Atlantic Roleplay Community Boards

Cal Hurst · Posted: Tue Apr 03, 2007 11:30 pm Post subject: Siaron Nuar!!!!

You went to www . uo-x .com and are mass-messaging people with links to go there. This is another warning for people not to go to this board, and for Siaron to IMMEDIATELY do a virus scan and change ALL his passwords!
_________________

Halister Marner · **Site Programmer** Joined: 05 Oct 2006 Posts: 2232

Please add spaces into the link if you are directly posting it, in case people accidentally click on the hyperlinked text.

Thanks for the warning though, I'll have to dissect it and see which IP it's pointing towards.
_________________
"There are those who dream to escape reality, and there are those who dream to change it."

Cal Hurst · Posted: Tue Apr 03, 2007 11:45 pm Post subject:

My B. Thanks for fixing.
_________________

Halister Marner · **Site Programmer** Joined: 05 Oct 2006 Posts: 2232

I cracked it open and had a peek inside.

The virus itself requires no user intervention to install on an un-patched system from the webpage itself. The virus takes advantage of an Iframe vulnerability (which has been patched today by Microsoft) to install itself (html.Iframe.BOF). The virus itself is UNDETECTED by all the major AV vendors - I'm working on getting it added to the databases for a few anti virus products tonight.

Its a very simple program - it logs your keys and relays them back, it also uses messenger windows to send out spam to all contacts on your list. That is essentially the entirety of it's function.

For those who are infected, I suggest asking for help to get the virus removed as soon as possible, I will update this post when it has been added to the database definitions and direct anyone infected to an online scanner.

In the meantime, removal should be as simple as locating the installed virus and deleting the associated files. If anyone needs help - PM me here.
_________________
"There are those who dream to escape reality, and there are those who dream to change it."

Siaron Nuar · Adventurer Joined: 12 Jan 2005 Posts: 66

Vaen thxs for making me aware of this and to inform everyone here and all around, I have searched my comp for those nasty files and none to be found, I ran that online scanner that halister suggested aswell as my other antivirus protection and all of them say the same thing, I am not infected....