YOUR SITE GOT HACKED !!

[nomo]

Still fake virus spammers here sending private messages


Hello, friend. There are viruses' activities from your computer in last few days. Strongly recommend you to check your computer. You can find a report about your computer's security and solve every problem with it here: [URL]http://www.********
Thank you. Forum member. :mad:




http://www.nzxt.com/forum/member.php?u=4545

[PAEMS1]

Yeah I just got the same message from the same member. I know my system has no viruses on it. I run scans everyday with all updates. I think someone should investigate this member sending out these messages.

Originally Posted by XandderrMan
Hello, friend. There are viruses' activities from your computer in last few days. Strongly recommend you to check your computer. You can find a report about your computer's security and solve every problem with it here: http://www.************
Thank you. Forum member.

[Pew]

ive had 3 of the same from that user, reported again :\

[mrpergo]

I had 2 and reported them.
This is getting old.

[TK31]

Hello, friend. There are viruses' activities from your computer in last few days. Strongly recommend you to check your computer. You can find a report about your computer's security and solve every problem with it here: Link Removed Thank you. Forum member.

same, except from RazzzorrrrMan. And the PM requires a receipt, so it'll keep spamming my email inbox until i acknowledge i've accepted the PM

Visited the site...

Man this is hilarious....

A "Windows Securit Alert" window in MAC OSX? Are you kidding me? LOL!
Win32 viruses in Mac OSX i686? LOL?

[Pew]

just got the razzorman one too

how about you do something about it nxzt?

[NZXT_Dood]

Just banned.

[caracarn]

XandderrMan and Razzorman, I just changed board preferences to disable private messaging, and disable all emails except from administrators.

[Sir Mandrake]

Ive been monitoring these PM spam activities and they appear to come on the weekend and most commonly on Sundays so Ill be on the lookout. Believe me when I say the admins do care if spam affects our forum and hate them just as much as you do.

Help us by reporting them if you get them, when the spammer is banned all PM and posts they make are removed as well. After looking at the logs, I see the same spammers return to do more dirty deeds only to be presented with a big fat DENIED!

So your reporting efforts combined with the efforts of the administrators, is keeping our forum cleaner than most of you may realize. Keep up the vigilant reporting and sorry for any inconvienience these annoying PMs are causing.

[fat ninja]

Hello. I got the same email. Here is the copy below.

DO NOT REPLY TO THIS EMAIL!
***************************

Dear fat ninja,

You have received a new private message at NZXT. Lounge from GafarozzMan, entitled "Be careful!".

To read the original version, respond to, or delete this message, you must log in here:
http://www.nzxt.com/forum/private.php

This is the message that was sent:
***************
Hello, friend. There are viruses' activities from your computer in last few days. Strongly recommend you to scan your computer. You can find a report about your computer's security and solve every problem with it here: http://www.*********************cted/docsavage;fat ninja;mogode15;wartank;v0dka
Thank you. Forum member.
***************

Again, please do not reply to this email. You must go to the following page to reply to this private message:
http://www.nzxt.com/forum/private.php

All the best,
NZXT. Lounge

It was supposedly sent by the member 'GafarozzMan'.
Ignore it.

[Sir Mandrake]

Yeah, he's gone so are all his PMs
Report these if you get them and delete them right away... also, please dont post a copy of them in a forum thread. We dont want these links getting spread around and clicked. :erstaunt078:

[Diff_1]

EddieTrr is spreading virus spam as of today, Ban please. Thank you.

[wrexer]

Got this message today is this spam??? I have no viruses on my pc and as far as im aware i do nor hack.

Heres the email i got but when i went into my private messages on NZXT i had none:confused:

DO NOT REPLY TO THIS EMAIL!
***************************

Dear wrexer,

You have received a new private message at NZXT. Lounge from EddieTrr, entitled "Secure your cumputer!".

To read the original version, respond to, or delete this message, you must log in here:
http://www.nzxt.com/forum/private.php (http://www.nzxt.com/forum/private.php)

This is the message that was sent:
***************
Dear, Legion;OVERLORD;martijn;wrexer;Fiduci!

There are viruses' activities from your computer! Highly recommend you to scan your computer for malicious and potentially unwanted software. If you do not follow this, I will have to make a complaint to your Internet Service Provider with attached log file (your IP address, etc.). If you want to find a report about your computer's security and solve every problem with it, please click here:

This is an online service that you can use for free spyware removal. Use it to scan your computer to help protect, clean, and keep your computer running at its best. Use the free scan to check for and remove viruses, spyware, and other potentially malicious software and to find vulnerabilities or shortcomings in your Internet security.

Thank you. Yours truly, Edmond Taylor.
***************

Again, please do not reply to this email. You must go to the following page to reply to this private message:
All the best,
NZXT. Lounge

EDIT i've deleted the links sorry about that :)

[NZXT_Dood]

who was the user?

[wrexer]

Says from Edmond Taylor?

[Diff_1]

Same one I listed above NZXT_Dood.
"EddieTrr"

Don't click on the link in it Wrexer it will give you avirus or other nasty not clear up any.
Like how their trying to use intimidation now by saying they'd report you to ISP.
LOL! ISP is not going to anything about someone having a virus on their computer.

Just ignore/report here so they can ban "user" and delete any you get like that, I've gotten them from like 6 different "users" already even that lady that was trying to pass herself off as an admin a while ago.

[Sir Mandrake]

Ok, I banned Eddietrr and deleted all PMs sent by this guy yesterday before anyone said anything. Apparently you are getting the PM notification sent to your personal emails. This guy is not just a problem here but is a problem on many other forums as well. We're actively working with other forum Admins to come up with a way to deal with this spammer. Untill then, please continue to report PM spam and to prevent any spam from being sent to your personal email... just turn off email notify on new PM's in your user profile. Just check back in regularly to check new PMs if any.

Thanks

[Diff_1]

Thanks Mandrake, more of a nuisance then anything else as I suspect most users here are smart enough not to fall for the baloney in the PM's and then subsequently lose all common sense and actually click the link.

The day some "supposed" fellow forum user can tell what I have and don't have on my computer is the day I disconnect from the net. ;)

[NZXT_Dood]

We are looking into upgrading the forums, the previous admin is a bit MIA so it's taking a bit longer to figure out :)

[v_corp]

This is exciting!!

[x.clay]

There seems to be a lot of this kind of stuff going on lately. I am on staff with HiTechLegion and we have had a few make it through the spam blockers lately. I have also been getting spam PMs like these from a couple of other forums. :mad2: :new_snipersmilie:

I am glad to see the staff taking care of this stuff quickly :thumbsup:

[fat ninja]

Hello. Now I'm getting emails saying spam has been detected coming from my pc, and if I don't stop NZXT will ban me and report me to my ISP. This is the second email I got now, its really starting to piss me off.

[Xylem]

Yep, here's another one:

Dear Xylem,

You have received a new private message at NZXT. Lounge from WillieThompson, entitled "Take measures immediately!".

To read the original version, respond to, or delete this message, you must log in here: ******

This is the message:

Dear, Xylem

Spam sending from your computer was detected.
We highly recommend you to check your computer and perform online virus check at our site immediately: ****************
If (http://If) you do not pass this test* we will have to delete your account and forward a complaint to your ISP with attached log file (your IP address, etc.).

Forum Administration www.nzxt.com (http://www.nzxt.com)

So, now this guy IS the administrator !!???

Hope you can do something about this; it's annoying. Thanks.........

[mrpergo]

I got the same one.
It was already deleted from my PM's before I got there to delete it.
Good job.
A better job would be to keep the beggars off the site.

[iNZXT]

We are doing our best to eliminate this problem. I am going through the vbulletin discussion on spam prevention to find more ways to prevent these guys from getting in.

We do apologize for the inconvenience.

[Diff_1]

Billjonezz,

that is a new one sending the fake virus spam.
Looks like they may have been banned already though as the PM was not in my box just got email notif of it.
If the person named above has not been banned then ban, ban, and furthermore ban him. LOL!

[PC-Tailor]

from already banned user: Billjonezz

But here is the mail headers, spamassasin noticed the domain.
mmd.net is our webhotel/email provider - so they are ok.
I don't know anything about siteprotect.com
our adresses *[snip]*ped off
Do you have any use of emai headers?

Return-Path: <nzxt@lsh215.chi.us.siteprotect.com>
X-Original-To: *[snip]*
Delivered-To: *[snip]*
Received: from mailscan01.mmd.net (mailscan01-out.mmd.net [80.83.0.45])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by mmdmail01.mmd.net (Postfix) with ESMTPS id E5569244A2A
for <datadust-1@mmdmail01>; Fri, 5 Mar 2010 20:04:52 +0200 (EET)
Received: by mailscan01.mmd.net (Postfix, from userid 108)
id D180112E01E; Fri, 5 Mar 2010 20:04:52 +0200 (EET)
X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on mailscan01.mmd.net
X-Spam-Last-External-IP: 64.26.63.28
X-Spam-Level:
X-Spam-Status: score=0.9 tests=URIBL_RHS_DOB
X-Spam-Report:
* 0.9 URIBL_RHS_DOB Contains an URI of a new domain (Day Old Bread)
* [URIs: total-scan.org]
Received: from lsh215.chi.us.siteprotect.com (lsh215.chi.us.siteprotect.com [64.26.63.28])
by mailscan01.mmd.net (Postfix) with ESMTP id 142252C2217
for <*[snip]*>; Fri, 5 Mar 2010 20:04:51 +0200 (EET)
Received: by lsh215.chi.us.siteprotect.com (Postfix, from userid 25399)
id 3ADBE1F791E; Fri, 5 Mar 2010 12:04:50 -0600 (CST)
To: *[snip]*
Subject: New Private Message at NZXT. Lounge
From: "NZXT. Lounge" <noreply@nzxt.com>
Auto-Submitted: auto-generated
Message-ID: <20100305180450.d8442b89377f@www.nzxt.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-Mailer: vBulletin Mail via PHP
Date: Fri, 5 Mar 2010 12:04:50 -0600 (CST)

[beancounter]

Just found two PM email notices in my inbox telling me I have virus and my ISP will be contacted if I do nothing. Two different names....Billjonezz and WillieThompson . Checked my PM inbox and nothing there.
System is scanned daily using different virus scanners to make sure all bases are covered. No virus have turned up.

What to do???? Thanks

[Diff_1]

Beancounter do nothing it's scamming spammer sending them nothing more.
DO NOT click the link they give as you're more likely to get a virus or other nasty then cure any problems.

Just report any names that are sending them to you here like you did so they can ban them.

[beancounter]

Thanks Diff_1 for the info.... Some of these spammers can make their cr*p look so official it is very easy to just follow the directions without realizing you are heading for trouble.

I'm glad to know that the forum management is taking care of the problem.

It's great to have such a pleasant place to exchange ideas and share our system builds.

[Chappy]

Hi Beancounter

It's usually easy to spot a sacm like these ones. First is always poor grammer, like "Spam sending from your computer...", nobody really puts it that way, and really only your ISP would send you any such message. Only they can monitor you for excessive bandwidth usage and check your data output for spam. Even then, if you get a message from your ISP, they will NEVER ask you to do things like this, or ask for paswwords. If you get something stating it's from your ISP, phone them and ask, don't click links because these scammers have all the tricks in use.

Second, if they ask you to click a link to scan your system...it's a dead giveaway! NEVER, EVER will a legit message from a forum admin ask you to go to another site like that.
These social engineering techniques try to make it look official but usually all it takes to avoid them is a healthy dose of skepticism, and a few minutes on Google or Bing to find the truth.

BTW Admins - I take it these guys are spoofing IP's right? They're obviously all the same crew due to the messages, and since it seems to be difficult to stop them they must be all proxied behind numerous IP's...

[Sir Mandrake]

BTW Admins - I take it these guys are spoofing IP's right? They're obviously all the same crew due to the messages, and since it seems to be difficult to stop them they must be all proxied behind numerous IP's...

You are correct.... and this isnt the only forum thats having this issue.... an idea that might work is require 1 - 5 reg forum posts for new users before they can access the PM option. This will prevent these spammers from registering and then unleash their PM script right off the bat.

[NZXT_Dood]

I agree. :) Let's do it.

[iNZXT]

After moderating the threads recently, I have found that we have received zero spam threads and posts. After adding an additional security measure at registration, it seems to be fending off the spammers.

Remember to post anything if you get suspicious emails or PMs. We'd like to keep the security up so the members in the NZXT community won't have to worry about spammers.

[x.clay]

the beefed up security definately seems to be helping. I haven't received any spam PMs in a while. :)