Just tried to go and have a nose around there and looks like someone has hacked or virused the site. My anti virus goes nuts and the window locks up

Information I ahve got is

CME-875


This worm spreads by internet exploiting MS Windows LSASS service vulnerability described in MS Security Bulletin MS04-011.

Installation:
When the worm is launched it copies itself as windows.exe and attach.tmp to Windows System Directory and registers itself as WIN in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key in Windows Registry.

Spreading: internet
Worm searches IP addresses and when it finds a vulnerable computer it uses the exploit for downloading a copy of itself and its launching.

This is not to bash any other boards but to let you know so you are able to protect your computer and maybe update your anti virus software accordingly

 

My best guess would be it's in one of the banner ads.

 

doesnt happen on homepage but does in all attempts to get past using the topic links which should throw up a different banner link each time. Just tried now, 2 attempts, 2 banners up, tempting toys and stuckakid and same problem happens, looks like its trying to run some chinese script in a prompt box.

 

Norton showed an intrusion attempt when I tried to go there earlier.

 

I don't use Norton....

but Tfans killed IE on both my PCs.

 

I signed up there. but i rarely go. i just got a weird email from them. thats about it.

 

IE froze up at first, then it worked, and now it's frozen again

 

http://www.tfans.com/talk/index.php?showtopic=44207

Virus-laced messages sent out to users... either a lot of people have mail addresses set to display on the board, or they have actually been compromised and their user database grabbed.

 

I thought TFans.com was the virus?

 

I got the message but I do not have my e-mail to be displayed (IIRC). Of course, 1) I almost never go there 2) I could see the link was a virus. You'd have to be stupid not to.

 

Lets not start that, shall we.

 

That seriously isn't good, then... odds are someone's got full SQL and/or FTP rights on the server. Passwords are likely to be stored as MD5 hashes, but any dictionary words or commonly used combinations would be easy to look up in a hash database -- mostly a problem for staff, but if anyone's got login/mail/pass details the same for a bunch of sites (always a bad idea, but it happens) they should go round updating them.

 

Is it just me, or are the staff's reactions in the thread Denyer linked hilarious? "Why is the staff acting like douches? Instead of trying to fix the problem with your board, you belittle your members." "Cry me a river..."

 

Well, they can't really do anything -- other than make sure all staff passwords are changed, advise everyone else to change their passwords, etc. Still won't make any difference if someone can walk into their SQL database or modify files on the server (if you get FTP access and db user accounts haven't been carefully restricted in their permissions, the former usually follows the latter...)

 

Doesn't sound good.

 

I just finished clearing out my computer of 5 trojans that I just got in my temporary internet files from TFans....I went to their home page, clicked on talk and Bam my Macafee went Nuts! I scanned my computer and it found 5 trojan viruses in my Temporary internet files! Guess I wont be going there for a while.

 

TFans has been taken down for repairs. We're working to fix this ASAP. We apologize for the inconvienve this has caused.

 

Just as a general bit of advice: if it's your machine, ditch Internet Explorer, otherwise any website has the potential to do the same to you. Microsoft are lethargic about fixing security holes, even assuming you have Windows set up to automatically download and apply security patches.

Opera's free now, or there's Firefox. If it isn't your machine... er, you're fucked. Although you could run Firefox off a USB flash drive.

 

im pretty sure it was from tfans...i scan everyday and had just scanned this morning and no automatic downloads occured between the time of the scan this AM and the time I tried to go on tfans. I have dial up, i scanned the computer...showered and got dressed...signed on went to tfans and that is when the bells went off exactly how everyone else described...i dont know if they had trojans, however when I scanned I did and they were not there an hour before. Everything is fine now...McAfee Virus Scan got rid of the viruses.