I Believe this site has been HACKED!

[mdj101]

Hi All,

When opening the forum in the browser if you get a box asking you to install a microsoft add on and to accept if you trust this site DONT it's a virus.

Im trying to get hold of Roger? anyone have his direct number!

[canarypam]

Oh no! I've already done it this morning!

[mdj101]

If anyone has done this I advise you update your existing anti-spyware / anti-virus software.

If you haven't got any i can recommend Zone Alarm Internet Security Suite. Its only $49 dollars so about £25 and you get a license to enable you to use it on 3 different PC's MUCH MUCH better than Nasty Norton

You Get.

FIREWALL
ANTI-VIRUS
ANTI-SPYWARE
ANTI-SPAM

All are excellent and business class products. It's this product that allerted me to this hack!

http://www.zonealarm.com/store/conte...s/sku_list.jsp

order above.

[Paula D-S]

<blockquote id="quote" class="ffs">quote:Originally posted by mdj101
Hi All,

When opening the forum in the browser if you get a box asking you to install a microsoft add on and to accept if you trust this site DONT it's a virus.

Im trying to get hold of Roger? anyone have his direct number!
[/quote]

Email John at info@orlandovillas.com

[floridadreamvilla.co.uk]

Thanks for the email to alert us.

I have found the cause of the problem and fixed it so the forums should be safe to use now. Our advice would be to never click to accept anything you do not understand when browsing any forums. I can confirm that our forums DO NOT need any Microsoft ad-on's so if you ever see a prompt about it then ignore it.

I'm now off to look into the site logs and see who tried to hack the forums, how they did it and who they are so we can make sure it never happens again.

[floridadreamvilla.co.uk]

A quick update for anyone interested:

We've now traced exactly what happened, including the exact sequence of events. It was a hacker from Belarus who created a new user account yesterday and used a very obscure hack to grant himself administrator privileges on the forums.

He then altered the description of the Ask The Experts section to include a hidden link to a very dodgy site which ran a script on there, which resulted in the pop-up some of you have seen.

Needless to say, we have taken measures to ensure they do not get access to the forums again and are patching the software as we speak to prevent the hack being used again.

[Lynnes]

To a non techo like me John does this mean that our computers are OK. I know i saw this last night but have been at work all day and have not looked at my home computer.

[floridadreamvilla.co.uk]

You will need to scan your computer with a reputable anti-virus package, updated to include the latest virus signatures I'm afraid.

<blockquote id="quote" class="ffs">quote:Originally posted by Lynnes
To a non techo like me John does this mean that our computers are OK. I know i saw this last night but have been at work all day and have not looked at my home computer.
[/quote]

[Lynnes]

Thanks John will do that as soon as I get home.

[DaveL]

If you go to the folder below

C:\WINDOWS\system32

you may find the following files at the top, if you sort it by date

proper.exe
winter.exe
bronto.dll

these are the ones it tried to install on my system this morning. It also tried to amend the startup file so that they would restart on each system reboot.

Dave