Wierd stuff on main page

[Ken Layton]

Anyone else notice that as soon as you start to open the main film-center.com main page that "trust4free.ws" is trying to open also. I've noticed this for over a week and it only happens here on film-center (not the forums though). Could this be a virus or something? Is this happening to everyone else too, or is it just me?

[Michael Coffin]

I just checked and something could definitely be wrong. As soon as I opened www.efilmcenter.com NAV detected/deleted 3 files it reported as viruses.

Dave, you should take a look at the index file for this page - check the date last updated and see if it might have been hacked.

-Mike

[Ken Layton]

Something's going on. Just now I was prompted to log in and normally I am automatically logged in.

[Michael Coffin]

Something's going on. Just now I was prompted to log in and normally I am automatically logged in.

I think Dave might be away for the holidays - but I've sent him an email to let him know I think the main page of eFilmCenter might be hacked. Do NOT enter any confidential information (including login id's/passwords) on that page until Dave give's the green light.

I cannot find a lot of information on 'trust4free', but the few sites that I have found that discuss it indicate that their sites were hacked and it does appear to be downloading some trojan horse viruses to the computer of anyone that visits.

-Mike

[Ken Layton]

I googled around on the trust4free also. I think I came up with the same info as you. The few sites that had discussed it talked about a trojan horse virus.

[Ken Layton]

This is getting scary now. When I started to go to film-center, trust4free tried to download a file. Norton caught it, but there is definitely something going on here.

[Michael Coffin]

I'm pretty sure the page has been hacked. I haven't been able to reach Dave directly to let him know, but have left him an email alerting him to the problem.

-Mike

[Russell Harnden]

I know that this thread was started in "The Cutting Room Floor", but the issue at hand sounds pretty serious. Perhaps someone might consider posting a "warning" on the "Film Collectors Forum" section of this website to alert fellow members...

[Michael Coffin]

Hi Russell,

The forums are set up to "categorize" information. I think this belongs in the "off-topic" forum as it doesn't have anything to do with films, but certainly is of interest of members.

Please note that the problem Ken and I have been discussing concerns the main index page of eFilmCenter.com - not eFilmForum.com.

I assume members are using the "Show Posts Since Last Visit" feature which shows all news posts from all forums since their last visit. If they are not, they should be.

-Mike

[Dave Harris]

Hello everyone, I"m checking in now from Domenica and will not be back at eFilmForum Central till Jan 3rd. I'm unable to reload clean files till then, so whatever is going on at film-center.com ---- sorry, but I just can't do anything from here. I just ebterred the forum here from an nternet cafe and going though the main page, etc notice no problem with the forums. Best thing would be to avoid film-center totally and I'll upload a fresh dump of files when I return....if you just have to log on there then make sure your anti-virus is up todate. Best to all of you...see you when I return.

[Ian John]

I keep Film-Centre listed on My Favourites list, and when I clicked on it yesterday, the home page came on very briefly and I had a Microsoft warning window come up in the middle of my screen telling me that the site I was using had to be shut down (the home page had just changed to a plain white screen) becuase there is a possible virus that could effect my email and other programmes used on my computer by inbedding itself into those programmes, it could also damage my computer. It also invited me to change my settings, and said that my computer system would not allow me to access this programme (Film-Centre) or other sites I visited with possible infection in future, but told me I could overide it and vist the site if I choose too.

I loged-on now to the sites home page, but this time I received no warnings, and it seemed to work as normal.

I am running NTL NetGuard Antivirus which is updated every 3-4 hours, and yesterday I ran a full scan, but no virus was found.


Regards.
Ian. (UK)

[Ken Layton]

Here's is what I have found so far:

http://nukecops.com/postp208240.html

The offending site that caused the problem is: trust4free.ws and their IP is 85.255.114.164

[Dave Harris]

Yes, somehow the main index file at film-center.com was hacked on 12/20. I just replaced the file and things should be ok now.

[Ken Layton]

Yup, seems to be ok now. :)

[Michael Coffin]

Hi DH,

You may want to beat up your ISP, from what I've seen this impacted a lot of sites run by ipowerweb, isnt' that your ISP? If so, THEY probably brought this trojan in by mistake and it infected all of the sites they host.

Glad you were able to rid yourself of it (and again, to our other members, this didn't impact eFilmForum.com, just film-center.com).

-Mike

[Jeff Sumberg]

What was the "purpose" of this bug? Was it something that affected IE, or specific versions of Windoze?

I don't use IE, so many of these problems don't seem to have any impact. I'm getting to the point where I'm ready to abandon Windows as my system that I browse/email on. It just isn't worth the hassle anymore. Too much shit out there.

[Michael Coffin]

The virus was in the form of an IFRAME injected into an otherwise normal web page. When the IFRAME imbedded in the main page opened, it caused three trojans to download to the user's computer (not entirely sure how, because web pages can't just "download files" to user computers - unless of course the software has security "holes" in it as so many Micro$oft programs do).

I know what you are saying about Winblows and Exploder - I wish Micro$oft would "get the message" and REALLY fix things. By the time they get around to it, Linux will have taken over and it will be too late for them. Already several countries are mandating that no software be used on government systems that isn't open source - ruling out ALL Micro$oft products.

-Mike

[Jeff Sumberg]

The virus was in the form of an IFRAME injected into an otherwise normal web page.

I know what you are saying about Winblows and Exploder - I wish Micro$oft would "get the message" and REALLY fix things.
Ok, one of those "properly crafted" strings that probably overflows a buffer and pushes code into an executable area. I never go to that film center page myself, but I'll bet it was an IE specific problem and not a Mozilla/Firefox worry.

I don't use IE. I never have. I was a Netscape user from before IE existed, and just stayed with it all the way through to the Mozilla era. Hell, it's better anyway. Why anyone uses IE is beyond me.

Microsoft HAS gotten the message and they are trying to fix things, but you know what? There's just too many. Their marvelous grand scheme to integrate everything and make everything web aware has really back fired on them BIG TIME. It serves them right too.