I should also have added that IX has a script they are running to find and remove the malicious code from the webpages. So, if you find that your website has been hacked, please contact your hosting service to see if they will do that for you also. Betsy At 06:59 AM 10/16/2009, you wrote: >According to a tech from IX, this attack is "internet-wide" - meaning >it has affected many hosting services. It may be connected to this: >http://www.kval.com/news/tech/63768427.html > >I find it interesting that although I use both gmail and earthlink, I >was not notified of this. > >The "Update Adobe" is what I am hearing is the indicator that the >page has been hacked. So, it does sound like Ancestry/RootsWeb has >also been compromised. I know ARGenWeb is on a totally different >server from USGenWeb and we were also hacked. > >Betsy > > >At 06:47 AM 10/16/2009, you wrote: > >Joan, I am not sure how we tell but I will share this bit from one of my > >people. I am terribly alarmed because I was on Ancestry last night and a > >fake looking Adobe update window came up. I think we need to know the > >extent of this hacking and need to know as soon as the information is > >available. > > > >Quote: > >earlier tonight, I was checking my county links, and my virus scan picked up > >a malware on the usgenweb site when I entered it, and when I entered one of > >neighboring websites when I checked that link. It appears to be a fake > >"Upload Adobe Flashplayer Now" scam, that appears as a pop up. I am advising > >folks (as I've always done) to never click on these items or similiar items > >when browsing the net. My virus scanner indicated that it was a Trojan > >program and very malicious. > > > >Karen > > > >-----Original Message----- > >From: [email protected] > >[mailto:[email protected]] On Behalf Of Joan Asche > >Sent: Friday, October 16, 2009 6:10 AM > >To: [email protected] > >Subject: Re: [STATE-COORD] Hacker Attack (Again) > > > >How can we tell if our sites are infected. Will it set off antivirus > >programs? > > > >J. Asche > > > >On Thu, Oct 15, 2009 at 7:30 PM, Sherri <[email protected]> wrote: > > > ********************* Please forward to all Project Lists > > > ********************************** > > > > > > The National USGenWeb Project site and all sites hosted on > theusgenweb.org > > > domain, as well as a few other Project sites have been hit again by a > > > hacker that has included some malware code at the end of the majority of > >the > > > pages on each site. We are working with the hosting service right now to > > > get the sites cleaned and the code removed. Please ask ALL Project > > > Coordinators that have their sites hosted on theusgenweb.org or anyone > >that > > > specifically gets notices that they're sites are infected to not connect > >by > > > ftp to the sites until at least the 16th as we work to try to ensure that > >we > > > have the sites cleaned once again. > > > > > > For folks that have only visited the USGenWeb National site or any of the > > > other affected sites using their browser, the risk is very > minor that your > > > computer has been infected. If you've connected by ftp and downloaded > >files > > > from any of the infected sites, I'd suggest running a full virus scan on > > > your computer and I'd also recommend running at least a couple of spyware > > > scans to add an additional level of confidence that your system is clean. > > > > > > All sites that are hosted on theusgenweb.org server will have the > >passwords > > > changed before you can log in again. I'll be starting on this > immediately > > > so that the downtime will be minimized as much as possible. > > > > > > If anyone has any specific questions or problems, please let me know. > > > > > > Sherri Bradley > > > National Coordinator > > > USGenWeb Project > > > Information about the USGenWeb Project at http://usgenweb.org > > > Advisory Board Agenda http://usgenweb.org/agenda2.php > > > > > > > > > > > > > > > > > > ------------------------------- > > > To unsubscribe from the list, please send an email to > >[email protected] with the word 'unsubscribe' without the > >quotes in the subject and the body of the message > > > > > > > > >------------------------------- > >To unsubscribe from the list, please send an email to > >[email protected] with the word 'unsubscribe' without the > >quotes in the subject and the body of the message > > > > > > > >------------------------------- > >To unsubscribe from the list, please send an email to > >[email protected] with the word 'unsubscribe' without > >the quotes in the subject and the body of the message > >------------------------------- >To unsubscribe from the list, please send an email to >[email protected] with the word 'unsubscribe' without >the quotes in the subject and the body of the message