Virus?

[MikeE]

I am being notified constantly of an attack by Exploit Toolkit Website 4 when I open the forum or change page. This apparently is from www.orion-software.co.uk. These are being blocked by Norton. Is there a problem with the site?

Regards

MikeE

[Timothy]

I am also getting warnings, but I only get the IP address, which I haven't WhoIsed yet.

[Ian Melville]

Me too. Picked up by both Norton and Malwarebytes

[jollyrog]

Same, by Norton.

I have added Orion Software to my block sites in the router again. I've had trouble with them before on here, perhaps Flyer could use a more reliable advertiser.

Currently I'm advert free.

[Propwash]

First thing this morning I found myself redirected to a site called "Whatismyispaddress.com" every time I tried to access the Flyer forum, either through favourites or via the Flyer website.

At least I now know my ISP address.

PW

[Timothy]

Same, by Norton.

I have added Orion Software to my block sites in the router again. I've had trouble with them before on here, perhaps Flyer could use a more reliable advertiser.

Currently I'm advert free.

Please can you give us a quick, detailed "How To"?

[jollyrog]

Timothy,

My Netgear router has a menu option "block sites". You can add addresses or keywords to block, the router then doesn't permit access to those places. I just added the web address for Orion to that list and pressed "Apply".

As all the Flyer adverts originate from Orion, it makes my Flyer viewing an advert free experience.

I had to do the same before, when there were other Orion problems.

[Timothy]

I have blocked domains orion-software.co.uk and orion-software.net and the pages are still very slow to load...am I doing something wrong? Should I put the www in front, or the http://?

Looking at page source, there is still a reference in the js to https://www.orion-software.co.uk and http://www.orion-software.co.uk

[Timothy]

Ahh...on clearing the cache it has suddenly speeded up...thank you!

[peterh337]

This is the problem with doing a forum using off the shelf software.

Every hacker in town is trying to break it, and most can.

Gawd knows how many people have their PCs infected before the thing is fixed.

[Timothy]

[mmcp42]

hmm
I didn't change anything - and it's not moaning today
perhaps it's gone away (can't really tell with all this sand in my eyes!)

[Keef]

This is the problem with doing a forum using off the shelf software.

Happily, this one isn't "off the shelf" although it uses a popular BB package as the basis.
That doesn't stop the hackers trying, although the great majority of them are seen only by Liam or the Admins.

The most frequent problem is links to sites that have been hacked. Short of blocking any linking, there doesn't seem to be an easy way to prevent that.

[Ian Melville]

Oh dear,
The Orion-Software attack seems to have stopped, but been replaced by one from onehaveoneby.homeip.net, which is an intrusion attempt. Don't get it on every page but seems to be triggered by the forum.

I fear for anyone who doesn't have good protection and wonder if/when they will launch an attach which my protection fails to detect

[Ian Melville]

My Netgear router has a menu option "block sites". You can add addresses or keywords to block, the router then doesn't permit access to those places. I just added the web address for Orion to that list and pressed "Apply".

As all the Flyer adverts originate from Orion, it makes my Flyer viewing an advert free experience.

I tried that and it didn't work for me. I have a Linksys WAG54G2.. IE and Chrome fail to load any of the Flyer forum page, FF hangs trying to load the Orion-Software page bur eventually displays the page minus ads. Have I set something wrong?