Thread: A hacker and new registrations

We have been dealing with a hacker for the last while and while admin is not around atm, Harold and I have only been able to delete his account whenever he shows up.

I have resorted to changing the human verification setting to question and answer. The question informs the user that we are dealing with a hacker and that new registrations are being blocked for the time being.

We will hopefully resolve the issue in due time and will restore new registrations as soon as we can.

Thanks for your patience and continued support.

KALSTER

I wonder if the hacker is the reason I've started getting an adf.ly page whenever I try to look at the default forum view.
Any other selection (e.g. today's posts or a sub-forum) is okay, but the "normal" view now when I try to come here is that damned page: and although it's got a "Skip ad" button all it does is count down 5 seconds and then reset...

Originally Posted by Dywyddyr

I wonder if the hacker is the reason I've started getting an adf.ly page whenever I try to look at the default forum view.

If you have not resolve the issue of "Ad" related hijacking, I would suggest clearing your browser Cookies & Cache. That should restore regular access back to all parts of the forum for members like us. For a more thorough cleanup, some of you may want to consider following the advice listed below.

How to Remove Browser Hijacker Adf.ly?

Probably yes. We'll have to wait for admin to sort it out.

That's the same page it was directing me to when I logged on from my phone last night. I'm guessing it's down to the "newuser" git. Is it possible to check the IP address to see if it is a recently banned member playing silly buggers? I have my suspicions that it is one banned loon in particular who went off the deep end and said basically "you'll be sorry for messing with me!"

The accounts have been deleted in a desperate attempt at stopping him and he never made any posts, so I don't think we can track it. But I wouldn't be surprised if it was that guy.

Originally Posted by scoobydoo1

Originally Posted by Dywyddyr

I wonder if the hacker is the reason I've started getting an adf.ly page whenever I try to look at the default forum view.

If you have not resolve the issue of "Ad" related hijacking, I would suggest clearing your browser Cookies & Cache. That should restore regular access back to all parts of the forum for members like us. For a more thorough cleanup, some of you may want to consider following the advice listed below.

How to Remove Browser Hijacker Adf.ly?

Thanks again Scooby!

Originally Posted by KALSTER

he never made any posts, so I don't think we can track it.

Does a chatbox entry count for traceability?

Not sure and I still don't have any internet, which makes it difficult for me to navigate the forum. But I wouldn't think so.

I am checking logs to see why/how this is happening.

it almost seems like someone left a trapdoor where they can upgrade themselves to admin status as soon as they are registered
the good thing is that blocking new members from registering has prevented him from gaining access
which means that he needs to be in first to do his nefarious business, and does not have an alternative way into the forum

Admin made a few changes that will hopefully prevent the hacker from returning. I will restore registrations again a bit later today.

I ask people to be vigilant and to report him as soon as you notice his return.

Thanks in advance!

Ok, registrations are enabled. Let's hope the issue has been fixed.

Something's been fixed : I'm no longer getting the adf.ly page...
(I followed - as far as I was able - the removal procedure but A) the majority of it was inapplicable to the problem - no actual files on my PC to delete, B) it only happened on the one page, which makes me think it was a peculiarity of whatever the hackers had done).

I had an issue of random text on webpages having been converted to ad links. I downloaded Malwarebytes and it removed it. It is free.

I hope you get this issue resolved. I was getting pop ups last week when trying to access this site. I hate hackers, they need locking up. Menaces.
Proper internet regualation etc will sort them out.

Newuser is back

Also as "playboy" by the look of it.

Misremembered: http://www.thescienceforum.com/members/biology.html

Took care of both newuser and biology. Also banned the mail addy they used and put the human verification back to Q&A.

I hope admin can sort something out. Apparently the other measure he took did not work out well.

Kalster/Admin

Can you tell me why I am only getting certain email notifications on certain threads?
It has been happening for quite some time and now with all the strange events I thought it best to mention it.

Have you checked the notifications/subscriptions part of your settings? You can set up which threads you are subscribed to and how/when you are notified. (Also if you have people on ignore you are not notified when they post). You can view/change these via the "Quick links" -- "subscribed threads" at the top of the page.

Originally Posted by hannah40

Kalster/Admin

Can you tell me why I am only getting certain email notifications on certain threads?
It has been happening for quite some time and now with all the strange events I thought it best to mention it.

You mean that you are subscribed to a bunch of threads, but that only activity on some of them generates an email notification?

Originally Posted by KALSTER

Originally Posted by hannah40

Kalster/Admin

Can you tell me why I am only getting certain email notifications on certain threads?
It has been happening for quite some time and now with all the strange events I thought it best to mention it.

You mean that you are subscribed to a bunch of threads, but that only activity on some of them generates an email notification?

Yes, but when I look,manually, there are replies I haven't got from others too. It's not just on here, it is on my twitter and Facebook accounts too.
Also, I get notifications on twitter etc, then the notifications appear again days or weeks later. It's like someone is playing stupid games.
It happens on my phone too, and I don't know how they do this but they are changing the settings on my mobile phone, they keep switching my alarm off on my phone and I've nearly overslept a few times.
I've reported it all to police along with other electronic/ strange happenings.

Originally Posted by hannah40

Originally Posted by KALSTER

Originally Posted by hannah40

Kalster/Admin

Can you tell me why I am only getting certain email notifications on certain threads?
It has been happening for quite some time and now with all the strange events I thought it best to mention it.

You mean that you are subscribed to a bunch of threads, but that only activity on some of them generates an email notification?

Yes, but when I look,manually, there are replies I haven't got from others too. It's not just on here, it is on my twitter and Facebook accounts too.
Also, I get notifications on twitter etc, then the notifications appear again days or weeks later. It's like someone is playing stupid games.
It happens on my phone too, and I don't know how they do this but they are changing the settings on my mobile phone, they keep switching my alarm off on my phone and I've nearly overslept a few times.
I've reported it all to police along with other electronic/ strange happenings.

just disconnect your phone from the internet before you go to bed and make sure your alarm is on. pesky, but it's one solution.

Originally Posted by scoobydoo1

Originally Posted by Dywyddyr

I wonder if the hacker is the reason I've started getting an adf.ly page whenever I try to look at the default forum view.

If you have not resolve the issue of "Ad" related hijacking, I would suggest clearing your browser Cookies & Cache. That should restore regular access back to all parts of the forum for members like us. For a more thorough cleanup, some of you may want to consider following the advice listed below.

How to Remove Browser Hijacker Adf.ly?

I followed the instructions but I can't seem to fix it. It's only with this site. But when I google it, the information about it says it should be redirecting me when I use Firefox for anything.

Originally Posted by DianeG

Originally Posted by scoobydoo1

Originally Posted by Dywyddyr

I wonder if the hacker is the reason I've started getting an adf.ly page whenever I try to look at the default forum view.

If you have not resolve the issue of "Ad" related hijacking, I would suggest clearing your browser Cookies & Cache. That should restore regular access back to all parts of the forum for members like us. For a more thorough cleanup, some of you may want to consider following the advice listed below.

How to Remove Browser Hijacker Adf.ly?

I followed the instructions but I can't seem to fix it. It's only with this site. But when I google it, the information about it says it should be redirecting me when I use Firefox for anything.

Never mind, I tried it again and it worked. Thanks.

Almost a duplicate of below.

As of last night, I have started to encounter AdFly on the home page of this forum and when I try to use the forum search function. I have no plans to do anything to my computer because I am of the opinion that it is a site problem related to Firefox browser use. It does not happen anywhere else that I travel on the net using Firefox and IE seems to be able to go to the home page.

I noticed it was back earlier today using IE on my phone. Cleared cache and cookies and it now seems Ok.

Originally Posted by PhDemon

I noticed it was back earlier today using IE on my phone. Cleared cache and cookies and it now seems Ok.

Okay, I did that, clearing just cookies and cache and now I can go to the main page.

I wonder how this comes about, given that it seems to happen during intervals when I have not been at my computer? That is why I suspect there is some mischief happening at this site and I get edgy about hanging around here and why I have not been as active here as at previous times.

Then again, that might be a good thing from the perspective of others, lol...

Originally Posted by scheherazade

I wonder how this comes about, given that it seems to happen during intervals when I have not been at my computer?

Your browser files have an expiry date.
This means that at midnight (while you are asleep or away from home) the files expire.
And then, when you next open the web-page, the new "adfly" version of the website is downloaded.
This tends to lead people into thinking that something has "happened" when really all that has happened is a day has passed.

A similar thing can happen when browsers limit your cache size.

Ok admin has been busy with the followng:

Originally Posted by admin

- Take full backup once again
- Replace all vbulletin files with the ones from latest stable release
- Upgrade database
- If TSF's working without too many thing broken, keep it. Else, restore from backup and look for another solution

Please report any issues as you notice them with the forum in general and if the hackers show up again. Hopefully these efforts will finally pay off.

Apologies to everyone for the inconvenience and thank you for your patience and continued support!

KALSTER

Thank you Kalster and Admin. for your efforts in dealing with this problem. I am reluctant to make any changes to my system when I only encounter a problem on one site. A couple of years ago, ToeQuest was under some form of attack and Norton flagged them as unsafe. This one was different in that Norton was not flagging or blocking it.

Originally Posted by KALSTER

Please report any issues as you notice them with the forum in general and if the hackers show up again. Hopefully these efforts will finally pay off.

My email notifications seem to have stopped, despite the fact that in my settings they are set up correctly...

The website has an incorrect favicon?

Originally Posted by PhDemon

Originally Posted by KALSTER

Please report any issues as you notice them with the forum in general and if the hackers show up again. Hopefully these efforts will finally pay off.

My email notifications seem to have stopped, despite the fact that in my settings they are set up correctly...

Have you tried disabling them, saving and then re-enabling them again? (i.e. have you tried turning it off and on again )

Originally Posted by RedPanda

The website has an incorrect favicon?

I did report it to admin earlier, but it seems to be back. Do you still not see it?

Originally Posted by KALSTER

Originally Posted by RedPanda

The website has an incorrect favicon?

I did report it to admin earlier, but it seems to be back. Do you still not see it?

Currently, I don't see the correct favicon - but they are notoriously difficult to refresh in FireFox.

{edit}
Just tried it in IE - has the new V shaped favicon.
Tried it in Chrome - no favicon at all.

Was not able to log in, tried to change my username Could only log in as Stargate2 all information was gone, likes and ignore list removed. Not receiving any prompt from email.

Originally Posted by KALSTER

Have you tried disabling them, saving and then re-enabling them again? (i.e. have you tried turning it off and on again )

That seems to have sorted it out.

Originally Posted by RedPanda

Originally Posted by KALSTER

Originally Posted by RedPanda

The website has an incorrect favicon?

I did report it to admin earlier, but it seems to be back. Do you still not see it?

Currently, I don't see the correct favicon - but they are notoriously difficult to refresh in FireFox..

Yes, I think the one I was seeing was still in my cache.

Originally Posted by Stargate

Was not able to log in, tried to change my username Could only log in as Stargate2 all information was gone, likes and ignore list removed. Not receiving any prompt from email.

I'll resend the password reset procedures to your Stargate email address. Also, can you explain to me why this was the fourth account you have opened here? Your first two were suspended.

Originally Posted by RedPanda

Just tried it in IE - has the new V shaped favicon.

is that right? I have the V shape too. Did admin change it? or is it still supposed to be the beaker and the V is hacker work?

- Favicon is fixed. The 'v' was default favicon of vbulletin software, the content management system we use.
- 'Remember me' checkbox is now checked by default while logging in to keep you logged in.
- Like button moved back to left.
- Email notifications working again.

Can we re-enable the collapsible option for the chatbox? For some reason it is no longer there; my mobile browser has it constantly fully viewable, but my desktop browser has it fully collapsed, and neither can be toggled.

And no more porn links!

Huzzah!

Originally Posted by KALSTER

Ok admin has been busy with the followng:

Originally Posted by admin

- Take full backup once again
- Replace all vbulletin files with the ones from latest stable release
- Upgrade database
- If TSF's working without too many thing broken, keep it. Else, restore from backup and look for another solution

Please report any issues as you notice them with the forum in general and if the hackers show up again. Hopefully these efforts will finally pay off.

Apologies to everyone for the inconvenience and thank you for your patience and continued support!

KALSTER

When logging onto the forum yesterday I got a nasty popup for some porno game or other, with no means to get rid of it other than turning off the machine. I reset Safari and ran a complete virus check - which proved -ve - and this morning the popup has not appeared. But I also got a number of suspiciously old e-mail notifications.

Seems this arsehole has not given up yet.

Originally Posted by exchemist

Originally Posted by KALSTER

Ok admin has been busy with the followng:

Originally Posted by admin

- Take full backup once again
- Replace all vbulletin files with the ones from latest stable release
- Upgrade database
- If TSF's working without too many thing broken, keep it. Else, restore from backup and look for another solution

Please report any issues as you notice them with the forum in general and if the hackers show up again. Hopefully these efforts will finally pay off.

Apologies to everyone for the inconvenience and thank you for your patience and continued support!

KALSTER

When logging onto the forum yesterday I got a nasty popup for some porno game or other, with no means to get rid of it other than turning off the machine. I reset Safari and ran a complete virus check - which proved -ve - and this morning the popup has not appeared. But I also got a number of suspiciously old e-mail notifications.

Seems this arsehole has not given up yet.

Popups restarted at 1230 BST today. Get one every time I click to read a thread entry.

Not porno this time just random crap and at least it pops up behind the window not in front.

Have you tried downloading and running Malwarebytes?

https://www.malwarebytes.org/

I'm getting pop ups for sky now. Gonna do a malware scan again. It removed over 100 last time.

Originally Posted by PhDemon

I noticed it was back earlier today using IE on my phone. Cleared cache and cookies and it now seems Ok.

I've had issues on my phone too. Strange thing is in past after browsing Icke forum on my mobile it would shut down or freeze up. Router would play up too, I had to reset the thing a few times.

Originally Posted by hannah40

Originally Posted by PhDemon

I noticed it was back earlier today using IE on my phone. Cleared cache and cookies and it now seems Ok.

I've had issues on my phone too. Strange thing is in past after browsing Icke forum on my mobile it would shut down or freeze up. Router would play up too, I had to reset the thing a few times.

Don't browse the Icke forum.

Originally Posted by KALSTER

Originally Posted by hannah40

Originally Posted by PhDemon

I noticed it was back earlier today using IE on my phone. Cleared cache and cookies and it now seems Ok.

I've had issues on my phone too. Strange thing is in past after browsing Icke forum on my mobile it would shut down or freeze up. Router would play up too, I had to reset the thing a few times.

Don't browse the Icke forum.

That crap should be shut down, along with a few others. I swear that anonymous are behind it, or, at least associated somehow.

PS - Anyone browsing on a phone, here or internet should maybe try a different mobile browser.
Opera is a good one!

I see that the pop-ups are back again, opening windows in the background. Just finished clearing cookies and cache, to no avail.

Originally Posted by hannah40

Originally Posted by KALSTER

Originally Posted by hannah40

Originally Posted by PhDemon

I noticed it was back earlier today using IE on my phone. Cleared cache and cookies and it now seems Ok.

I've had issues on my phone too. Strange thing is in past after browsing Icke forum on my mobile it would shut down or freeze up. Router would play up too, I had to reset the thing a few times.

Don't browse the Icke forum.

That crap should be shut down, along with a few others. I swear that anonymous are behind it, or, at least associated somehow.

Actually, I think that the forum of Mr. Icke should remain open. After all, imagine where those [insert derogatory noun] would go if they did not have their own space to post their ideas. Next, I do not think that Anonymous is responsible for the recent troubles. This forum is not exactly their scope.

Originally Posted by scheherazade

I see that the pop-ups are back again, opening windows in the background. Just finished clearing cookies and cache, to no avail.

Have you tried downloading, updating and running Malwarebytes?

Originally Posted by Cogito Ergo Sum

Originally Posted by hannah40

Originally Posted by KALSTER

Originally Posted by hannah40

Originally Posted by PhDemon

I noticed it was back earlier today using IE on my phone. Cleared cache and cookies and it now seems Ok.

I've had issues on my phone too. Strange thing is in past after browsing Icke forum on my mobile it would shut down or freeze up. Router would play up too, I had to reset the thing a few times.

Don't browse the Icke forum.

That crap should be shut down, along with a few others. I swear that anonymous are behind it, or, at least associated somehow.

Actually, I think that the forum of Mr. Icke should remain open. After all, imagine where those [insert derogatory noun] would go if they did not have their own space to post their ideas. Next, I do not think that Anonymous is responsible for the recent troubles. This forum is not exactly their scope.

I didn't say anonymous targeted this forum. Did I?

Apparently, there is speculation that the Icke forum got infiltrated very recently.

Originally Posted by hannah40

I didn't say anonymous targeted this forum. Did I?

Apparently, there is speculation that the Icke forum got infiltrated very recently.

I have misread what you stated in post #53.
My apologies for the mistake.

Originally Posted by Stargate2

Was not able to log in, tried to change my username Could only log in as Stargate2 all information was gone, likes and ignore list removed. Not receiving any prompt from email.

That's odd. It's bloody annoying but sometimes funny.

I remember a while back I was signed in to my Facebook account and I was just about to change my profile pic and right in front of me, someone changed it, they must have accessed my profile, I couldn't believe it. I laughed but I also called the police and was told to change my password. I said thats not good enough, we need a cybercrime unit, but they dont have one. They apparently use IBM partnership to deal with problems.

Just another reason why the police fail too much.

Originally Posted by KALSTER

Originally Posted by scheherazade

I see that the pop-ups are back again, opening windows in the background. Just finished clearing cookies and cache, to no avail.

Have you tried downloading, updating and running Malwarebytes?

I just finished running CC Cleaner so will see if that has made a difference. While I appreciate your suggestions, I see no reason to load my computer with programs which may begin to conflict with each other when this is the only site I am encountering difficulties with.

Originally Posted by scheherazade

Originally Posted by KALSTER

Originally Posted by scheherazade

I see that the pop-ups are back again, opening windows in the background. Just finished clearing cookies and cache, to no avail.

Have you tried downloading, updating and running Malwarebytes?

I just finished running CC Cleaner so will see if that has made a difference. While I appreciate your suggestions, I see no reason to load my computer with programs which may begin to conflict with each other when this is the only site I am encountering difficulties with.

I think this has to be fixed before we should go on, I am not sure I am doing the right thing anymore, and as Cher said, this is the site it seems to be coming from.

I hope we do not have some mad person trying to bring the forum down.

Investigating.

Originally Posted by hannah40

Just another reason why the police fail too much.

...or they have better things to do than look into such a serious crime a facebook hack that resulted in no monetary loss¹ or public safety issue. I'm surprised they didn't do you for wasting their time

1. I'm guessing you would have mentioned it if it had.

Originally Posted by PhDemon

Originally Posted by hannah40

Just another reason why the police fail too much.

...or they have better things to do than look into such a serious crime a facebook hack that resulted in no monetary loss¹ or public safety issue. I'm surprised they didn't do you for wasting their time

1. I'm guessing you would have mentioned it if it had.

No, it may be part of a bigger issue going on though eh? Especially when our local forces sites and accounts got hacked!

Just for the record, the profile picture that appeared happened to be of a police officer.

Ah, I love the smell of conspiracy theories in the morning

Originally Posted by PhDemon

Ah, I love the smell of conspiracy theories in the morning

Conspiracy? Oh, here we go again, everyone else is always wrong.
You've just made Number 2 on my block list. Number 2, oooh, suits yoooo!

Originally Posted by hannah40

Originally Posted by PhDemon

Ah, I love the smell of conspiracy theories in the morning

Conspiracy? Oh, here we go again, everyone else is always wrong.
You've just made Number 2 on my block list. Number 2, oooh, suits yoooo!

If it was part of a bigger issue, then how do you know about it and what was the intent of taking over Facebook accounts and other websites?

Originally Posted by hannah40

Apparently, there is speculation that the Icke forum got infiltrated very recently.

By the shape-shifting reptilian people?

Originally Posted by Cogito Ergo Sum

Originally Posted by hannah40

Originally Posted by PhDemon

Ah, I love the smell of conspiracy theories in the morning

Conspiracy? Oh, here we go again, everyone else is always wrong.
You've just made Number 2 on my block list. Number 2, oooh, suits yoooo!

If it was part of a bigger issue, then how do you know about it and what was the intent of taking over Facebook accounts and other websites?

Go back and read what I wrote again and stop making yourself look stupid!

Originally Posted by hannah40

Go back and read what I wrote again and stop making yourself look stupid!

You wrote (in post #57 and post #62):

Originally Posted by hannah40

I remember a while back I was signed in to my Facebook account and I was just about to change my profile pic and right in front of me, someone changed it, they must have accessed my profile, I couldn't believe it. I laughed but I also called the police and was told to change my password. I said thats not good enough, we need a cybercrime unit, but they dont have one. They apparently use IBM partnership to deal with problems.


Just another reason why the police fail too much.

Originally Posted by hannah40

No, it may be part of a bigger issue going on though eh? Especially when our local forces sites and accounts got hacked!

Just for the record, the profile picture that appeared happened to be of a police officer.

As there is no mentioning of why you think that it was "part of a bigger issue" (i.e. no justification was given),
I could not but ask why you think that it might be "part of a bigger issue" and what the intent was of hacking "local forces sites and accounts".

Originally Posted by hannah40

Originally Posted by PhDemon

Ah, I love the smell of conspiracy theories in the morning

Conspiracy? Oh, here we go again, everyone else is always wrong.

Nope, I don't ASSUME everyone else is wrong but the evidence is YOU often are, why didn't you stay on the Icke forum? Your mish-mash of conspiracy tinged nonsense should fit right in there, on a science forum, not so much...

Originally Posted by hannah40

You've just made Number 2 on my block list. Number 2, oooh, suits yoooo!

My considered response (NSFW!)

Spoiler Alert, click show to read: 

Originally Posted by Cogito Ergo Sum

By the shape-shifting reptilian people?

Mr Lizard!

Mr Lizard - YouTube

Originally Posted by Cogito Ergo Sum

Originally Posted by hannah40

Go back and read what I wrote again and stop making yourself look stupid!

You wrote (in post #57 and post #62):

Originally Posted by hannah40

I remember a while back I was signed in to my Facebook account and I was just about to change my profile pic and right in front of me, someone changed it, they must have accessed my profile, I couldn't believe it. I laughed but I also called the police and was told to change my password. I said thats not good enough, we need a cybercrime unit, but they dont have one. They apparently use IBM partnership to deal with problems.


Just another reason why the police fail too much.

Originally Posted by hannah40

No, it may be part of a bigger issue going on though eh? Especially when our local forces sites and accounts got hacked!

Just for the record, the profile picture that appeared happened to be of a police officer.

As there is no mentioning of why you think that it was "part of a bigger issue" (i.e. no justification was given),
I could not but ask why you think that it might be "part of a bigger issue" and what the intent was of hacking "local forces sites and accounts".

I said it 'MAY BE' .

When I reported it to police, they started getting strange happenings.

Could be disgruntled ex coppers...who knows.....

Originally Posted by Cogito Ergo Sum

Originally Posted by hannah40

Originally Posted by PhDemon

Ah, I love the smell of conspiracy theories in the morning

Conspiracy? Oh, here we go again, everyone else is always wrong.
You've just made Number 2 on my block list. Number 2, oooh, suits yoooo!

If it was part of a bigger issue, then how do you know about it and what was the intent of taking over Facebook accounts and other websites?

Originally Posted by hannah40

Apparently, there is speculation that the Icke forum got infiltrated very recently.

By the shape-shifting reptilian people?

Shape shifters?

Ha ha....Icke is a tool in some respects, he's been fed crap on purpose. still, they'll probably stab him in the back when they dont need him anymore.

Mainstream seem to avoid him like the plague.

Originally Posted by hannah40

Ha ha....Icke is a tool in some respects,

in "some" respects?!?!!? how about all respects?

Originally Posted by hannah40

Mainstream seem to avoid him like the plague.

with good reason. never thought I would be saying this to anyone, but you could learn a thing or 12 from the mainstream.

I'm currently browsing using a PS Vita and I've have to turn off Javascript in my Settings to get the site to work, otherwise I just get redirected whenever I click on anything.