Has Landlordzone got a virus?

Paul_Varjak

Alias_Omega wrote: »

Working for me..

http://www.landlordzone.co.uk/forums/

It asks if you want to install an IE update and even if you press the cancel button it redirects you to a chinese website where it tries to install a rootkit virus: Win32:Rootkit-gen [Rtk]

My anti-virus (G-Data) automatically blocked the site when it detected the rootkit! God only knows what it tries to install on your computer! But I think that rootkit viruses are the worst sort - maybe keylogger software that will trap your keystrokes next time you log onto your bank website!

If your antivirus falied to detect any virus, then you have been unlucky and installed a virus on your computer! So, you need to try another antivirus to get rid of it!

Several pages on the site redirect you to the rootkit virus download!

Shakethedisease

Looks like a number of forums have been hacked the last week or so. Be very careful clicking on anything on LZ until this is confirmed as gone..


http://www.google.co.uk/search?sourceid=navclient&hl=en-GB&ie=UTF-8&rlz=1T4SNYK_en-GBGB309GB310&q=leasycrabs

The websites of JB Hi-Fi, one of Australia's largest retailers, and PC hardware forum Overclockers, were compromised over the weekend.
Hundreds of users have been reporting malware infections and other issues from Friday evening, with users posting details of their experience on broadband forum Whirlpool, which ironically faced its own security breach a week earlier.
Overclockers had been hit for the second time in quick succession. The site reported a security breach just over a week ago and is currently offline due to "technical issues". Whirlpool users reported JB Hi-Fi as having a similar issue.

The Whirlpool forums are crammed with users reporting redirects, drive by downloads and even malicious adverts that redirect victims to sites in Asia and Eastern Europe.
"It seems that some of their [JB Hi-Fi] ads have been hijacked and link to some Czech Republic websites which are registered with Norton as hosting harmful material," wrote Whirlpool user rtw.

Drive-by-download attacks usually prey on unpatched vulnerabilities in users' browsers or operating system. If successfully executed, victims need only visit a compromised site to be infected by malware.
JB-Hi-Fi's spokesman was not available for comment today. Overclockers had not responded to a request for comment.

etc, etc..

rodent

Have failed to load LLZ successfully, getting the same as everyone else, IE update required, also same problem a few days ago (redirect to a blank page).

Altho i can see through a shaded screen that the forum posts are being updated regularly ...so looks like lots of people are accessing the site okay ....perhaps they have all now got themselves a virus in the process ?

Has anyone managed to contact anyone at LLZ ..are they even aware ?

Paul_Varjak

I have tried to find an emergency phone number for landlordzone, but without success. I have left a message on their main number.

Alias_Omega

A few posts from landlord zone

Wickerman wrote: »

Note - Do not update your browser - site has been hacked!

Wickerman wrote: »

Just disable javascript in your browser for now!

This thread - http://www.landlordzone.co.uk/forums/showthread.php?t=24367

madeinchina

rodent wrote: »

Have failed to load LLZ successfully, getting the same as everyone else, IE update required, also same problem a few days ago (redirect to a blank page).

Altho i can see through a shaded screen that the forum posts are being updated regularly ...so looks like lots of people are accessing the site okay ....perhaps they have all now got themselves a virus in the process ?

Has anyone managed to contact anyone at LLZ ..are they even aware ?

Through the shading, each forum post says do not upload the browser change .

tomE_4

Yes, LandlordZONE was hacked, along with, it seems, quite a lot of other sites.
The LandlordZONE site was hacked and has been affected over the last 12 hours, perhaps longer, we cannot tell for sure.
The hacking was done through a vulnerability in our ad server software which has now been corrected, though we need to re-install all our ads.
Extra security measures have also been put in place to ensure that this does not happen again.
The hack was directing visitors to a foreign web site which we now know was leasygrabs.cn, through a hoax FireFox upgrade or other pop ups on other browsers?
If you clicked on any pop-ups relating to this or similar you should check out your computer for spy-ware. We recommend Microsoft Security or this malware virus checker at: malwarebytes.org
Thanks to all those who contacted us and posted warnings.
We are very sorry for any inconvenience this has caused.
The site is safe again now.
Many thanks to MSE and the posters here.
Regards,
Tom