Topic: Weenie Down

[uncle bud]

Hi all - Just a quick note to say our host has had some trouble today and we were taken down for some time for security reasons. We seem to be back up but things could still be a little unstable for awhile as they continue to work through the problem. We'll keep you updated.

Drive safely.

[waxwing]

Odd. We seem to have gone back in time. I was shown the exact same "Unread Posts" list I saw last night, and a post I made after viewing those posts has disappeared. Anyone else lose a post?

Wax

[jed]

They may have restored all or some portion from a backup.  Some modicum of loss is not out of the question. 

You may want to wait a bit to see what is restored; if you compose your posts offline, you can re-post them once things have stabilized. 

Relieved,
Jed

[uncle bud]

Yes, they restored from backup. More info as it comes in, but a couple of the last posts before the downtime may have gone missing. They are still working on fixing the overall problem, but it has hit a number of sites on our host server.

[Stuart]

When I clicked on WC late this morning my firewall (McAfee On-Access Scan) came up due to it detecting a virus/Trojan being downloaded from the host server. Here's the McAfee page on the virus/Trojan:

http://home.mcafee.com/VirusInfo/VirusProfile.aspx?key=99965#

As you can see, it's been around for a while so virus protection programs most probably caught it. I'm still running XP and IE6 which made my box a target, but when in doubt, a system scan might be in order.

[Norfolk Slim]

My AVG caught the same thing- so yes, anyone without good up to date protection should run a scan asap.

[Slack]

Right, all accounts were affected on the host server - so they had to restore from backup and change all passwords etc.  The host has suspended two accounts.   Run a scan on your system with your anti-virus software.  Folks will have to re-post any posts that got lost right before we went down.

Stuff happens.

[uncle bud]

And Slack, by passwords, you mean administrative passwords, not Weenie user passwords, and by accounts, you mean clients of our host, not individual Weenie accounts - correct? Just so everyone is clear.

[Slack]

That's correct, thanks for clarifying UB. 

[Rivers]

Does our hosting outfit know the exact timeframe during which the site was affected? This for folks who had not accessed WC during that time. For example I previously checked in Thursday night, all was OK, and then again when I got home Friday 5:30P and saw the emails, at that time I got no warnings and a white screen which I assume was a placeholder while they were working on it.

[uncle bud]

Earlier Friday morning was OK when I was online. Wax checked around 11:30 EST or so I think and got the white screen. The white screen was not a placeholder but seems to be part of the security compromise.

For anyone running virus scans: is your software finding anything actually resident on your computer or did you just get download warnings when you visited the Weenie site (as it seems Stuart, Slim and I did)? So far, anti-virus software seems to have blocked this thing.

[Norfolk Slim]

Just a warning here- AVG caught it fine.

[dj]

I'm running Firefox on XP, and just got the white screen.  Full scan with updated virus software found nothing.  My most recent quarantines were from back in July.

[Stuart]

After the initial message, I also ran a scan--nothing got through.