We were hacked earlier today - you may have noticed that you were bombarded by popus etc. for "spy-shredder.com" instead of being able to see the forums.

Hackers often gain access to websites through Front Page Extensions which are often (as was the case here) turned "on" by default on the server. I would recommend that everyone check to make sure that Front Page extensions are "off" on your server and manually remove all of the files to prevent your own website from being hacked.

It started around 1:00 AM est

Wasn't that a trip? What a mess. So glad it's better now.

This place is like crack for me. I've had the jitters all day.

Sorry it took me so long to discover - I hadn't checked the forums this morning as I was busy with other things. It was not a good time to be hacked

A member emailed me about it and once I found out there was a problem it only took 10 minutes to fix.

Yeah I thought that was weird this morning.My anti-virus protection tore it up and spit it out,it was trying to download some crap onto my computer which my antivirus blocked.

yes, it was nuts. my spybot and ad-aware took care of 'em though. lol

I told my wife she couldn't download anymore Sims stuff because I figured that's where it came from. She just made me apologize...

Now that is real trouble - kinda like the boy who cried "wolf" huh? I am sure the Sims stuff will cause a mess yet and next time she wont believe you.

Women ...

I stay in the dawg house 90% of the time man! lol

lots of people been hacked lately, I saved the hack page before I restored the original http://propertyhogs.com/index_hacked.html

HAS AOREIC BEEN HACKED AGAIN TODAY? I get virus detection warnings every time I click on a link or forum message. Is there a separate email address to alert the admin about possible hacking?

Chris, I had the same problem this morning. Was surfing around on the forums this morning and got some anti-spyware message, and got rerouted to a some dang download page. It only happed once, and no harm was done.

I hope the problem was fixed.

Yes, happened to me too....

It should be fixed now - thanks for the "heads up".

i am still getting virus notices - Trojan and am going to have to sign off

I'm getting them today, too, so I'm in the middle of a little "cleanup" on my system.

There's still a virus embeded in the website. My AV software keeps picking it up. I can't stay on long, before it shuts down my IE browser.

Please scan the files!

Still getting the virus notifications and it 'jumped' me to this address:

http://www.primosearch.com/jump/?affiliate=free20

then to an antivirus software page. That's funny.

Good luck gettin this cleaned up!

I thought I had it the first time but did get it now - thanks for your patience

I'm, still getting a notification. FYI

The code which was causing the redirects - and would have been causing your McAfee notifications is gone and you should not be being redirected. Perhaps your browser is using old code from its cache?

Regarding the JS/Wonka notifications you receive from your Anti Virus or spyware program - as found in the Cnet forums - > This does not necessarily mean that a virus has been found. It merely means that HTML code was found which attempts to activate additional executable code without the user's express permission.

Note: this detection may be triggered by merely visiting a web page that contains malicious code. It does not necessarily mean your machine has been compromised.

Removal Instructions

If this is being detected in the Temporary Internet Files directory, in order to remove unwanted files from your computer, you will have to remove all off-line content from your PC.

Removal:

http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=47231

In short, the notifications are caused because the old forum page is in your Internet Temporary files - it does not mean you have a virus. The notification is caused because of the redirection code (the executable code mentioned above) that hackers placed on our site is still on pages in your cache and your virus program is finding this code.

This looks like the same microsoft virus or whatever from a few months ago saying you need to download the microsoft program.

Do you guys have the newest security patches from microsoft?

A tip if yo uever see a screen that pops up saying you need to install do not click the cancel button!!!!!!The virus is set up to load on the cancel or install instead just x out of the screen.If your computer freezes shut down everything and restart.

Clearing the cache mentioned above is a good idea.Sometimes if you get a reall nasty virus removing it isn't easy even if you delete and clear the cache.The reason is it put's a hidden system folder that reload it onto your computer each time you delete it.

What you have to do then is go to properties on internet explorer and then the advanced tab and check show system hidden files and folders then restart in safemode so only regular programs are running because it won't let you delete a program that is running.

Look for hidden files or start ups you are not familiar with.You will have to get a list from a website of the differences between valid extensions and a virus then delete the program and remove from startup.

If you are not comfortable doing this get a computer person to help.You might have to also delete strings from the registry but before doing that you would want a backup of your hardrive files.

Anyways if you are ever unsure about something don't click on it,you can always research further and determine later if you need it or not.

As far as uploading security updates or interent explorer updates if your computer acts squirrely after an install but the download was from microsoft it's probably not a virus but a corrupted download and in that case you delete the update and do a clean re-install.

Everyone should make it a weekly checklist to ensure the security of your sites. VB forums are particularly vulnerable.

Still have a problem?

No the issue was solved long ago. This thread is several months old

i am always afraid of getting hacked too, but i see this is an old thread

What is that panic guys. there is no smock without fire. Keep going.

http://www.planorealestateadvisor.com
http://www.planorealty.blogspot.com

Also, I would recommend to transfer this forum software to VB which is much more secure.

The problem here was not a software security issue - it was a server security issue. The software is very secure.

Yeah I thought that was weird this morning.My anti-virus protection tore it up and spit it out,it was trying to download some crap onto my computer which my antivirus blocked.

The thread you are responding to is 2 years old. If your antivirus alerted you to anything it was likely just a cookie or a web beacon used by Google in the advertising.

Patrishia's 3rd post - copying our Super poster - and look, you have to be kidding - LOL