Message for Sonny Re: Racing Studebakers

[Transtar60]

Hey Sonny,FYI I just visited my photo album on your website and two different Trojan attacks occurred


3E38
4E2
4E28
5E13
7E7
8E7
8E12
8E28

59 Lark
etc

[grobb284]

I haven't been back for a short while, I had the same problem with a virus attack there and had to run Avast antivirus.

[allstateguy]

My work firewall calls it a malicious website. I miss going there!

JohnP, driving & reviving
an early Lark

[Alan]

I have no problems with the forums, maybe it is just the photo gallery that has a problem.

[PlainBrownR2]

I was getting the same thing. I'm also running antiviral software and it freaked once I loaded the page. I just bookmarked the Racing Studebaker forum page and the Studebaker forum page and I use those now to get to either without going through the Racing Studebaker page first.

[img=left]http://i158.photobucket.com/albums/t102/PlainBrownR2/My%201950%202r5%20Studebaker%20Pickup%20with%20turbocharger/P1000137-1.jpg[/img=left][img=left]http://i158.photobucket.com/albums/t102/PlainBrownR2/My%201950%202r5%20Studebaker%20Pickup%20with%20turbocharger/P1000145-1.jpg[/img=left][IMG=right]http://i158.photobucket.com/albums/t102/PlainBrownR2/Ex%20Studebaker%20Plant%20Locomotive/P1000578-1.jpg[/IMG=right]
[IMG=right]http://i158.photobucket.com/albums/t102/PlainBrownR2/My%201964%20Studebaker%20Commander%20R2/P1010168.jpg[/IMG=right]

[bams50]

As PBR2 says, go to the Forums directly to bypass the problem area:

http://racingstudebakers.com/stl-web/bulletin/bb/index.php?sid=0b08b3c44525ec7a633295f34c19af93

Robert (Bob) Andrews Owner- Studebakeracres- on the IoMT (Island of Misfit Toys!)
Parish, central NY 13131

"Some people live for the rules, I live for exceptions"- 311

"Do they all not, by mere virtue of having survived as relics of a bygone era, amass a level of respect perhaps not accorded to them when they were new?"

[DEEPNHOCK]

I saw Sonny earlier today (before reading this) and sent him a voicemail a few minutes ago, so he will be able to respond to this...
Jeff[8D]

quote:Originally posted by Transtar60

Hey Sonny,FYI I just visited my photo album on your website and two different Trojan attacks occurred

[Mike Van Veghten]

No...I mentioned this to him a few weeks ago also. Same thing, I can't get there from work any more because of it.

And this past weekend after going there...I got one at home...that McAfee won't get rid of!
No quarantine, no removed, no nuthin! SILL have it...

Mike

[Sonny]

quote:Originally posted by Transtar60

Hey Sonny,FYI I just visited my photo album on your website and two different Trojan attacks occurred


3E38
4E2
4E28
5E13
7E7
8E7
8E12
8E28

59 Lark
etc

Ooooh tay.... Lemme guess, you didn't email me about it because my email Trojan attacked ya too?

Sonny
http://RacingStudebakers.com

[Sonny]

Holy CRAP fellas! Sorry 'bout that! Didn't realize that it had effected so many... Lemme 'splain.

What we did NOT have is a virus attack. Yep, my website is built with "Front Page" and some little scumbag from Russia, via Hong Kong, (oh yeah, my "server guy" tracked the little butt-hole down [^]), found a tiny, tiny security breach in the Front Page software and inserted one, tiny little line of code in my Racing Studebakers home page.

Mike emailed me that he got an alert from his virus checker and we went to work on it immediately. The server guy ran a virus check on the complete Racing Studebakers part of the server and found absolutely zip, zero, nada, nothing. Grrrr.... I wasn't having any problems and no other complaints so we decided to see if anybody else got an alert, figuring it may have just been a "false positive" or some kind of glitch. But, sure enough, TWO more emails! DOUBLE Grrrr....

This time we took the day and went in, looked at every, single line of code on the website, starting with the home page. There it was! Down on the very bottom margin of the home page code was a little line of script, outside the actual html operating area. It was supposed to re-direct anyone who opened the Racing Studebakers home page to some slimy, Adobe type web page in Russia! Obviously it didn't work as nobody complained about seeing a Russian website! We looked at EVERY other page of Racing Studebakers code and there was no other scripts or virus, whew...

However, I was afraid that somebody could put a real virus where that little script was. Well, here's why that would be a LOT harder. The scumbags used a "back door" in Front Page to insert this little re-direct code, but since it was such an obscure "hole" in the software, they couldn't put their code were it was supposed to be so it would work correctly. Second, my server guy assured me that they run anti-virus software continuously, have an industrial strength firewall and watch all of the websites carefully. He assured me that IF somebody could put an actual virus on my website, they would know about it very shortly thereafter.

Now, why did some have an alert from this and some did not? It seems that some anti-virus software uses a type of "fuzzy logic", and some does not. IF your virus protector "alerted" when you brought up the Racing Studebakers home page KEEP IT! It KNEW SOMEthing was wrong, but even if it didn't know exactly WHAT was wrong, it alerted, as it logically SHOULD do! It identified the re-direct code as a "Trojan" because it was in an unusual place, didn't match other virus types and didn't activate or try to download a known virus when summoned along with the home page code, all attributes of a Trojan. Nice job...[^]

Now, the "other" type of anti-virus software, (that I have), uses a "comparison" method/system. It only compares the "signatures" & "traces" of those viruses [u]in it's current library</u>. If it gets no matches, it assumes no problem, thus no alert! THAT is why it's a darn good idea to keep your anti-virus software updated, DAILY!

Ok, in any event, I wasn't too worried and why I didn't make a big deal out of it. No virus, no real threat to anybody, just a PITA if you try to bring up my home page. Also, I've been watching the website a LOT more closely lately, as well as working on the website behind the scenes, updated the Front Page software, (although I have to re-do the webpages with the updated software for it to be effective), and looking into doing a whole new look for Racing Studebakers. The scumbags only put the re-direct code on the Racing Studebakers and the Studebaker Racing Association HOME pages, nowhere else on either website. In fact, they cannot put it on any forums because the forums are written in different code!

So, we think we have the problem solved, BUT, with the slimy, scumbags who have dedicated their slimy little selves to making webmaster life miserable, who knows... Just email me if ya have ANY problem, ANYwhere on the Racing Studebakers website. I promise that I'll c

[PlainBrownR2]

Now from the other side of the fence [)]
I bookmarked the forum sites because the antivirus software has a component that keeps an electronic watchful eye on the website. Once the trojan was detected it gave me a couple choices; keep the site or remove it to a "penalty box" where once in there the site will never ever ever appear again unless it's removed, as there's something suspicious with the address. Since I didn't know what was on the page I did the latter, twice. Once because I thought it was a fluke and then pulled it back out of "penalty box" and then again when it showed up a second time. I was assured something was rotten in Denmark so I kept it until it was fixed. I think I also sent you an email too, but I didn't think of anything of it afterwards, as the issue was temporarily resolved. It's good the site is fixed, now I can post it in the bookmark bar again .

[img=left]http://i158.photobucket.com/albums/t102/PlainBrownR2/My%201950%202r5%20Studebaker%20Pickup%20with%20turbocharger/P1000137-1.jpg[/img=left][img=left]http://i158.photobucket.com/albums/t102/PlainBrownR2/My%201950%202r5%20Studebaker%20Pickup%20with%20turbocharger/P1000145-1.jpg[/img=left][IMG=right]http://i158.photobucket.com/albums/t102/PlainBrownR2/Ex%20Studebaker%20Plant%20Locomotive/P1000578-1.jpg[/IMG=right]
[IMG=right]http://i158.photobucket.com/albums/t102/PlainBrownR2/My%201964%20Studebaker%20Commander%20R2/P1010168.jpg[/IMG=right]

[Sonny]

quote:Originally posted by Mike Van Veghten

No...I mentioned this to him a few weeks ago also. Same thing, I can't get there from work any more because of it.

And this past weekend after going there...I got one at home...that McAfee won't get rid of!
No quarantine, no removed, no nuthin! SILL have it...

Mike

You don't have a virus Mike. Check & see. You only had a problem when you tried to open the RS home page, right? Now check it...

Sonny
http://RacingStudebakers.com

[allstateguy]

Thanks Sonny! Even my work's over-eager netnanny is happy now, ME TOO!

JohnP, driving & reviving
an early Lark

[grobb284]

Thanks for making and keeping the site. Missed it for a short period due to Trojan Horse alert.

Best regards.

[jlmccuan]

Over the past few days, I have had an Adobe page try to load and then hang. Didn't think too much about it at the time, but now it fits. Thanks for the details.

Jim

_________1966 Avanti II RQA 0088______________________1963 Avanti R2 63R3152_______________Rabid Snail Racing