popups

[tommykl]

I've stopped getting the error messages for a few days, and my computer hasn't had any problems. However, the forum seems to be a bit slow to load up, and I'm still getting the daysofyorr thing.

[East Londoner]

I've stopped getting the error messages for a few days, and my computer hasn't had any problems. However, the forum seems to be a bit slow to load up, and I'm still getting the daysofyorr thing.

This. I think we may have survived the problem. Could it have been those Indian hackers again?

[DanielPT]

I've stopped getting the error messages for a few days, and my computer hasn't had any problems. However, the forum seems to be a bit slow to load up, and I'm still getting the daysofyorr thing.

This. I think we may have survived the problem. Could it have been those Indian hackers again?

Still have those problems. I opened F1Rejects Forum today and a warning of an exploit was displayed by AVG...

[Wizzie]

I've stopped getting the error messages for a few days, and my computer hasn't had any problems. However, the forum seems to be a bit slow to load up, and I'm still getting the daysofyorr thing.

This. I think we may have survived the problem. Could it have been those Indian hackers again?

Still have those problems. I opened F1Rejects Forum today and a warning of an exploit was displayed by AVG...

AVG did the exact same thing for me a few hours ago

[CoopsII]

FWIW Ive had no problems on either my works PC or at home.

[Stramala]

I think we may have survived the problem. Could it have been those Indian hackers again?

Still have those problems. I opened F1Rejects Forum today and a warning of an exploit was displayed by AVG...

AVG did the exact same thing for me a few hours ago

Perhaps AVG and McAfee have different methods of virus detection. AVG may reference a central database of known malicious URLs, which would mean AVG would recognise the file users of the forums are trying to be directed to, even though the file is no longer there. Whereas McAfee may only block something when it actively tries to force its way into the system. That's my theory at least.

For reference, the URL is daysofyorr.com/release.js - there is no longer anything there (but don't bother looking just in case it re-appears!!!), but that is where the virus used to be located - note the .js, the file extension for scripts. The smart-filter at my college has the URL blocked for being "malicious content" however the rest of the domain is accessible. I have a feeling some programs have picked up this is a URL distribuing viruses and is now automatically blocking/warning of all access to it. Essentially, AVG is having a panic attack and wetting itself thinking there is something hiding in the closet, even though it already escaped and was subsequently killed. I think...

[Priceless]

For reference, the URL is daysofyorr.com/release.js - there is no longer anything there (but don't bother looking just in case it re-appears!!!), but that is where the virus used to be located - note the .js, the file extension for scripts. The smart-filter at my college has the URL blocked for being "malicious content" however the rest of the domain is accessible. I have a feeling some programs have picked up this is a URL distribuing viruses and is now automatically blocking/warning of all access to it. Essentially, AVG is having a panic attack and wetting itself thinking there is something hiding in the closet, even though it already escaped and was subsequently killed. I think...

As far as I can see, the code that triggers the exploit within F1 Rejects is still there. Even though on my computer nothing happens beyond the browser displaying "Waiting for daysofyorr.com...", I wouldn't say "it's gone" yet, as the "release.js" script was cloaked somehow when I made the first tests - when I tried to download it with an external tool I got a 404 page instead, however the actual response from the server was 200 (OK). It might actually be gone though, and what's triggering the alarms with some security software is the URL that F1 Rejects is still attempting to load - I just don't know for sure.

I have some safety features up that might be impeding the exploit from triggering here - I've blocked the IP range that the exploit directs to in my firewall, also I'm using Google Chrome on Windows (the exploit affects Firefox and Internet Explorer). I'll set up a virtual machine using an old copy of Windows XP I have, so I can test it with Firefox (I won't bother with IE) in a controlled environment, at a later time.

[Nuppiz]

Fact is, I had my school computer login credentials locked because a Trojan had been downloaded on one of the computers while I had been using it. And because F1Rejects is the only site I visit there that has had security problems, it might have been a result of the recent problems this site has faced.

BTW, I managed to talk my way out from that situation and got my login credentials back. But I don't think I'll be visiting F1Rejects on a school computer for a while, and I probably have to check my own PC as well...

Not blaming F1Rejects for anything, just wanted to tell you one of the worst things that can happen because of this.

[Sunshine_Baby_[IT]]

I've stopped getting the error messages for a few days, and my computer hasn't had any problems. However, the forum seems to be a bit slow to load up, and I'm still getting the daysofyorr thing.

Sometimes Kaspersky shows the error message and sometimes doesn't show it.

It seems it shows the message just when I enter Jean-Denis Deletraz memorial forum, Paul Stoddard memorial forum, Eric Van De Poele memorial forum, Perry McCarthy memorial forum, but it never show it when I enter HWNSNBM forum.
Probably in HWNSNBM it's HWNSNBM himself who save us from hackers.

[Paul Hayes]

Sorry for posting this as a thread, but just wanted to alert Jamie and Enoch to the fact that when I've visited the forum over the past few days, Norton has flashed up a warning on my computer of a blocked attack from "Malicious Toolkit Website 9".

This is on the main front page of the forum.

Just thought I'd let you know, in case something undesirable has crept into the system somewhere.

Cheers,
Paul

[shinji]

Sure if you didn't know, over here we were discussing the possibility of having to move to a new forum due to the level of dodgy code and stuff (I'm not too hot on that kinda jazz) lying around in the site.

[Paul Hayes]

Yes, I realised soon after posting the thread that I'd accidentally put it in the wrong place. Sorry all!

[golic_2004]

FAIL

[Yannick]

On Sunday, the f1rejects.com server was dead slow for a while near noon CET time. And in the past few days, I could not access the board either. There clearly is something wrong. I hope it's not those Indian hackers again. But how could they? Narain did not receive an award ...

[tristan1117]

Alright, I was on a school computer when I opened this forum. Suddenly, my virus scan came up and said that a trojan had been downloaded onto my network file. My school still has Firefox 3.6 so I guess that's where the problem is from.

[Nuppiz]

Alright, I was on a school computer when I opened this forum. Suddenly, my virus scan came up and said that a trojan had been downloaded onto my network file. My school still has Firefox 3.6 so I guess that's where the problem is from.

I got my school computer login credentials suspended because a trojan had been downloaded on one of the computers there while I was using it. And they're also pretty ancient in that they still use Firefox 4.0.1, and it's supposed to be a top-of-the-line computer school...

[Stramala]

If this is the explot kit I think it is, it means it was first coded and released into the wild almost two years ago. How it is leaking into people's computers I have no idea, it can't even get past my router's firewall at my home, McAfee doesn't have to do a thing becasue the logs on my router are showing it is blocking connections. It's something of a disgrace that education establishments are being infected by this stuff after spending thousands of pounds, whereas my £30 router and free McAfee subscription are locking out the trojan completely.

Anyway, yesterday I send an email to the head honchos of the website, and they have yet to reply. For once, I think we have reason to be critical of them for something!

[tristan1117]

Alright, I was on a school computer when I opened this forum. Suddenly, my virus scan came up and said that a trojan had been downloaded onto my network file. My school still has Firefox 3.6 so I guess that's where the problem is from.

I got my school computer login credentials suspended because a trojan had been downloaded on one of the computers there while I was using it. And they're also pretty ancient in that they still use Firefox 4.0.1, and it's supposed to be a top-of-the-line computer school...

I've noticed that the exploit doesn't work on Macs (which I use at home) even though the http://www.daysofyorr.com still shows up.

(Furiously knocks on wood)

[dinizintheoven]

For what it's worth, I also have a Mac, and though I'd usually use Chrome for my general internetting, I've been looking at this forum with Safari, and I never see the daysofyorr malarkey at the bottom of the page.

[Nuppiz]

Latest virus scan: 5 files with 20 recognitions, all having the same exploit codes in them. That and 64 hidden objects which my scanner cannot read!

Tip: if the exploit this site unfortunately still seems to be infected with manages to get on your computer, it usually lurks in the AppData/LocalLow/Sun folder or the Temp folder.