Chisoxfn Posted March 4, 2006 Share Posted March 4, 2006 That email contains two malicious links. The site was hacked for the 2nd time in 3 days. It looks like I've found the potential hole they were getting through, but I'm going to be keeping a close eye. Everything will be revamped on the site security was ASAP. This is the first time the site has ever been hacked. We apologize and if anyone sees anything strange coming up from Soxtalk in the next few days, please ignore it. We do not send out emails nor do we have any sort of spyware or downloads that are required to view pages on the site. Quote Link to comment Share on other sites More sharing options...
Balta1701 Posted March 4, 2006 Share Posted March 4, 2006 I blame the Cubs. Quote Link to comment Share on other sites More sharing options...
Heads22 Posted March 4, 2006 Share Posted March 4, 2006 I will say that we are not taking this lightly at all. Anyone found to be undermining the security of the site and most of all doing ANYTHING that will hurt our members will be dealt with. There's no other goddamn reason for Gage and I to be on this late otherwise. Quote Link to comment Share on other sites More sharing options...
Chisoxfn Posted March 4, 2006 Author Share Posted March 4, 2006 You all might as well know, but if you ever plan on hacking this site. We will not take it lightly. I may be a moron when it comes to computers and may not be the most technologicaly savy web developer out there. But I have gotten enough evidence on this hacker and it will be reported to the authorities who will hopefully be in contact with him/her. Quote Link to comment Share on other sites More sharing options...
Jordan4life_2007 Posted March 4, 2006 Share Posted March 4, 2006 It was me. What you gonna do about it? Quote Link to comment Share on other sites More sharing options...
Heads22 Posted March 4, 2006 Share Posted March 4, 2006 QUOTE(Chisoxfn @ Mar 4, 2006 -> 02:36 AM) You all might as well know, but if you ever plan on hacking this site. We will not take it lightly. I may be a moron when it comes to computers and may not be the most technologicaly savy web developer out there. But I have gotten enough evidence on this hacker and it will be reported to the authorities who will hopefully be in contact with him/her. I echo what Jason says and I'm sure guys like Kap who spend hours working on this site do too. We've invested too much time and money in this website, as well as all the people that visit, to allow this crap to happen. Quote Link to comment Share on other sites More sharing options...
BFirebird Posted March 4, 2006 Share Posted March 4, 2006 Some people just have too much time on their hands to go and mess up what other people create....I don't get it. Quote Link to comment Share on other sites More sharing options...
drowninginflame Posted March 4, 2006 Share Posted March 4, 2006 yea, that sucked, I opened that email thinking I had a pm or something Quote Link to comment Share on other sites More sharing options...
Heads22 Posted March 4, 2006 Share Posted March 4, 2006 It should probably appear to be from my MCHSI email. The Soxtalk email is now switched to Jasons, but anything from a*****@mchsi.com is using my email as the reply-to addy. But, rest assured, I didn't do this. Quote Link to comment Share on other sites More sharing options...
Cali Posted March 4, 2006 Share Posted March 4, 2006 I did it cause I hate Jason and Orange County..... You bastard. You got what was coming to you! Quote Link to comment Share on other sites More sharing options...
RME JICO Posted March 4, 2006 Share Posted March 4, 2006 (edited) Also, if you use IE, you might want to scan your comps for the following files if you visited the site within the last 24 hours: Normally in TEMP or Temporary Internet Files: xpladv553.wmf Hidden file: C:\WINDOWS\system32\avload32.dll Hidden file: C:\WINDOWS\system32\wnlogow.sys Those were the files that my system intercepted and they are related to or directed to this website: http://traffdollars.biz/dl/adv553.php WHOS IS info: whois.melbourneit.com] Domain Name: TRAFFDOLLARS.BIZ Domain ID: D12368913-BIZ Sponsoring Registrar: TLDS INC. Sponsoring Registrar IANA ID: 320 Domain Status: clientTransferProhibited Registrant ID: 6510555-SRSPLUS Registrant Name: Jason Coffman Registrant Organization: Private person Registrant Address1: 908 Alder St Registrant City: Philadelphia Registrant State/Province: PA Registrant Postal Code: 19147 Registrant Country: United States Registrant Country Code: US Registrant Phone Number: +1.74952171179 Registrant Email: [email protected] Name Server: NS1.TRAFFDOLLARS.BIZ Name Server: NS2.TRAFFDOLLARS.BIZ Created by Registrar: TLDS INC. Last Updated by Registrar: TLDS INC. Domain Registration Date: Tue Feb 07 18:01:52 GMT 2006 Domain Expiration Date: Tue Feb 06 23:59:59 GMT 2007 Domain Last Updated Date: Tue Feb 07 19:25:25 GMT 2006 Edited March 4, 2006 by RME JICO Quote Link to comment Share on other sites More sharing options...
DBAHO Posted March 4, 2006 Share Posted March 4, 2006 Thanks for the info there RME JICO. Probably a good idea for everyone to do. Quote Link to comment Share on other sites More sharing options...
RME JICO Posted March 4, 2006 Share Posted March 4, 2006 QUOTE(DBAH0 @ Mar 4, 2006 -> 07:24 AM) Thanks for the info there RME JICO. Probably a good idea for everyone to do. No prob, it seems like this Jason Coffman guy of Philadelphia didn't like the Thome trade. I hope the admins can gather enough information to pursue this guy. Quote Link to comment Share on other sites More sharing options...
THEWOOD Posted March 4, 2006 Share Posted March 4, 2006 I really hope you guys pursue this asshole. You have no idea how pissed off I was thursday morning when I couldnt get my soxtalk fix before work. Quote Link to comment Share on other sites More sharing options...
RME JICO Posted March 4, 2006 Share Posted March 4, 2006 Also, I don't know if this has anything to do with the problem, but when you go to: http://www.soxtalk.com/forums/ it asks you to save a file called forums. This was the same thing that happened when the forums were down. It might just be a bug, but normally if you go to the / of site, it defaults to the index.php, but it is not doing that here. Just FYI. Quote Link to comment Share on other sites More sharing options...
THEWOOD Posted March 4, 2006 Share Posted March 4, 2006 QUOTE(RME JICO @ Mar 4, 2006 -> 07:57 AM) Also, I don't know if this has anything to do with the problem, but when you go to: http://www.soxtalk.com/forums/ it asks you to save a file called forums. This was the same thing that happened when the forums were down. It might just be a bug, but normally if you go to the / of site, it defaults to the index.php, but it is not doing that here. Just FYI. That was what I kept getting Thursday morning. It kept telling me to DL something...I was ummmm should I...I dont know?!?!? And then I tried to go straight to the forums and that didnt work either so I figured it was a glitch. I called a friend had them try to get in later in the morning and they said they got a page saying forbidden. Quote Link to comment Share on other sites More sharing options...
kapkomet Posted March 4, 2006 Share Posted March 4, 2006 QUOTE(THEWOOD @ Mar 4, 2006 -> 02:01 PM) That was what I kept getting Thursday morning. It kept telling me to DL something...I was ummmm should I...I dont know?!?!? And then I tried to go straight to the forums and that didnt work either so I figured it was a glitch. I called a friend had them try to get in later in the morning and they said they got a page saying forbidden. That was unrelated... the Thursday morning incident wasn't us being hacked, it was the server. We then change the opening page to reflect the "forbidden" so not as many people would get that. We'll get this (other issue) fixed this weekend. Quote Link to comment Share on other sites More sharing options...
Middle Buffalo Posted March 4, 2006 Share Posted March 4, 2006 I got the email (2 actually). One said don't open this, open the previous one. So, I deleted the first and opened the one I was "supposed" to open, but I didn't click on the link. Can someone tell me if I need to be worried? Quote Link to comment Share on other sites More sharing options...
iWiN4PreP Posted March 4, 2006 Share Posted March 4, 2006 Thanks for the info, and good luck to you guys. Quote Link to comment Share on other sites More sharing options...
SSH2005 Posted March 4, 2006 Share Posted March 4, 2006 I got the email. The subject of the email is "hello my dear friends ( From Soxtalk.com )." It has a link to some Spyware crap in it. Quote Link to comment Share on other sites More sharing options...
Middle Buffalo Posted March 4, 2006 Share Posted March 4, 2006 QUOTE(SSH2005 @ Mar 4, 2006 -> 09:28 AM) I got the email. The subject of the email is "hello my dear friends ( From Soxtalk.com )." It has a link to some Spyware crap in it. If you open it, but don't click on the link, are you at risk? Quote Link to comment Share on other sites More sharing options...
iWiN4PreP Posted March 4, 2006 Share Posted March 4, 2006 I dont think I got hte email. but i may have deleted it already. Quote Link to comment Share on other sites More sharing options...
Kalapse Posted March 4, 2006 Share Posted March 4, 2006 I didn't get an email. Quote Link to comment Share on other sites More sharing options...
SSH2005 Posted March 4, 2006 Share Posted March 4, 2006 (edited) I didn't get an email. <{POST_SNAPBACK}> Do you want me to forward it to you? Edited March 4, 2006 by SSH2005 Quote Link to comment Share on other sites More sharing options...
Chisoxfn Posted March 4, 2006 Author Share Posted March 4, 2006 QUOTE(Middle Buffalo @ Mar 4, 2006 -> 08:29 AM) If you open it, but don't click on the link, are you at risk? No Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.