AJ Hacked

[Rapture]

Unfortunately AJ was brought down earlier today by a malicious user.

Don't worry your information is safe and the site has once again been reverted to a recent back up. When it rains it pours.


This user posted a link to a malicious applet earlier today in the Interface/AddOn section (http://www.arenajunkies.com/showthread.php?t=23814). If you clicked on this link earlier PLEASE run a virus scan and make sure your computer is clear of any threats. However, it would seem that this site was the target of his attacks.

We can not say it enough - Please use the report button to report ANYTHING you may even remotely suspect as being suspicious.


Rest assured everything has been secured. The necessary precautions have been taken to safe guard us even further.

[Bio]

He prob sucks at arena :(

[Conradical]

wow fuk

p.s. second FUCK

[Rollyat]

It was definitely some very large guy in his mid thirties who has become too large to leave his mother's basement so he's resorted to watching the classic 90's movie "Hackers" and dwelling on his insane internet dominance.

[Rapture]

An update as to our best guess to the virus in question.

It would seem it was a variant of the i-worm/stration virus. To quote AVG's virus encyclopedia.

Payload:

Various modifications of the worm try to download (via http) one or more files from the Internet. Server and file names are variable.

The Worm blocks some security software, for example various firewalls, antivirus programs and so on. It stops services belonging to that software, or redirects servers.

In the case of AVG (but also for many other antivirus applications), the worm disables the download of update files by modifying theHostsfile. It redirects the update server addresses in this file. (Explanation: The TCP/IP stack uses this file as its first choice when performing translation of IP addresses from the server's name. When the name is found in the file, the IP stack does not query the DNS servers).

Latest news is that new versions of the worm are using process injecting. This technology allows the worm to hide itself from firewalls. Usual victims are mainly Internet Explorer and other browsers.

Some versions of the worm can cause a crash of Explorer, or can disable the save command in notepad, or can disable usage ofRegeditor can download other malware from the Internet.

Update-KB.exe, upon running, will sometimes display a message about successful installation.
http://www.grisoft.com/us.virbase.idv-288751

[Kags]

i heard it was ziss

[Neokrebs]

fucking neokrebs

[Duckers]

IT WAS MEMPHIS AND DOCHOLIDAY< OMG.

[Quantity]

It was the entire <Y U DODGIN> guild from Hydraxis-Emberstorm after their inferiority complex caught up with them, led by their fearless leader Missjazz.

[etherimp]

Did a lot of threads/posts get lost with the crash?

[Rapture]

Did a lot of threads/posts get lost with the crash?

Unfortunately everything that happened since our last backup (Around 6AM this morning) was lost. :(

[str4t]

Unfortunately everything that happened since our last backup (Around 6AM this morning) was lost. :(

OMG I made a huge long double mage guide for 2v2's. /cry

[Kisaa]

Wow, I read that post earlier and thought to myself that it was way too suspicious and I didn't click it. Should have reported it, I feel dumb right now.

[dredhed]

Wow, I read that post earlier and thought to myself that it was way too suspicious and I didn't click it. Should have reported it, I feel dumb right now.

I Think its safe you say, this was all your fault.

[Slilent]

Wow, I read that post earlier and thought to myself that it was way too suspicious and I didn't click it. Should have reported it, I feel dumb right now.

Reported you in-game.

[Frostydude]

It was the entire <Y U DODGIN> guild from Hydraxis-Emberstorm after their inferiority complex caught up with them, led by their fearless leader Missjazz.

Did I ever hurt your feelings in arena?

[Dulu]

I bet it was Tyveris.

(>'.')>

[Disparity]

It was the entire <Y U DODGIN> guild from Hydraxis-Emberstorm after their inferiority complex caught up with them, led by their fearless leader Missjazz.

NO U

[Grombringal]

Thanks god I'm using Firefox and NoScript, would've got owned :o

[Ralppi]

:o

[nawty]

clicked it and it just refused to open anything, computer > me clearly.

[Quantity]

Did I ever hurt your feelings in arena?

Judging by your bad ratings on a bad battlegroup, I'm going to say...

No.

[Blakeyohn]

So, any tips on removing said virus? I ran AVG a few times to no avail and then just said screw it and did a system restore. I feel kind of dumb for clicking on that link like 8 times >.>

[Rapture]

So, any tips on removing said virus? I ran AVG a few times to no avail and then just said screw it and did a system restore. I feel kind of dumb for clicking on that link like 8 times >.>

The best information we have now is that it will show up as the i-worm/stration virus.
Here is the description of it:
http://free.grisoft.com/ww.virbase.idv-288748

Hopefully AVG picked it up and removed it for you. Make sure you have updated the virus definitions. AVG also has a free utility that will remove it for you - should be run in Safe Mode:
http://free.grisoft.com/ww.virus-removal?uti=Vcleaner

If you are still concerned about it - you can reformat and reinstall your OS.

[Blakeyohn]

Going to run the vcleaner just to be safe. By the way, anyone else infected, I would advise you not to log onto AIM, MSN, etc. as the virus will spread itself to others through instant-messaging programs without your knowledge.

[Snacks]

I think noscript told me to go fuck myself. How could you tell you had it?

[Blakeyohn]

Warnings from AVG popped up and told me I had it. Other than that, not sure if you can really tell. I knew I had it because I use IE (lolz)

[enareksi]

http://www.getfirefox.net/firefox2/firefox-spread-btn-5.png

[Disparity]

QUANTITY IS A LEGEND

HE USED HIS SPECIAL POWERS TO HAX SITE

[Quantity]

ur cute

[Archhlock]

does the virus come from the link u gave or from the link there was another link given to the malicious website?

[Rapture]

does the virus come from the link u gave or from the link there was another link given to the malicious website?

The link to the virus no longer exists on the website. It has been edited out.

[Alethasis]

yeah i had just typed up a huge resto shaman disc priest 2v2 strat. guess i'll re-type it...

[Supahfly]

WOW.