Recent site problems, trojan horses and other nasty things! Forums

peejay · Campsite DB Admin

Hi all,

It obvious there's been a lot of site problems while i've been away on my hols.

The site is still very slow even on broadband but i can live with that knowing that Dave is probably working behind the scenes frantically finding a fix (go get 'em Dave).

I seem though, to have been recently innundated with attacks by numerous trojan horses (whatever they are, but sometimes several times a day) and something called lexpps.exe. The Norton thingy is doing a sterling job at the moment fending off attacks but do you think this is anything to do with the obvious malicious interest in MHF.com at the moment (obviously jealous of success) or am i just being unlucky at the moment? I've never had so many attacks in the past.

A learned reply from someone wot knows about these things would be much appreciated (In Queens English).

pete.

DABurleigh

Pete,

How do you know it's a Trojan attack?

For instance, if you have a Lexmark printer on a network, it could simply be your firewall doing its job until you tell it it's friendly and is supposed to be going on .....

Dave

peejay · Campsite DB Admin

Hi Dave,

sorry, probably didn't explain properly, the lexpps.exe is a separate attack, not a trojan thingy, did a google search and as you say, its to do with lexmark printers, but i've got an Epson printer!

I know all the others are trojan horses because the norton antivirus software says so.

The only reason i query this is because until i retuned from holiday i rarely got any attacks like this, just seems a bit too co-oincidental maybe?

pete.

MOTORHOMER

[quote:25c67c2f7c="peejay"]Hi all,

It obvious there's been a lot of site problems while i've been away on my hols.

The site is still very slow even on broadband but i can live with that knowing that Dave is probably working behind the scenes frantically finding a fix (go get 'em Dave).

I seem though, to have been recently innundated with attacks by numerous trojan horses (whatever they are, but sometimes several times a day) and something called lexpps.exe. The Norton thingy is doing a sterling job at the moment fending off attacks but do you think this is anything to do with the obvious malicious interest in MHF.com at the moment (obviously jealous of success) or am i just being unlucky at the moment? I've never had so many attacks in the past.

A learned reply from someone wot knows about these things would be much appreciated (In Queens English).

pete.[/quote:25c67c2f7c]

Hello Pete

You are not alone. We were away when the site was hijacked so dont know what strange posts etc were made. One thing is sure. Since we have been back we have been unindated with trojan horses, hijacker threats, etc many times a day. We find we were constantly doing various scansby spybot, pest control. microsoft anti spyware etc. No one gets them all. A couple of days ago we installed the norton package 2005 for security & virus protection. It seems to be catching a lot more than the regularly automatic updates of 2004 version it replaced. We also seem to be getting a hell of a lot more spam as well.

Motorhomer

nukeadmin · Site Admin

hi all, well i have finally ascertained the major root cause of the MHF probs, the site has been undergoing a sustained Denial of Service attack from someones PC, i have no problems listing this IP here.

It is 84.134.235.80 who is a Blue Yonder customer. I am in the process of informing them to let them know !!!!

as for the weird error messages that get displayed when you enter the forums, i am trying to ascertain what i have done that has caused it !!

BadlyOverdrawnBoy

[quote:1aee332365="nukeadmin"] i have no problems listing this IP here.

[/quote:1aee332365]

Quite a few systems give you a new IP each time you connect, so this could lead to hassle for someone completely innocent.

dodger148

Dynamic (IP addresses that change) are fine for individuals but web sites such as this need to retain the IP address.
Other instances may complicate things if you have say a router which wants a static address but your provider gives you dynamic address such as mine.
These things are sent to blow our minds, but if the children stopped playing and being silly we wouldnt have all this aggro

peejay · Campsite DB Admin

Going back to my original query, it's happened again this morning, 2 attacks by a sokets de trois v1 trojan horse. The norton is doing its job well though. Does anyone think there is any link to this and the recent site problems?

Sorry you're having the same probs motorhomer.

pete.

nukeadmin · Site Admin

shouldnt have thought so peejay, just a co-incidence, these things are happening all the time, and also a helluva lot of security apps flag false positives and say you are being attacked when you arent Smile