Important Virus Warning!! Please Read

  • The masquerade of murder returns! A new game of Vampires Amongst Us has begun. Unmask the killers, trust no one, and try to survive the night. Find out more and sign up now!
Status
Not open for further replies.
Hi all,

I'm a network administrator\engineer by trade. These types of attacks are becoming more and more common everyday unfortunately, we have seen many, many web sites attacked this way, they are known these days as drive by attacks. I literally can not count the amount of affected machines we have cleaned in the last 12 months. For those using Mac OS, android, Linux etc, you will find that you are not going to be affected. 99% of malicious software will only affect Windows machines simply because they make up over 90% of the PC OS market.

Some web sites of note that have been used to launch these attacks are US government web sites, the UN web site, youtube. The company I work for administors and supports well over 20 smb networks comprising about 60 servers and just 600 over seats (users) and as I said before we have seen these infections occur on a weekly basis. I recommend PC Tools spyware doctor if you can spare about $50 US, this will provide you with 3 licenses so if you have more than 1 PC as most do these days it is well worth it. This antimalware package has found infections on machines that hjave come up as clean using 3 different packages. Microsoft Security Essentials is a free download from Microsoft and isn't too bad as well as Malwarebytes antimalware. If you have any questions please feel free to ask.
 
Oh I forgot to add this to that last post, Massive congrats and a tip of the hat to Disciple of Nagash for his actions and the fact that he let everyone know. That is the most responsible behaviour I have seen in my many years in the IT industry, believe me most forum owners\admins would have said nothing, shut the site down for maintanence and let their users wonder where the hell they got a virus. Big, big effort on the part of Nagash. Serioulsy us users of this forum don't know how lucky we are to have you. Awesome job. Credit where credit is due.
 
Hi Doobinator,

Thank you very much. My members come first so as soon as I realised it could affect them I shut the site down.
Cheers for the clarificaition on the macs. If you have any recommendations on how to make Carpe Noctem more secure I would really appreciate, either here or via PM.

I completley forgot about PC Tools Spyware Doctor. I also highly recommend this over all the others out there. It really is the best, but it is expensive. Suppose you get what you pay for!
 
Umm DoN, I'm still finding it very difficult to access CN... takes about ten tries before it just loads a list of web-pages, then I refresh again and I see the familiar CN.
 
Count Darvaleth said:
Umm DoN, I'm still finding it very difficult to access CN... takes about ten tries before it just loads a list of web-pages, then I refresh again and I see the familiar CN.

Have you cleared your cache, temp files and history in your browser?

Mioum said:
Just to be sure, if anyone can tell me if those 2 files should be deleted:

GDIFONTCACHEV1.dat
prvlcl.dat

Not the same that DoN talked about but I just want to be sure as they are in the same place I found the IconCache file.

For the first one I found this:

http://help.lockergnome.com/general/GDIPFONTCACHEV1-dat--ftopict54210.html

I would suggest as they do, to move it to a folder elsewhere and see if any programs complain. If after a while they don't you should be ok to delete it, however on some other sites it does mention that file is actually ok.

As for your other one, it appears to be for your Antivirus: http://forums.avg.com/ww-en/avg-free-forum?sec=thread&act=show&id=62111
 
This is using Google Chrome. I'll try and get a screenshot in a mo...

EDIT: It only seems to happen the first few times I try and access CN. After I've got in, it works every time, even if I close my browser and re-open it...
 
That could be an issue with our host, as there have been some changes there, one of the reasons why we are shutting down for planned maintenance this weekend.

I am using Chrome and logged in no issues. Let me check with other browsers.
 
Nope, checked with Firefox and IE as well and logged in on first click. This one doesn't look to be an issue with the site. Have you full checked your PC for any bugs?
 
Aha - ironcache.db is ok! So don't worry about that one either, it is a database used by your PC. However for those who have deleted it, that is ok as it means you PC should rebuild a fresh "clean" copy incase your previous one was infected.

What files are you showing Darvaleth?

Don't forget, that whilst CN is now clean this attack is happening to a lot of sites, so you may get infected elsewhere sadly.....
 
I was attacked, thought it odd that a "windows defender" window appeared while browsing the forums its alright, im more then capable of removing it, and thanks Disciple for doing all the ground work and listing the file names.
 
So apart from Darvaleth has anyone else had any issues?

I would also recommend the following as a secure browser: xdark firefox - I am looking for a link as it has changed since I got it. It is a versions of Firefox with some really good addons installed to protect your browser and therefore your PC.

I have got hold of Spyware Doctor, currently doing a scan.....
 
Yes that's in , however only download it from a torrent site if you know what you are doing. It is a free program so should not contain any cracks etc, hence it should not have any malware etc in there. Scan it before installing.

But one you install it, good browser.
 
Luckily didnt find any of those. thanks for the heads up. Turns oout whether your mortal or undead, you still at risk of viruses :P
 
Disciple of Nagash said:
Mioum said:
Just to be sure, if anyone can tell me if those 2 files should be deleted:

GDIFONTCACHEV1.dat
prvlcl.dat

Not the same that DoN talked about but I just want to be sure as they are in the same place I found the IconCache file.

For the first one I found this:

http://help.lockergnome.com/general/GDIPFONTCACHEV1-dat--ftopict54210.html

I would suggest as they do, to move it to a folder elsewhere and see if any programs complain. If after a while they don't you should be ok to delete it, however on some other sites it does mention that file is actually ok.

As for your other one, it appears to be for your Antivirus: http://forums.avg.com/ww-en/avg-free-forum?sec=thread&act=show&id=62111

desfer said:
the file mioum wrote about isnt anything to be afraid of, i checked the date it was last modified and mine says about 5 months ago, so i dont believe its anything dangerous. Also i think that if you restart your computer the iconcache.db file is recreated. Its created when your shutting down your pc, when it saves the changes that have been made.

Thanks to both of you :)

So even the IronCache wasn't a threat after all, it's good, that means that AVG stopped it, good to know that it works :p
 
Status
Not open for further replies.

About us

  • Our community has been around for many years and pride ourselves on offering unbiased, critical discussion among people of all different backgrounds. We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu