Ambient on/off
Join eRepublik

Warning - Invader

49 Day 646, 23:29 Romania
[RO]
Pentru cei care folosesc Mozilla Firefox (indiferent de versiune se pare) exista o problema cu accesarea http://wiki.erepublik.com
Am auzit problema asta de la cativa cetateni inclusiv americani si finlandezi (Hi Publius and Erwin S) pe canalul comunitatii romanesti de pe irc, rizon network, #eRO
Am incercat sa refac pasii enuntati de cei cu probleme, si am observat ca odata cu accesarea wiki, de pe un browser Firefox, se downloadeaza si sa incearca sa se ruleze un fisier a.exe in C:\windows\system32\ si pe care Kaspersky il recunoaste ca un invader, si din cauza caruia firefox ia crash pe sisteme dotate cu norton anti virus sau nod32.
Atentie la neatentie, e posibil sa fie vreo infectie facuta de cineva dinauntrul jocului, de aceea va recomand sa va uitati cu atentie la tranzactiile facute de contul dumneavoastra, daca observati ceva ciudat, schimbati parola si dati report imediat la administratori.
Ziua buna,
smif
Your average joe

[EN]
For the ones using Mozilla Firefox web browser (no matter the version installed) there seems to be a problem accesing http://wiki.erepublik.com
I heard of this problem while I was on #eRO, the romanian community irc channel based on rizon network, with citizens like Publius and Erwin S complaining about this problem.
I did the same steps as they told me that they have already done, and it seems that while on a Firefox browser , when you reach wiki.erepublik.com an a.exe file is being downloaded on c:\windows\system32\ and is being loaded. The Kaspersky is reading this thread as an invader, thus you should be very carefull and if you visited wiki.erepublik you should pay close attention to your transaction and if you find anything suspicious, exchange your account password immediately and report it to the administrators.
Also a full computer scan is in need.
Kindly regards,
smif
Your average joe

 
Report comments
 
Zoli
39
Zoli Day 646, 23:30

Baga si in engleza!

 
drewxyz
25
drewxyz Day 646, 23:31

Votat - Important de stiut.

 
vaesir
29
vaesir Day 646, 23:36

Ok sa vedem despre ce este vorba

 
vaesir
29
vaesir Day 646, 23:38

dupa ani si ani cum spunea cineva...
este vorba de JQS.exe
<a href="http://www.processlibrary.com/directory/files/jqs/" target="_blank">http://www.processlibrary.com/directory/[..]jqs/</a>
Pentru ca baietii de la eRepublik folosesc un anume fisier de la SUN.com FF da crash...
So no worry there....

 
Collin Roche
24
Collin Roche Day 646, 23:40

Voted.

 
smif
38
smif Day 646, 23:41

vaesir, este vorba de a.exe nu jqs.exe

 
AlxxRO
31
AlxxRO Day 646, 23:42

mi s-a intamplat si mie! este un program "a.exe"
din fericire programul antispy l-a detectat si i-am dat kill process.

 
Adiemus
41
Adiemus Day 646, 23:42

Mie ieri mi-a disparut run-ul. (si nici acm nu a revenit)
La un moment dat inca era prezent dar cand am dat sa-l deschid mi-a zis ca nu am autoritatea necesara pt acea comanda

Si in plus, din senin a aparut o fereastra din aia neagra cu text in ea si s-a rulat rapid un script... si pe urma s-a inchis. Mi-a cam dat fiori...

Au legatura?

 
smif
38
smif Day 646, 23:44

adiemus, un scan la calculator urgent, YOU HAVE BEEN INFECTED!
Si cu tot respectul pentru Pan Hallipa cred ca ai bitdefender )
de aia nu vede nimic.

 
Bogdan Adamutz
54
Bogdan Adamutz Day 646, 23:48

lol, ce bine ca nu intru pe wiki:))

 
vaesir
29
vaesir Day 646, 23:53

am facut si un trace back la IP-ul de unde se incarca "64.202.102.97" si mi-a aparut asta <a href="http://whois.domaintools.com/64.202.102.97" target="_blank">http://whois.domaintools.com/64.202.102.[..]2.97</a>

 
R3sid3nTt
24
R3sid3nTt Day 646, 23:54

adimeus,actioneaza rapid pana nu strica tot calcu ,poate ai salinity si e rau

 
vaesir
29
vaesir Day 646, 23:55

cat despre acel "a.exe" see info here: <a href="http://www.processlibrary.com/directory/files/a/" target="_blank">http://www.processlibrary.com/directory/[..]s/a/</a>
este un worm ce se transmite mai mult prin e-mail

 
Publius
40
Publius Day 646, 23:58

Hi smif.

bugrepublik becomes wormrepublik.

 
smif
38
smif Day 646, 00:02

Foloseste in continuare Avast
Ca si Adiemus foloseste )
Si uite unde a ajuns
In schimb Kaspersky imi arata CLAR fisierul a.exe, si mai sunt cateva antivirusuri care merg, altele decat Avast.
Sorry for breaking your perfect world but your AV sucks.

 
Poopak
25
Poopak Day 646, 00:03

It's Fired Fox then.

 
Cornny
24
Cornny Day 646, 00:04

Cand folosesc IE nu pot modifica salariile sua concedia angajatii. Practic imi dispar cele doua butoana "Update" si "Fire"

Cu Mozilla merge

 
l.skywalker
29
l.skywalker Day 646, 00:04

Thanks for information. VOTED

 
adrianosun01
33
adrianosun01 Day 646, 00:05

i use google chrome and i got a major problem after i access the wiki to check some info, can not open wiki or something else, so i just uninstall google chrome and go back to IE something was wrong today

 
PimpDollaz
34
PimpDollaz Day 646, 00:12

thanks for the heads up

 
Quicksilver
25
Quicksilver Day 646, 00:23

I also got into it...

 
stephankeops
29
stephankeops Day 646, 00:29

bine de stiut

 
vaesir
29
vaesir Day 646, 00:37

smif - folosesc Avast si am deaschis wiki cu Opera 9.2,IE 7 si FF 3.5.2
La nici unul nu mi-a aparut asa ceva.
in taskrun nu am nici un executabil "a"
Opera imi da o singura eroare, la fel ca si FF la Shockwave.

 
jonnyjon
27
jonnyjon Day 646, 00:37

ce bine ca nu intru pe wiki )

(nici nu stiu daca am intrat de mai mult de 2-3 ori pe wiki de cand am intrat in joc)
apai asa nush daca reusim sa mai aducem jucatori noi...cand afla ca se aleg cu un worm daca vor sa stie ceva despre joc

 
Alecsandru010
31
Alecsandru010 Day 646, 00:38

Eu am NOD,si nu am nici o problema,oricum VOT!

 
Shadowman Fza
35
Shadowman Fza Day 646, 00:44

Dap NOD never failed me also.

 
Bocalindo
33
Bocalindo Day 646, 00:53

folosesc linux )))))))

 
Teiman
23
Teiman Day 646, 00:53

crap

 
pyroelectricity
24
pyroelectricity Day 646, 00:57

Kaspersky for the win.

 
Adiemus
41
Adiemus Day 646, 00:57

Io folosesc Avira + AVG.
Sper ca am reusit sa scap de problema...

 
Noel Guns of Brixton
25
Noel Guns of Brixton Day 647, 01:17

yepp, usef irewall and scanners at least...
Risk Assessment:Low/2(0-5)
"This worm spreads via AOL Instant Messenger and (MS03-040) unpatched Internet Explorer browsers."

 
vladb
36
vladb Day 647, 01:22

lool )

ER is a free web browser game ..not free of worms it seems

 
DrMarius
23
DrMarius Day 647, 01:28

multzam de informatie... bine ca am ramas cu IE8, ca nu pot tolera schimbarea de browser )

 
vaesir
29
vaesir Day 647, 01:46

@smif ok ti-am urmat sfatul si am cumparat Kars...surpriza nu am nimic infectat....
Iar daca vrei sa stii my perfect world este ca pana acum 5 luni nu foloseam nimic. Si acum Avastul il deschid numai cand imi aduc aminte.
Nu imi este niciodata frica de un worm sau trojan si mai ales nu dau click ca "vita" pe orice link imi apare pe web.
o singura data in viata mea am luat un virus urat si atunci a fost din cauza ne-atentiei.
Cat despre ce antivirus este bun....in acest domeniu nu poti sa faci o comparatie.Toate sunt bune la un moment dat si apoi cad.
De exemplu cel mai bun pana acum este Norton. De care anul trecut toata lumea fugea de parca era frate cu draku..


yeah long story short.
you have the "a.exe" in the Taskrun List?
Do what this guys tell you to do:
<a href="http://www.symantec.com/security_response/writeup.jsp?docid=2003-051914-5016-99&tabid=3" target="_blank">http://www.symantec.com/security_respons[..]bid=3</a>

 
sweeta
41
sweeta Day 647, 02:55

@Cornny: parerea mea e ca e plin de buguri jocul, uneori dai work si iti mai arata apoi ca trebuie sa muncesti...si altele.btw, mie in IE mi se inchide pagina cand accesez jocul.

 
AlxxRO
31
AlxxRO Day 647, 04:16

La mine BitDefenderul nu l-a vazut. Noroc ca imi ruleaza si SpyBot (program gratuit...) care l-a detectat imediat + crash pe firefox.

 
Vercety
20
Vercety Day 647, 10:25

ok smith, am da-t ))))))

 
hommaaja
25
hommaaja Day 647, 12:48

Symantec agrees: <a href="http://safeweb.norton.com/report/show?url=erepublik.com" target="_blank">http://safeweb.norton.com/report/show?ur[..]k.com</a>

 
eCICEA
8
eCICEA Day 647, 13:01

folositi opera si nu aveti probleme

 
dj Tieff
30
dj Tieff Day 647, 14:06

VOTAT! bravo smif, AGAIN!
FOLOSITI CU INCREDERE MOZILLA ZOLIfox...cel mai bun browser...TRADUCE BINE DIN ROMANA/ENGLEZA, in UNGURESTE:) da invers nu, ca are bug-uri:))
ZOLI comenteaza la ai tai acolo ) aia "hun"...sau ce sunteti voi de fel:))
poate comentezi ZZZOOOLLLIII:)) te votez presedinte peste buda -pesta:)) ca atat va mai fi ungaria in ceva vreme:)) din tot pEACE-ul:))

 
simon santo
27
simon santo Day 647, 14:46

thx voted and subscribed

 
gamerno1
25
gamerno1 Day 647, 19:01

I noticed somthing was worng when my firewall started going nuts...

Oh and voted.

 
Erwin Schauman
26
Erwin Schauman Day 647, 20:49

Seems that the trojan it uploads is a.exe. msa.exe has also been reported but it could be another trojan that a.exe uploads. Couldn't find anything on my computer so I assume the browser crashing was a safety measure that stopped the virus from infecting the system.

 
graduallynevele
34
graduallynevele Day 647, 20:56

Haven't gotten any problems on Opera.

 
HaiCuPorcu
20
HaiCuPorcu Day 647, 21:18

Am FF 3.5.2 si nu mi se intampla nimic si chiar eram curios... de unde pot face si eu rost de acest a.exe ?
Voi ce versiuni de firefox aveti de sunteti afectati ?

 
Q J Lincoln
23
Q J Lincoln Day 648, 09:19

Just got a message from an amigo at eRep.

All users need to clear their cookie + cache.

From the admins:
"This issue was solved, all the sites from that server were cleaned and moved to another server. But all Wiki users still report problems with the Wiki mostly (because their cache still keeps the malicious code). "

I want to personally thank all of the wiki editors that reported this issue. I didn't know my "baby" was so sick!!!! (I hope it wasn't swine flu).

 
veek
25
veek Day 648, 10:16

sunt fericit! lucrez pe macintosh!

 
avevali
23
avevali Day 657, 04:12

<a href="http://www.erepublik.com/en/newspaper/ad[..]37/1" target="_blank">http://www.erepublik.com/en/newspaper/ad[..]37/1</a>

Ziarul Oficial al Ambasadei eMoldovei in Romania.
Subscribe, vote &comment.

 
Iskander181
21
Iskander181 Day 662, 07:06

9/11 – TERROR – TERRORISM – FALSE FLAG OPERATIONS
<a href="http://www.erepublik.com/en/article/9-11-terror-terrorism-false-flag-operations-935454/1/2" target="_blank">http://www.erepublik.com/en/article/9-11[..]4/1/2</a>