Yesterday, I came here and I got this message saying something about Microsoft Data Services wants to run.  Then a message box appeared that said "Click OK to Run Active X Control on this webpage".  So I clicked OK, it loaded a blank page with a blank java screen, then Norton Firewall popped up telling me that it just blocked an intrusion attempt  :o

I rebooted my PC and got back here fine, but just moments earlier, it happened again.  What is this all about?

Yesterday, I came here and I got this message saying something about Microsoft Data Services wants to run.  Then a message box appeared that said "Click OK to Run Active X Control on this webpage".  So I clicked OK, it loaded a blank page with a blank java screen, then Norton Firewall popped up telling me that it just blocked an intrusion attempt  :o

I rebooted my PC and got back here fine, but just moments earlier, it happened again.  What is this all about?



I got the same thing earlier... ???

^ I am glad I am not alone.  I was just about ready ot smash my computer

I am getting it more than ever now.  And it won't even let you cancel, all you can do is click that OK box :(

^ I am glad I am not alone.  I was just about ready ot smash my computer

I am getting it more than ever now.  And it won't even let you cancel, all you can do is click that OK box :(


Really?  It only happened to me once and everything has been fine since I did the one reboot...

^ I am glad I am not alone.  I was just about ready ot smash my computer

I am getting it more than ever now.  And it won't even let you cancel, all you can do is click that OK box :(


I've had the same problem. I've PM'ed Chucky about it, as well, 'cause it didn't/doesn't look good to me...


Yesterday, I came here and I got this message saying something about Microsoft Data Services wants to run.  Then a message box appeared that said "Click OK to Run Active X Control on this webpage".  So I clicked OK, it loaded a blank page with a blank java screen, then Norton Firewall popped up telling me that it just blocked an intrusion attempt  :o


I didn't get that far, though. I got worried 'cause it took so incredibly long to load, so I aborted.

The best I can figure is Microsoft Internet Explorer had an update over the weekend that is breaking things.

I haven't made any changes to the site software in several weeks, so right now I'm trying to figure out what it could be.

I was getting this message this morning, since closing all my windows down and restarting IE it has not appeared.

it appears this is happening on other sites, which means it's likely not here but on your machine.  IE 7.0 especially.

Also McAfee had a bad update recently which makes sites appear to be hacked

http://arstechnica.com/news.ars/post/20080102-mcafee-flaw-makes-ars-and-many-other-sites-appear-hacked.html

it appears this is happening on other sites, which means it's likely not here but on your machine.  IE 7.0 especially.

Also McAfee had a bad update recently which makes sites appear to be hacked

http://arstechnica.com/news.ars/post/20080102-mcafee-flaw-makes-ars-and-many-other-sites-appear-hacked.html


So...we're OK then? No action needed? ???

Is the panic over?

So...we're OK then? No action needed? ???


no idea realy.  I haven't got a machine I'm willing to sacrifice to run IE 7 to see the bug and see if I can make sure this is nothing.

I do know that it's not a javascript virus in the web pages, because I looked and saw nothing new there.

no idea realy.  I haven't got a machine I'm willing to sacrifice to run IE 7 to see the bug and see if I can make sure this is nothing.

I do know that it's not a javascript virus in the web pages, because I looked and saw nothing new there.


I guess we'll have to sit and wait then. That's what I'm gonna do anyway.

I guess we'll have to sit and wait then. That's what I'm gonna do anyway.


well, Firefox and Opera, and even the older version of IE won't have this issue if you want to give them a try.

I'm not sure what you can do to fix IE to stop having the problem.  I guess when it asks if you want to install/run something, it's best to say no.

Now for some unexplained reason, I lost my connection with my Internet Supplier and had to restart my computer. Since coming back here, that message has started appearing again.

One little item of curiousity, when that message does appear, I click on the 'X' for it to close, and a little white box white a dot appears in the top left corner of the window I am using for inthe00s.

Now for some unexplained reason, I lost my connection with my Internet Supplier and had to restart my computer. Since coming back here, that message has started appearing again.

One little item of curiousity, when that message does appear, I click on the 'X' for it to close, and a little white box white a dot appears in the top left corner of the window I am using for inthe00s.


have you got a malware/spyware type virus scanner that is 100% up to date?  it might be something on your machine

I'm not getting the same message but my avast scanner keeps finding Malware.  I am on Windows Explorer so I'll try Firefox later and see what happens.

I have a pop-up blocker running.  It has just started telling me that it has blocked a pop-up from Remote Data Services Data Control, part of the 'Microsoft Corporation'.  Or something.

have you got a malware/spyware type virus scanner that is 100% up to date?  it might be something on your machine
Norton is employed here.

I have a pop-up blocker running.  It has just started telling me that it has blocked a pop-up from Remote Data Services Data Control, part of the 'Microsoft Corporation'.  Or something.


is it every page of inthe00s, or is it just the frontpage, or the index or something else?

I want to be 100% sure it's nothing on my end, before I mark it up to more Microsoft incompetence...

I keep getting it too. Mine looks like this...

Something about a HTML script virus called Silly.Gen???

I keep getting it too. Mine looks like this...

Something about a HTML script virus called Silly.Gen???



I tried researching it.  The best I can tell is that your machine is infected with this virus, but it only spreads between Windows machines, and inthe00s is a Linux machine.  It might just be in memory or something.

I've also been thinking... it could be something I link to on every page, like big-boards or google search.  Those aren't on my server and could be infected...

could someone who is having this problem click on the big-boards image at the bottom and see if the warning comes up there.

I've also been thinking... it could be something I link to on every page, like big-boards or google search.  Those aren't on my server and could be infected...

could someone who is having this problem click on the big-boards image at the bottom and see if the warning comes up there.


It's not there.

I was getting a pop-up block here earlier as well (on the main page), though it hasn't appeared since I looked through a few pages. I'm running IE 7.

Ant

Last time I logged in I got it only on the index page.  This time it happened when I looked at a particular thread (sad song one) on Before the 70s.  It says the website is trying to load an add-on.

It's not there.

I was getting a pop-up block here earlier as well (on the main page), though it hasn't appeared since I looked through a few pages. I'm running IE 7.


yeah, but if you aren't getting the error here any more, that's not a test.  I need someone getting it here, to see if they get it there as well.

So far, I haven't got enough to go on, as to what it is, or what I should do to fix it.

I am running vista in Protected mode and I received the prompt as well.
Luckily mine looked like this one did:
http://msmvps.com/blogs/hostsnews/archive/2007/09/10/jamespot-hacked.aspx

Not sure the truth to this but I scanned my harddrive for spyware, malware, virus and access attempts and it showed me in my TIF's about 12 or so instances of hijack attempts, malware and spyware all being listed under inthe00s.com

Don't know if this helps any - as it could be something Chucky links to and not actually his site. Clean your TIF's and cookies and virus/spyware scan etc.

Tam 8)

I also forgot to mention that one time it did actually shut down my IE7, sent an error report to which there was no information, restarted my IE7 and everything has gone fine since......

I am running vista in Protected mode and I received the prompt as well.
Luckily mine looked like this one did:
http://msmvps.com/blogs/hostsnews/archive/2007/09/10/jamespot-hacked.aspx

Not sure the truth to this but I scanned my harddrive for spyware, malware, virus and access attempts and it showed me in my TIF's about 12 or so instances of hijack attempts, malware and spyware all being listed under inthe00s.com

Don't know if this helps any - as it could be something Chucky links to and not actually his site. Clean your TIF's and cookies and virus/spyware scan etc.

Tam 8)


it may be that people with avatar links from other sites are somehow passing along a virus.  TIFs?  you mean image TIFs? if you run it again, could you give me some filenames, that might help.

I get this error everytime I come back here after a long absence, and several times inbetween when I visit other sections of the board.  I am almost tempted to just say yes to the active X download thing and risk screwing up my computer

I get this error everytime I come back here after a long absence, and several times inbetween when I visit other sections of the board.  I am almost tempted to just say yes to the active X download thing and risk screwing up my computer


You shouldn't have to.  How long has this been going on?

You shouldn't have to.  How long has this been going on?


It just started happening last night. 

I have decided not to download the Active X thing as when I closed out of IE7, it re-popped up and automatically came back to this board and randomly started opening new tabs to various pages of the forum.  Seems like it's definately a virus of some sort, and perhaps it's spreading through the forum?

Guess I'll have to use FireFox to come here from now on :(

It just started happening last night. 

I have decided not to download the Active X thing as when I closed out of IE7, it re-popped up and automatically came back to this board and randomly started opening new tabs to various pages of the forum.  Seems like it's definately a virus of some sort, and perhaps it's spreading through the forum?

Guess I'll have to use FireFox to come here from now on :(


it sounds like something on your machine.  I can't be certain what's causing this yet though.

I got the same thing earlier... ???

I just got a similar thing a few minutes ago as I was logging in. The machine made a "blip!" sound and below the title bar it had one of those little strands. "...If you trust this software and want to run it, please click here." I just clicked the "x" at the right hand side of the bar to kill it. The same strand reappeared a couple more times during the past few minutes.

I'd love to use Firefox, but, our PC doesn't have it. :-\\ :-\\

It just started happening last night. 

I have decided not to download the Active X thing as when I closed out of IE7, it re-popped up and automatically came back to this board and randomly started opening new tabs to various pages of the forum.  Seems like it's definately a virus of some sort, and perhaps it's spreading through the forum?

Guess I'll have to use FireFox to come here from now on :(
try a system restore Jason. left click start, go to programs, then accessories, then sytem restore and it will ask you if you want to restore your system to an earlier date, and pick a date from 3-4 days ago and then see if it will restore your computer to the way it was on that date.  maybe it'll work.

I just got a similar thing a few minutes ago as I was logging in. The machine made a "blip!" sound and below the title bar it had one of those little strands. "...If you trust this software and want to run it, please click here." I just clicked the "x" at the right hand side of the bar to kill it. The same strand reappeared a couple more times during the past few minutes.

I'd love to use Firefox, but, our PC doesn't have it. :-\\ :-\\


is it only when reading threads, or is it when viewing the board index?

is it only when reading threads, or is it when viewing the board index?

First it happened when I signed in; it gave me an error message. Then I restarted my browser and went back to this site, and all was fine. But then when I clicked "Show new replies to your posts", that's when the little strand started to appear. It did that a couple of times.

Chucky - I just sent you an email regarding what just happened to my computer after my last post....

I can copy it here for others to see as well if you like

Tam

First it happened when I signed in; it gave me an error message. Then I restarted my browser and went back to this site, and all was fine. But then when I clicked "Show new replies to your posts", that's when the little strand started to appear. It did that a couple of times.


that would seem to indicate it was with the software here, not a linked image.  still no closer to understanding this

Chucky - I just sent you an email regarding what just happened to my computer after my last post....

I can copy it here for others to see as well if you like

Tam


might as well.. I didn't quite understand what you meant in the PM

that would seem to indicate it was with the software here, not a linked image.  still no closer to understanding this

Well it's not happening anymore; it was just those couple times. Everything's ok on my end right now.

ok - first things first - I just got it again

On the index page

www.inthe00s.com/index.php

My email to you:

"Hey Chucky!

I couldn't get back to the site because when I made my last post, I got the pop up again on the data services thread, and then my PC-cillin Internet Security shut down my computer because of a hijack attempt.

It restarted and immediately started scanning for everything - so far showing 26 items but I don't have the breakdown for it. I looked at the error log, and I came up with this fault name :

StackHash_e52f

I researched it and found that it was an attempt to access windows without having the proper credentials. So IE7 might have a vulnerability that they aren't aware of yet, no fix for it yet since I haven't found one, and further reference shows that the data services thing is not coming from your website, but possibly ANY link that has been put on your board. (Be it your links or links from members.)

My scan just finished and here are the vulnerabilities it shows:

specificclick, pointroll, statcounter, profiling and atwola

So I researched these and some just come up as cookies but others say that they are embedded phishing/hijacking programs from links that can be served through anonymous proxies, a hacked server, ad banners that have been infected (the list can go on) These were attached to my temporary internet files labeled www.inthe00s.com/ (insert a bunch of numbers here)

At any rate, I just wanted to let you know. Apparently PC-cillin has recognized the attempt and will no longer let it go through. So I will go back and if anything else happens I will be sure to let you know."

someone mentioned they saw a line in the HTML source code that had the following filename in it:

omyzf.js

that doesn't belong, but I can't find any reference to it on the server anywhere either.

ok - first things first - I just got it again

On the index page

www.inthe00s.com/index.php

My email to you:




ok, I had only seen the PM, which wasn't that detailed.  I'm going to try searching on those names and see if it turns up anything.

I'm going to try removing the big-boards code, and google analytics, which are the only two off site resources on those pages.  Maybe that will clear things up.

Tam, those cookies shouldn't have anything to do with inthe00s, no idea why they are coming up as such.

OK, I removed all the off-site links and stuff, most of them are pretty well known sites, so I doubt they'd be the source of the problems.