Reptile & Amphibian Forums

Folks,

There is a computer virus/bug going around that seems to have started up on/about Dec. 28 and has been spreading.

From our current understanding, this bug is more like an aggressive spyware type thing and it puts the bug into your system and when you post on message boards, it tags your post with a hyperlink leading primarily to porn related material, but also other websites. People often do not know they even have this bug until they start noticing these hyperlinks showing up that they did not put into their messages.

This nasty bug is spreading on our boards and even some other web-based forum sites. Some folks have unknowingly been clicking on these links. It is unsure if some of these sites are force downloading the spyware/bug on people or if people are unknowingly picking it up after having downloaded some program off other sites and did not know there was a hitchhiker. Either way, if you run your cursor over the hyperlink and look at the bottom of the page, you should see the URL address. If it looks like a porn site or has a "[bleep]" in it, assume it is one of those types of links and DON'T click on it. As we find new domains in the newer links, we have been filtering them out to hopefully help keep the damage down in future posts by infected individuals.

We first started noticing it when usually good members were suddenly posting porn links. We knew something wasn't right. Our suggestion is to download anti-spyware software such as adaware http://www.lavasoftusa.com. Also make sure you have antivirus sotware and that it is upto date. A good free antivirus progem is AVG http://www.grisoft.com/us/us_dwnl_free.php.

There is some discussion about it at http://www.computing.net/security/wwwboard/forum/8346.html.

Please if anyone sees any such posts with an active hyperlink at the bottom of someone's message that just says 'Link', REPORT those messages ASAP via the 'abuse report' button (located by the author's name). Not all posts with a default 'Link' at the bottom are bad, but we do want people to alert us to them so that we can check those messages out and if they do turn out to be the bad ones then we can get those messages cleaned up ASAP and inform the individuals of their situation. Unfortunately, some folks have email from us blocked or they have changed ISPs so please also help get the word around.

Additionally, any person we find with this bug posting on the forums will likely have their account temporarily suspended to keep them from posting and possibly spreading this problem even further on the forums. Once they have been made aware of the situation and have their computer cleaned up they can contact the site coordinator to have their account reinstated.

http://www.pethobbyist.com/contact/index.php

Thank you.

_____

PHWyvern

Kingsnake.com Forum Leader

I have AVG and adaware.Ive notice in chatrooms if you go to check a profile it takes you to this stupid site called outwar.com.Your virus protection will go ape%$%$.This is going on all over.I cant name the sites because they will just be deleted anyway.I might mention once infected your profile will spread the virus/spyware on.Or help itself by posting a link.Adaware and Avg virus are free.Just make sure you run the adaware after loading AVG.Good Luck...Paul.

This sounds like a server-side virus. Is the code that runs this server a generic company written or is it home-made? If the code that runs these forums is pretty specific and special for this forums it is unlikely that this is a "general" problem lots of people are having and more like kingsnake has been targeted, mainly it's users. It also sounds like the virus is coming, originally from chatroom java scripts that are downloading themselves to US.

I ask again, what has been done to protect us? more info please.

What have we done to protect you?

*First of all, it is a spyware bot that attaches itself to your computer when you click on the link. NO ONE should click on links without at least looking at the url address at the bottom of the page when you move your cursor over the link. If it looks like a porn site, we hope our members have sense not to click on it - especially after being warned about this. We cannot control what links you click on or where you chose to visit on the web.

*Whenever the virus spits out a new url, we put it into our filters as quickly as we know it.

*The minute we get a report on a member who is infected, we clean up all of their posts with the link.

*We block the member's posting and write the member telling them what is going on.

*We have spent hours every day since this started cleaning up posts and corresponding with the infected folks, giving advise and helping them run tests. It even takes time to reactivate their account.

What are we doing? A lot and we are doing the best we can. Can we stop this ourselves? No - that's why the program was written the way it was - to circumvent your accounts and our forums. We are under attack every bit as much as you are.

-----
Ginger Sanders
Staff Director
Email PHGinger
[

I had this problem. I attempted to use my McAfee anti-virus, Ad-Aware, Spy Hunter and none of the stuff truly worked to get rid of it. It caught some files, but nothing changed in terms of my comp still posting the links... What I ended up doing was going into my Add/Remove programs and found the culprit sitting quite innocently in there. I removed two things and everything went back to normal.

I do believe this is a Trojan called Malware, but a new 'strain' of it not yet detectable or combattable by most anti-virus mechanisms. I'm 99.9% sure I picked it up from this site.

Also... I found that the links wouldn't be posted in forums I visit that are more 'advanced' in their technology compared to Kingsnake. Like www.piranha-fury.com never gave me any problems... I think it's because the boards have such low tech to them and no real security features in place.

Hope that info helps some.
-----
Stephan
The Canopy

i am using a mac and i don't know if there are any virus checkers out there that i can get for free. the free is importand because i am a money less teenager
Demon
P.S. aren't you glad i reported the message mettle?

I don't think mac's are affected by most of the viruses out there. Most makers of these invasive programs aim for Win32 based systems (ie Windows line of Operating systems) so you should be safe from the majority Demon. However, I am no expert in Mac systems so suggest tracking down a decent website about viruses that can effect Mac computers...www.apple.com may have suggestions on where to go, if their site doesn't have something about it.

With the Mods and users on this forum, they informed us right away and did thier best to help us to avoid getting the virus. I have checked with other forums and some had no idea about the virus so I then directed them with the same information I recieved here.
I think this is the virus everyone is refering too, Im not 100% sure though.

http://securityresponse.symantec.com/avcenter/venc/data/trojan.bookmarker.b.html

Thanks a lot to everyone here, I dont get on line much and the first place I head to read is here. Not only do you all help out with my sometimes stupid questions but now you help out with the lastest virus information