READ THE RULES: Click here

Follow us on Facebook: https://www.facebook.com/xentax/ :)

XeNTaX attacked by virus

Read rules and news about the XeNTaX Game Discussion Forum
User avatar
Mr.Mouse
Site Admin
Posts: 4039
Joined: Wed Jan 15, 2003 6:45 pm
Location: Dungeons of Doom
Has thanked: 412 times
Been thanked: 559 times
Contact:

XeNTaX attacked by virus

Post by Mr.Mouse » Sat Aug 28, 2010 7:56 am

XeNTaX attacked by virus
August 28th, 2010 by Mr.Mouse and Craptain

If you wondered why we were down, we suffered an attack by a bot. The last few days our host and us worked hard to remove the infection. We will spend some more time to update the code to latest versions as we go. Sorry for the inconvenience.

Webmaster note: We were hit by a virus called Gumblar. It was a more sophisticated virus than usual. It used the password stored in the scp client of one of our webmasters to gain access to our server. Once it had access, it added obfuscated and encoded javascript to all index.html, index.php, etc files, in order to spread the infection.

If you have visited the xentax main site or any of the xentax subdomains from the 25th of august to the 28th, it’s probably a good idea to run a virus scanner. If you’re a webmaster who stores ftp or scp passwords in a local client, check your site’s source code for suspicious scripts.

We are still cleaning up this shit, and are taking this opportunity to upgrade our forum and blog software as well. We will be busy with this at least until sunday, because as usual real life gets in the way: a friend of ours is getting married today.
Sorry for the downtime and the inconvenience it may have caused.

Final edit: The javascript exploits a weakness in adobe acrobat reader and flash, probably only in Windows. So if you run Linux or other Unix clones, you get to be smug and self satisfied that this particular virus doesn’t target you. If you run OSX you can remain clueless about this whole conversation.

invisghost
advanced
Posts: 55
Joined: Tue Jul 13, 2010 7:16 pm
Has thanked: 1 time
Been thanked: 9 times

Re: XeNTaX attacked by virus

Post by invisghost » Sat Aug 28, 2010 11:22 am

:P I was noticing the javascript there during those days. Nod32 kept saying it was blocking the connections. Lucky me right? 8)

Energy
ultra-n00b
Posts: 8
Joined: Fri Mar 19, 2010 2:05 am
Has thanked: 9 times
Been thanked: 1 time

Re: XeNTaX attacked by virus

Post by Energy » Sat Aug 28, 2010 11:41 am

Oh and my comp full with trojan horses. I delete some of them (shit) but the new is coming :(
Avast blocking conection but virus come. So you need new antivurs. Microsoft Security Essentials safe my comp for now and delete 5 trojan in windows temp folder and interenet temp folder. I think my comp is clear now.

User avatar
firsak
advanced
Posts: 64
Joined: Wed Dec 16, 2009 12:32 pm
Location: Russia
Has thanked: 20 times
Been thanked: 10 times
Contact:

Re: XeNTaX attacked by virus

Post by firsak » Sat Aug 28, 2010 12:32 pm

"Mark forums read" stopped working for me.

eycaramba
veteran
Posts: 86
Joined: Wed Sep 02, 2009 1:52 pm
Has thanked: 30 times
Been thanked: 1 time

Re: XeNTaX attacked by virus

Post by eycaramba » Sat Aug 28, 2010 3:00 pm

I am glad I have an all-in-one antivirus software :keke:
It blocked the attack right away ^~^

I am happy xentax is back 8D

piecemontee
advanced
Posts: 50
Joined: Mon Aug 03, 2009 9:34 pm
Has thanked: 5 times
Been thanked: 16 times
Contact:

Re: XeNTaX attacked by virus

Post by piecemontee » Sat Aug 28, 2010 5:26 pm

I am a looser :(
avast warned me, I thought "hey it's xentax, how dumb is this virus scanner?"
and I added an exception to the realtime protection...

how dumb am I :cry:
Last edited by piecemontee on Sat Aug 28, 2010 10:39 pm, edited 1 time in total.

invisghost
advanced
Posts: 55
Joined: Tue Jul 13, 2010 7:16 pm
Has thanked: 1 time
Been thanked: 9 times

Re: XeNTaX attacked by virus

Post by invisghost » Sat Aug 28, 2010 7:50 pm

Lol I've had nod32 for about 3 years now and never once had a virus get through. I like it cause it doesn't bog down your computer like those other ones do. I need my computer's proformance for getting good FPS in pcsx2 :P

User avatar
XpoZed
veteran
Posts: 144
Joined: Sat Oct 24, 2009 5:08 pm
Location: Bulgaria
Has thanked: 2 times
Been thanked: 45 times
Contact:

Re: XeNTaX attacked by virus

Post by XpoZed » Sat Aug 28, 2010 8:45 pm

I don't think there was a virus that is downloaded on your PC. It's more likely a session/cookie stealer or something.
Anyway, if someone can provide me with a sample (exe,dll,ocx,sys, etc.) i'll be happy to reverse engineer it (that's my main hobby these days ;)).

piecemontee
advanced
Posts: 50
Joined: Mon Aug 03, 2009 9:34 pm
Has thanked: 5 times
Been thanked: 16 times
Contact:

Re: XeNTaX attacked by virus

Post by piecemontee » Sat Aug 28, 2010 10:42 pm

XpoZed wrote:I don't think there was a virus that is downloaded on your PC. It's more likely a session/cookie stealer or something.
Anyway, if someone can provide me with a sample (exe,dll,ocx,sys, etc.) i'll be happy to reverse engineer it (that's my main hobby these days ;)).
Yes U're right, I ran a full scan and nothing stood out.
It seems to hack FTP account throught filezilla to propagate throught javascript,
I checked my website and no javascript was added,

Sheen
beginner
Posts: 25
Joined: Tue Mar 02, 2010 7:29 pm
Has thanked: 8 times
Been thanked: 3 times

Re: XeNTaX attacked by virus

Post by Sheen » Sat Aug 28, 2010 11:17 pm

I'm happy to see XentaX running up again. Some days ago Avast! blocked my conection to this site warning me there was a virus, or something like that. :cry:

Regards.

User avatar
MrAdults
Moderator
Posts: 1007
Joined: Mon Mar 23, 2009 2:57 am
Has thanked: 44 times
Been thanked: 498 times

Re: XeNTaX attacked by virus

Post by MrAdults » Sun Aug 29, 2010 10:27 am

Glad to see things up and running again so quickly. Good work, Mr.Mouse and company. :)

User avatar
chrrox
Moderator
Posts: 2537
Joined: Sun May 18, 2008 3:01 pm
Has thanked: 57 times
Been thanked: 1263 times

Re: XeNTaX attacked by virus

Post by chrrox » Sun Aug 29, 2010 2:18 pm

I noticed a small bug the mark forum read no longer works after the site restore.

User avatar
Mr.Mouse
Site Admin
Posts: 4039
Joined: Wed Jan 15, 2003 6:45 pm
Location: Dungeons of Doom
Has thanked: 412 times
Been thanked: 559 times
Contact:

Re: XeNTaX attacked by virus

Post by Mr.Mouse » Sun Aug 29, 2010 3:41 pm

Actually I does work for me. Cache problem? Does anyone else have this bug?

User avatar
chrrox
Moderator
Posts: 2537
Joined: Sun May 18, 2008 3:01 pm
Has thanked: 57 times
Been thanked: 1263 times

Re: XeNTaX attacked by virus

Post by chrrox » Sun Aug 29, 2010 4:10 pm

im using firefox its only the mark forum read that does not work for me i can go into any thread and the mark read works.

User avatar
XpoZed
veteran
Posts: 144
Joined: Sat Oct 24, 2009 5:08 pm
Location: Bulgaria
Has thanked: 2 times
Been thanked: 45 times
Contact:

Re: XeNTaX attacked by virus

Post by XpoZed » Sun Aug 29, 2010 4:14 pm

Dont know about that, but you should integrate the "tanks" system back after the update.

Post Reply