This got me thinking that another threat we will face shortly is phishing.
One could create a site looking just like Mt. Gox, InstaWallet or ClearCoin, with a similar domain name, but just be a big scam and eat your coins.
People will need to be extra careful.
Topic: Errorer impersonating staff (Read 1519 times)
Their accounts are deleted now, and new users can now not use names that contain staff names. (This is probably pretty easy to bypass, though, so watch out.)
Also, don't click on URL shortened links, especially in Bitcoin related fora.
I added xxxxxs so no one can click by accident.
I didnt catch it with a antivirus.
I caught it with my bullshit detector.
I know I have not written anything offensive and a simple account check on the sender of the PM showed he was a newbie and only made one post in the newbie forum with the same link.
I then ran the URL through some online checkers and it showed that it redirects to Javascript.
Seems to try to install some software if clicked however what and why I dont know.
I didnt catch it with a antivirus.
I caught it with my bullshit detector.
I know I have not written anything offensive and a simple account check on the sender of the PM showed he was a newbie and only made one post in the newbie forum with the same link.
I then ran the URL through some online checkers and it showed that it redirects to Javascript.
Seems to try to install some software if clicked however what and why I dont know.
I think you should get rid of that link right away. We don't anyone accidentally clicking it and infecting their computer. One more thing, which AV were you using that caught the virus, it would be nice to know, thanks.
Thanks for the info.
I checked myself and it seems to open some Java script.
http://xxxxxxxxxxxxxxxxxxxxxxxxxximages4u.hostil.pl/DSC00054.jpg redirects to
http://xxxxxxxxxxxxxxxxxxxxxxxxxxximages4u.hostil.pl/DSC00054.jpg/
Checking: http://xxxxxxxxxxxxxxxxxxxxxxxxxxxhostil.pl/reklama.js
File size: 4331 bytes
File MD5: 4119156a2fb15193a5647431ba91b261
http://xxxxxxxxxxxxxxxxxxxxxxhostil.pl/reklama.js - Ok
Checking: http://xxxxxxxxxxxxxxxxxxxxxxxxxxxximages4u.hostil.pl/DSC00054.jpg/
Engine version: 5.0.2.3300
Total virus-finding records: 2220597
File size: 859 bytes
File MD5: 381b45cceb715c29baaa073dc1dd2a82
http://xxxxxxxxxxxxxxxxxxximages4u.hostil.pl/DSC00054.jpg/ - archive HTML
>http://xxxxxxxxxxxxxxxximages4u.hostil.pl/DSC00054.jpg//JavaScript.0 - Ok
>http://xxxxxxxxxxxxxxxxxximages4u.hostil.pl/DSC00054.jpg//Script.1 - Ok
>http://xxxxxxxxxxxxxxxxximages4u.hostil.pl/DSC00054.jpg//Script.2 - Ok
http://xxxxxxxxxxxxxxxximages4u.hostil.pl/DSC00054.jpg/ - Ok
Don't click on any of the above.
I checked myself and it seems to open some Java script.
Quote
http://xxxxxxxxxxxxxxxxxxxxxxxxxximages4u.hostil.pl/DSC00054.jpg redirects to
http://xxxxxxxxxxxxxxxxxxxxxxxxxxximages4u.hostil.pl/DSC00054.jpg/
Checking: http://xxxxxxxxxxxxxxxxxxxxxxxxxxxhostil.pl/reklama.js
File size: 4331 bytes
File MD5: 4119156a2fb15193a5647431ba91b261
http://xxxxxxxxxxxxxxxxxxxxxxhostil.pl/reklama.js - Ok
Checking: http://xxxxxxxxxxxxxxxxxxxxxxxxxxxximages4u.hostil.pl/DSC00054.jpg/
Engine version: 5.0.2.3300
Total virus-finding records: 2220597
File size: 859 bytes
File MD5: 381b45cceb715c29baaa073dc1dd2a82
http://xxxxxxxxxxxxxxxxxxximages4u.hostil.pl/DSC00054.jpg/ - archive HTML
>http://xxxxxxxxxxxxxxxximages4u.hostil.pl/DSC00054.jpg//JavaScript.0 - Ok
>http://xxxxxxxxxxxxxxxxxximages4u.hostil.pl/DSC00054.jpg//Script.1 - Ok
>http://xxxxxxxxxxxxxxxxximages4u.hostil.pl/DSC00054.jpg//Script.2 - Ok
http://xxxxxxxxxxxxxxxximages4u.hostil.pl/DSC00054.jpg/ - Ok
Don't click on any of the above.
Clicked link and Firefox starting downloding it without asking. Virus scanner popped up with W32.Induc.A warning and deleted it.
Could you give me some details as to what happened when you clicked on it?
Did it install software?
Show a picture?
Thanks
Did it install software?
Show a picture?
Thanks
Virus. I clicked!
I just got a PM form a newbie with the following information:
I censored the link. I have no idea what that link is but I certainly wouldn't click on it.
I reported the user and the message.
Just a heads up.
Quote
You have just been sent a personal message by Errorer on Bitcoin Forum.
IMPORTANT: Remember, this is just a notification. Please do not reply to this email.
The message they sent you was:
Hello
Statements which should not be generally offensive, be excessively repeated or have bad formatting (spam), contain forbidden advertising or political or religious views, not be non-English when English is required, disclose personal data of others, or support any other rule violation.
Proof can be seen at:
http://xxxxxxxxxxxxxxxxxxxxxxxxxxx
One more warning and your account might be banned.
IMPORTANT: Remember, this is just a notification. Please do not reply to this email.
The message they sent you was:
Hello
Statements which should not be generally offensive, be excessively repeated or have bad formatting (spam), contain forbidden advertising or political or religious views, not be non-English when English is required, disclose personal data of others, or support any other rule violation.
Proof can be seen at:
http://xxxxxxxxxxxxxxxxxxxxxxxxxxx
One more warning and your account might be banned.
I censored the link. I have no idea what that link is but I certainly wouldn't click on it.
I reported the user and the message.
Just a heads up.
Same message but different person sent mine. Had name similar to admin.
CONTAINS VIRUS. I actually clicked it!
CONTAINS VIRUS. I actually clicked it!
Right, I'll do that now. I actually haven't opened to the PM, just read the email notification and wanted to warn not only staff but users as fast as possible.
Done. Forum is pretty slow right now but I think it went through.
Done. Forum is pretty slow right now but I think it went through.
Click the "Report to Admin" link at the lower right hand side of the displayed private message.
A member is sending PM's talking of rule violations and linking to images4u site (didn't click on it). Beware this user. This thread is to alert staff and to warn others.
Quote from: Errorer
Hello
Statements which should not be generally offensive, be excessively repeated or have bad formatting (spam), contain forbidden advertising or political or religious views, not be non-English when English is required, disclose personal data of others, or support any other rule violation.
Proof can be seen at:
http://images4u.EDITEDFORSAFETY
One more warning and your account might be banned.
Statements which should not be generally offensive, be excessively repeated or have bad formatting (spam), contain forbidden advertising or political or religious views, not be non-English when English is required, disclose personal data of others, or support any other rule violation.
Proof can be seen at:
http://images4u.EDITEDFORSAFETY
One more warning and your account might be banned.
Jump to: