[WriteLog] Possible virus on contesting.com and eHam websites

[w1net at arrl.net]

Sorry for those infected.  Does anyone know if this has been resolved and
one can go back to visiting these sites?

Txs

John

-----Original Message-----
From: Clay Melhorn [mailto:n9io at hotmail.com] 
Sent: Sunday, October 02, 2011 4:16 PM
To: aa5au at bellsouth.net; Writelog Forum
Subject: Re: [WriteLog] Possible virus on contesting.com and eHam websites


Thanks for the heads up Don,
I saw that come up on my laptop at home over the weekend a couple times so I
stopped trying to see the link.
Fortunately I remember clicking Cancel each time as I recognized it as a
potential nuisance software window.
Sure seems I was only at eHam web site through a search link, fairly sure
but had followed a few links.
Yep, sounds like one of the sites may have gotten hacked.

Clay Melhorn N9IO Bonfield, IL
Webmaster: KARS - Kankakee Area Radio Society - W9AZ http://www.w9az.com/
 
 
 

 

> From: aa5au at bellsouth.net
> To: aa5au at bellsouth.net
> Date: Sat, 1 Oct 2011 22:50:09 -0500
> Subject: [WriteLog] Possible virus on contesting.com and eHam websites
> 
> Last Friday I got a nasty trojan on my work laptop viewing ham-related 
> websites. I didn't know which one because I had left the room for 
> something and when I returned my PC was going haywire with all these false
alerts saying my hard drive had died. Today I got a mysterious dialog box
when I went to contesting.com. Others have told me they got the same thing
when going to eHam.
> 
> It's called the Data Restore virus. A description of the virus plus a 
> good set of instructions for getting rid of it are located
> here:
> 
> http://www.myantispyware.com/2011/09/29/how-to-remove-data-restore-vir
> us/
> 
> >From what I understand, it could be related to running Internet 
> >Explorer 8 under Windows XP although other platforms may be
> susceptible too. When visiting these sites, a dialog box comes up 
> asking if you want to run a program. Do NOT click the Allow button or the
X box to close it or the "What's the risk" link. Instead, CLOSE IT ONLY
USING THE CANCEL BUTTON.
> 
> A did a screenshot of the dialog box and put it on my website. To see what
it looks like, go here:
> 
> http://rttycontesting.com/contestingcom.jpg
> 
> I'm running MS Security Essentials and it did not immediately catch 
> it. I have heard that other virus programs did not catch it either.
> 
> Sorry for the bandwidth, but I just hope to save others from the pain 
> of having to deal with getting rid of this crap on their computer after
visiting legitimate ham-related websites.
> 
> 73, Don AA5AU
> http://www.aa5au.com
> http://www.rttycontesting.com
> 
> _______________________________________________
> WriteLog mailing list
> WriteLog at contesting.com
> http://lists.contesting.com/mailman/listinfo/writelog
> WriteLog on the web: http://www.writelog.com/
 		 	   		  
_______________________________________________
WriteLog mailing list
WriteLog at contesting.com
http://lists.contesting.com/mailman/listinfo/writelog
WriteLog on the web:  http://www.writelog.com/