La Légion des Ombres

Guilde PVE - Les Clairvoyants - Horde
 
AccueilPortailFAQRechercherS'enregistrerConnexion

Partagez | 
 

 mmo-champion hacked !

Voir le sujet précédent Voir le sujet suivant Aller en bas 
AuteurMessage
-=KT=-Zulkkatar

avatar

Masculin Nombre de messages : 1535
Age : 25
Localisation : Genève
Reroll principal : Zulkkatar
Date d'inscription : 16/04/2009

Feuille de personnage
Race: Orc
Classe du personnage: Guerrier
Metiers: Forge / Joallerie

MessageSujet: mmo-champion hacked !   Dim 13 Juin - 8:42

Oh god, MMO-Champion got hacked
Yay! It finally happened! MMO-Champion got hacked! But don't worry too much, the title is mostly here to scare you and make sure you will read the rest. The site got indirectly affected by a very nasty virus called Gumblar, the site is cached in various ways and it means that most users are potentially safe but I strongly suggest that you read the entire post.

Gumblar, AKA Troj/JSRedir-R, is a botnet driven virus which attacks both websites and normal computers. Sounds scary, and to anyone who owns their own website it is, but to anyone else it's mostly harmless.

How does it work?

The virus is split into two parts. There's a javascript version, which infects websites, and the actual virus itself which infects computers. Whenever a browser executes the javascript on a website, it runs a Java applet and (through a Java exploit or two) installs the virus onto your computer. The virus, once warm and snug on a computer, looks for any FTP details you may have stored (In dreamweaver, filezilla, pretty much any FTP application) and makes a copy of them.

For every FTP it manages to get, it attempts to make a connection and then infects the website with the javascript. It does this by opening .js/.html/.php files and attaching a unique version of itself to a position inside the file, usually at the end. This new code is unique per website, not per file, so removing it isn't as daunting as it sounds.

In addition to spreading itself to every website it can get its claws on, the virus also reprises its role as a traditional Trojan and attempts to install other spyware onto your computer, including redirecting popular websites (such as Google) to its own unsafe alternative.

How do I know if I have it? How do I get rid of it?
Most modern anti-viruses should pick up the Gumblar virus. Personally I'd suggest downloading and installing Malwarebytes and doing a complete system scan. Make absolute sure your anti-virus is up to date before scanning, and make sure it's on a full/intensive scan, take no risks with a quick sweep.

For webmasters, there's a lovely tool called Unmask Parasites for checking if your website is safe or not. However, if you suspect you may have been infected but this tool returns nothing, you may be best suited to manually look through the files. Open up a few random .js files, and look at the end for a line or two of code that you don't recognise. Open up some .html files for a <script> tag that shouldn't be there. If you find it, take your website down immediately and start removing it. If you have backups, make sure they're clean and restore them. Otherwise, you can manually fix the files. Automated tools do not work so well for this as it's unique code for every website.

As always, it is recommended you change any private details (such as passwords) after you have confirmed you are safe. While World of Warcraft/Battlenet accounts are not affected by this virus, it is still strongly advised you change your password for it regardless.

My epics are safe?
Gumblar is a botnet driven virus, which means the infection process is entirely automated by other infected machines, no human intervention. As it was not designed to look for World of Warcraft details, it is not particularly interested in looking for them. This doesn't mean you can slack and use this as an excuse to never change your password though. It's always a good time to change your password!

Technical details
For more details about Gumblar, see this Wikipedia article or this Unmask Parasites article. For a technical summary of Gumblar, there's a nice article on iss.net about it.
Revenir en haut Aller en bas
Voir le profil de l'utilisateur
Hafaelas

avatar

Nombre de messages : 162
Age : 71
Date d'inscription : 30/06/2009

MessageSujet: Re: mmo-champion hacked !   Dim 13 Juin - 10:12

Old things are old
Revenir en haut Aller en bas
Voir le profil de l'utilisateur
-=KT=-Zulkkatar

avatar

Masculin Nombre de messages : 1535
Age : 25
Localisation : Genève
Reroll principal : Zulkkatar
Date d'inscription : 16/04/2009

Feuille de personnage
Race: Orc
Classe du personnage: Guerrier
Metiers: Forge / Joallerie

MessageSujet: Re: mmo-champion hacked !   Dim 13 Juin - 10:34

Bah wai c'old mais y a encore des problèmes du à ça Razz Pas plus tard que ce matin ^^
Revenir en haut Aller en bas
Voir le profil de l'utilisateur
Contenu sponsorisé




MessageSujet: Re: mmo-champion hacked !   

Revenir en haut Aller en bas
 
mmo-champion hacked !
Voir le sujet précédent Voir le sujet suivant Revenir en haut 
Page 1 sur 1
 Sujets similaires
-
» World Club Champion Football Intercontinental Clubs 09-10
» Champion de Khorne
» Le futur Champion du monde de blood Bowl !
» [Standard] Deck champion d'Europe Standard 2009
» World Club Champion Football Intercontinental Clubs 10-11

Permission de ce forum:Vous ne pouvez pas répondre aux sujets dans ce forum
La Légion des Ombres :: Hall d'accueil - Partie publique :: Le défouloir-
Sauter vers: