ProZ.com Translation Forums

Nov 20 malware incident | Sorted

Tom in London — Tue, 27 Nov 2012 17:15:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Tom in London
Post title: Sorted

[quote]Lisa Simpson, MCIL wrote:

There was quite a major issue in April of this year:
[/quote]

That was with Java, which is not part of the core MacOS and which you don't actually need. Anyway Apple fixed it immediately. Since then there have been no other problems.

Of course one should never be complacent about anything in this life, but so far as computer operating systems are concerned I'm very happy that the MacOS is basically safe, and that I don't need to slow it down by running AV software. PC users seem to be wrestling with virusses or suspected virusses all day long.

Nov 20 malware incident | @ Tom

XXXphxxx (X) — Tue, 27 Nov 2012 15:44:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: XXXphxxx (X)
Post title: @ Tom

[quote]Tom in London wrote:

[quote]Lisa Simpson, MCIL wrote:

As I understand, Apple have had to withdraw any claims that they are virus-proof in view of the number of recent incidents. Personally, I wouldn't risk it. [/quote]

There haven't been any incidents. Here's an interesting discussion: "Mac OS X forum: Is it true that MacOS is Virus-free?"

[url removed] [/quote]

From what I can make out that discussion dates back to 2008. There was quite a major issue in April of this year:

[url removed]
[url removed]

The likelihood is still minimal compared to a PC, but I'm not sure it's worth being too complacent.

Nov 20 malware incident | I wouldn't worry too much

Tom in London — Tue, 27 Nov 2012 15:33:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Tom in London
Post title: I wouldn't worry too much

[quote]Lisa Simpson, MCIL wrote:

As I understand, Apple have had to withdraw any claims that they are virus-proof in view of the number of recent incidents. Personally, I wouldn't risk it. [/quote]

There haven't been any incidents. Here's an interesting discussion: "Mac OS X forum: Is it true that MacOS is Virus-free?"

[url removed]

Nov 20 malware incident | Thank you, Shai

Jennifer Forbes — Sun, 25 Nov 2012 12:56:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Jennifer Forbes
Post title: Thank you, Shai

Thank you, Shai, for your helpful explanation and interesting thoughts. My ignorance on the matter is now slightly less encyclopaedic!
Best wishes,
Jenny

Nov 20 malware incident | Some thoughts

Shai Navé — Sat, 24 Nov 2012 18:15:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Shai Navé
Post title: Some thoughts

[quote]Jenny Forbes wrote:
The scan took about an hour and, according to the final report, found 96 "threats" (all with two orange asterisks assigned to them, not the three red asterisks assigned to "serious threats").[/quote]
Those are possibly Cookies or other web-related elements that are saved to the cache. They might not even be related to this incident, but it is possible that they are. Either way, they are probably not an immediate threat to the integrity of your system (but it is good to remove them anyway, like you did).
[quote]
Are 96 threats an abnormally high amount?
[/quote]
There isn't a single determinate answer to this question. It is more about the nature of the malware rather than the number of files infected or occurances. Many times hundreds and even thousands (depending on the amount of data in the drive) of files get infected, but it is a "minor" infection; it causes disruption to normal work (programs don't start, the web traffic gets redirected, AV gets disables and so on), but it is fairly easy to clean up and usually no permanent damage to the system or data occurs. Other times (though less common), the infection is more deeply embedded, harder to identify and get rid of (short of wiping the drive and losing some or all the data), and it carries higher risk to the system integrity and the security of the user's personal information and identity).
There is some misconception about malwares. The common belief is that malwares are malicious softwares that aim to wipe one's data. However, in reality they are more of an annoyance that disrupts work by disabling some functionality, referring web traffic (sometimes by taking over the system's hosts file), opening "tunnels" in the systems firewall system and call home to download more malware of this sort or to allow someone from the outside to use the computing resources for, usually, malicious activity (for sending spam for example), etc. The common malware does not delete anything directly nor tries to. The biggest threat of modern malware is identity theft by means of keyloggers and/or Phishing, and or specifically exposing your system to someone from the outside. Granted, sometimes the system gets corrupt indirectly as a result of the cleaning process. This is more typical to an aggressive approach because when dealing with infected systems some finesse and systematic approach are required. Just dropping the hammer, sort of speak, usually causes more damage to the system than the malware.

I recommend (again) everyone who suspect foul play or just want to err on the side of caution to:
1) Run an AV scan outside of the system.
2) Run a scan with a dedicated malware removal tool such as Malwarebytes Anti-Malware and SuperantiSpyware.
3) Run an Hijackthis scan.
4) If possible, check the firewall logs for any suspicious activity in the relevant time period.
5) If infected or experiencing some system instability: those running Windows, open a command prompt (elevated in Vista and above) and type "sfc /scannow" (note, it might require the installation media). This will check the integrity of core system files and attempt to replace them if any of them got corrupt.

As a side note; this is another reason why it is so important to backup the important data. I know of too many people who neglect doing so, or doing it wrong (typically by copying the data to another drive and remove it from the first drive - back means 2 or more copies of the data). So, like all other incident of this kind, it is a good opportunity for anyone who doesn't back up like they should to catch up on things and start doing so to avoid any future data loss.

[quote]
And get a *paid* antivirus suite if you possibly can
[/quote]
I agree. Most free AVs (with the exception of MSE from all the more common brands in this market, at least as far as I know) are intended for personal use only. Using them in a professional capacity (on a system that is used to make revenue) is in violation of the user agreement. I also think that it is important to support the developer (exactly like we like to get paid for our work and not spread it for free for others to capitalize on it), and in the process one is eligible for support and, usually, gets priority updates over the free version.
There are nice selection of good AVs, so one probably can find a reliable solution within their budget. If, for whatever reason, one cannot afford an AV, I recommend using MSE (Microsoft Security Essentials; now comes pre-installed in Windows 8). This way one does not abuse the developer's offering and MSE is a very good AV in its own, so this is not a compromise on quality.
However, from a technical stand point there is nothing wrong with the free AVs. They perform (except for the disabled features in comparison to the "Pro" version) just the same.

Nov 20 malware incident | Google it

XXXphxxx (X) — Sat, 24 Nov 2012 16:51:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: XXXphxxx (X)
Post title: Google it

[quote]Tom in London wrote:

[quote]Lisa Simpson, MCIL wrote:

......the ESET technician I spoke to yesterday evening said they had a Mac attack just the other day; someone's operating system had got completely fried. [/quote]

Well, 'e would say that, wouldn't 'e?

:) [/quote]

As I understand, Apple have had to withdraw any claims that they are virus-proof in view of the number of recent incidents. Personally, I wouldn't risk it.

Nov 20 malware incident | Well....

Tom in London — Sat, 24 Nov 2012 14:55:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Tom in London
Post title: Well....

[quote]Lisa Simpson, MCIL wrote:

......the ESET technician I spoke to yesterday evening said they had a Mac attack just the other day; someone's operating system had got completely fried. [/quote]

Well, 'e would say that, wouldn't 'e?

:)

Nov 20 malware incident | Macs

XXXphxxx (X) — Sat, 24 Nov 2012 10:31:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: XXXphxxx (X)
Post title: Macs

[quote]juliette_K wrote:

I honestly doubt that such a verbose OS as Windows has always been could ever be virus-free...

[quote]Tom in London wrote:

[quote]juliette_K wrote:

All my solidarity to PC users having hard times : ( [/quote]

As a Mac user, I don't get infected. In 10+ years of using Macs I've never had any form of virus. And I hear that Windows 8 is virus-free too (although I don't know if that's true).

[Edited at 2012-11-23 13:41 GMT] [/quote] [/quote]

I would still play safe. After this recent incident I moved the only PC I have not running on ESET from McAfee (which came pre-installed on a new machine) to ESET. We have 4 PCs and 1 Mac and the Mac has had anti-virus software on it for the past year or so. The threats are increasing and the ESET technician I spoke to yesterday evening said they had a Mac attack just the other day; someone's operating system had got completely fried.

Nov 20 malware incident | DIdn't get it

Tom in London — Sat, 24 Nov 2012 10:22:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Tom in London
Post title: DIdn't get it

[quote]Ty Kendall wrote:

has anyone else received this message:(etc) [/quote]

No. I never received any such message.

Nov 20 malware incident | 96 threats!

Jennifer Forbes — Sat, 24 Nov 2012 09:45:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Jennifer Forbes
Post title: 96 threats!

Thanks to this thread and the emailed warnings from Proz, yesterday I ran a full anti-virus scan (using AVG free). The scan took about an hour and, according to the final report, found 96 "threats" (all with two orange asterisks assigned to them, not the three red asterisks assigned to "serious threats"). It sent all of them to the "vault".
This morning, I received what I think was a suspicious email in a language I don't speak - possibly Turkish - which I deleted at once without opening it. Are 96 threats an abnormally high amount? I don't know.
AVG does an automatic scan every day (taking about 10 minutes) and I don't normally try to find out how many threats it identifies.
Of course I don't know whether the 96 threats and the suspicious email message had anything to do with the malware incident of 20th November.
Anyway, I'm grateful to Proz and colleagues for the warnings.
Trusting I'm now as clean as a whistle ... but am I?
Jenny

Nov 20 malware incident | [OT]

Giunia Totaro — Sat, 24 Nov 2012 03:03:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Giunia Totaro
Post title: [OT]

I honestly doubt that such a verbose OS as Windows has always been could ever be virus-free...

[quote]Tom in London wrote:

[quote]juliette_K wrote:

All my solidarity to PC users having hard times : ( [/quote]

As a Mac user, I don't get infected. In 10+ years of using Macs I've never had any form of virus. And I hear that Windows 8 is virus-free too (although I don't know if that's true).

[Edited at 2012-11-23 13:41 GMT] [/quote]

Nov 20 malware incident | And get a paid antivirus suite if you possibly can

Neil Coffey — Sat, 24 Nov 2012 02:17:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Neil Coffey
Post title: And get a *paid* antivirus suite if you possibly can

And... without wishing to sound like a proponent of naked capitalism, I would differ slightly from some of the advice given here in that I am slightly suspicious of free antivirus software.

It's fantastic idea in principle.

But in practice, for an antivirus company to keep on top of the latest threats requires significant resources. So if you opt for a "free" product, make sure you have a satisfactory answer on where their revenue stream actually comes from and how they can provide the same level of service as the major labs.

Nov 20 malware incident | Also run a vulnerability scan

Neil Coffey — Sat, 24 Nov 2012 02:05:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Neil Coffey
Post title: Also run a *vulnerability* scan

Remember that in principle, for your computer to be infected with malware via a web page, either you have to specifically take some action that allows this, or else the malware in question needs to exploit some security loophole in your browser/plugins, or in the software (PDF reader etc) that you use to open files in commonly downloaded formats.

So, it is a good idea to take preventive action against the latter case. Many antivirus programs, in addition to allowing you to scan for actual infections, allow you to perform a scan for *Vulnerabilities*. This is designed to alert you to outdated components installed on your computer for which known updates with security fixes are available.

If you don't have an antivirus with such a facility (or indeed, in any case) it's a good idea to regularly check that you have the latest version of your browser and major plugins and software that opens common file formats. Frequent culprits are Java, Flash and PDF Reader. In principle, these should automatically alert you if an update is available. But it does no harm to run the scan or do a manual check every few weeks.

As I think it was Henry who said above, the unfortunate need to battle against security threats is a joint effort: with legitimate web site owners doing all they can on their end-- in terms of installing the latest server patches etc-- and users doing all they can-- in terms of using antivirus tools and updating their software-- at their end.

[Edited at 2012-11-24 02:06 GMT]

Nov 20 malware incident | ????

Evonymus (Ewa Kazmierczak) — Sat, 24 Nov 2012 00:05:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Evonymus (Ewa Kazmierczak)
Post title: ????

[quote]Jason Grimes wrote:

At this time, the only reported problem that is known to be consequence of this issue is that some users were redirected to another site when viewing a banner ad during that 4-hour time period.

Jason [/quote]

Which ad exactly?
And if I didn't click any ad banner, is my computer safe? Of course I ran my ESET Smart Security and no problem was detected, but how do I know for sure?
Ewa

[Edited at 2012-11-24 00:10 GMT]

Nov 20 malware incident | No problem

Russell Jones — Fri, 23 Nov 2012 22:51:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Russell Jones
Post title: No problem

My screen jumped to the ISP pages mentioned in previous posts and I immediately closed them.
I have McAfee anti-virus software pre-installed on my PC.
In the light of the updated recommendations, I ran a full scan today with MalwareBytes and am pleased to report that no threats were detected.

Nov 20 malware incident | I'm the one who initially reported the incident

Steven Hanley (X) — Fri, 23 Nov 2012 20:43:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Steven Hanley (X)
Post title: I'm the one who initially reported the incident

So, FYI, it was an "Exploit Toolkit" attack, and you can find the details here:

[url removed]

Hope that helps.

Nov 20 malware incident | An antivirus scan should definitely be run.

Henry Dotterer — Fri, 23 Nov 2012 20:38:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Henry Dotterer
Post title: An antivirus scan should definitely be run.

Hi all,

It would appear that the member who reported irregularities with her online bank has gone offline; we have been unable to reach her by phone, skype, email or other means. However, based on her posting, and out of an abundance of caution, at this point we feel we have to change our recommendation from "it might be a good idea to run an antivirus scan" to "you should definitely run an antivirus scan".

If you do not have anti-virus software, there are several free options:

* Avast - [url removed]
* MalwareBytes - [url removed]

Once again, I sincerely apologize for the inconvenience this may cause. Thank you for your understanding.

[quote]I tried to log into my online banking system and got a very suspicious message right after logging in. When I contacted my bank, they said that the problem was probably caused by a virus (at that time I didn't receive the mail from Proz yet) that tried to find out my banking details. They advised me to do a thorough scan of my computer to delete the virus. My normal antivirus program didn't indicate anything, but luckily my husband ran some other programs for me. There were indeed several threats and after deleting those, I was able to use my banking system again. So please, be very careful and take this message from Proz seriously![/quote]

Nov 20 malware incident | It could be worse than a redirect

Henry Dotterer — Fri, 23 Nov 2012 20:31:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Henry Dotterer
Post title: It could be worse than a redirect

[quote]Samuel Murray wrote:
[quote]Ty Kendall wrote:
[i]ProZ.com's dedicated ad server was infected with malware around 09:55 GMT. ... The direct effect of this malware is that a site user who visited a page with banner advertisements could have received content from, or could have been redirected to, a site other than ProZ.com. [/i] [/quote]
Well, I don't think the infection was the type that spread to other computers.

The infection caused certain ProZ.com pages to automatically forward to another site, and such a forwarding action is recognised by anti-virus programs, but it does not actually infect the user's computer. It merely redirects to the user to another site.[/quote]
Thanks, Samuel. Hopefully it was a redirect and nothing more, as you say. We can not rule out the possibility, however, that the site one gets redirected to could try to install something worse than a redirect script. It might not even take any effort on the part of the user to become infected.

Although we have located and removed the malware that infected our system, we don't have a means of determining what the destination site was putting out. All we can do is follow up on reports of anything abnormal. We continue to do that, and appreciate the cooperation of many of you in that respect.

Nov 20 malware incident | Ads

John Fossey — Fri, 23 Nov 2012 18:58:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: John Fossey
Post title: Ads

[quote]Dominique Pivard wrote:

FWIW, I use the AdBlock extension in Firefox and it blocks links from ads.proz.com by default:

In addition to the extra security provided (if you don't see them, you won't be tempted to click on them), it also makes for a more pleasant browsing experience.

[/quote]

Trouble with that is that some of us actually benefit from the proz.com ads, which are industry specific.

Nov 20 malware incident | AdBlock

Dominique Pivard — Fri, 23 Nov 2012 17:42:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Dominique Pivard
Post title: AdBlock

FWIW, I use the AdBlock extension in Firefox and it blocks links from ads.proz.com by default:

In addition to the extra security provided (if you don't see them, you won't be tempted to click on them), it also makes for a more pleasant browsing experience.

Nov 20 malware incident | Trying to reach Déborah

Henry Dotterer — Fri, 23 Nov 2012 17:33:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Henry Dotterer
Post title: Trying to reach Déborah

[quote]Déborah Essers-Jansen wrote:

I tried to log into my online banking system and got a very suspicious message right after logging in. When I contacted my bank, they said that the problem was probably caused by a virus (at that time I didn't receive the mail from Proz yet) that tried to find out my banking details. They advised me to do a thorough scan of my computer to delete the virus. My normal antivirus program didn't indicate anything, but luckily my husband ran some other programs for me. There were indeed several threats and after deleting those, I was able to use my banking system again. So please, be very careful and take this message from Proz seriously! [/quote]
This is a very serious report. We have had no other similar reports. We are trying to get hold of Déborah to get more information, but so far have not been able to.

If anyone has had this sort of experience, please tell us about it.

Déborah, if you see this, sorry for the trouble, but I am sure you understand that we have to take this sort of report very seriously, even if it does not appear likely to us that the malware we found would have led to this sort of thing. Therefore, we would appreciate if you could help us get a bit more information about what happened to you. (The office number is [phone removed] . Call that or use Skype (check your voicemail.)) Thank you very much in advance.

Nov 20 malware incident | Thanks, Lisa

Henry Dotterer — Fri, 23 Nov 2012 16:32:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Henry Dotterer
Post title: Thanks, Lisa

[quote]Lisa Simpson, MCIL wrote:
[quote]Henry Dotterer wrote:
There were approximately 6700 people who could have been served ads during the period that the malware could have been active. The notice contained in this thread was sent to all of them (including you, Lisa; your server accepted the email, according to our logs. Would you mind checking on your end?)
[/quote]
Can you tell me roughly when this email went out? Date and time (GMT) I must confess that if it came in when I was in the throes of the computer meltdown it may have just got deleted as "low priority". [/quote]
Since you are now connected with Jason I suggest we just continue this directly. I know you've had a rough patch and appreciate your help as we try to determine whether or not this was related to the malware incident.

Nov 20 malware incident | When was the email sent?

XXXphxxx (X) — Fri, 23 Nov 2012 16:16:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: XXXphxxx (X)
Post title: When was the email sent?

[quote]Henry Dotterer wrote:

There were approximately 6700 people who could have been served ads during the period that the malware could have been active. The notice contained in this thread was sent to all of them (including you, Lisa; your server accepted the email, according to our logs. Would you mind checking on your end?)
[/quote]

Can you tell me roughly when this email went out? Date and time (GMT) I must confess that if it came in when I was in the throes of the computer meltdown it may have just got deleted as "low priority".

Nov 20 malware incident | I have antivirus software

XXXphxxx (X) — Fri, 23 Nov 2012 16:13:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: XXXphxxx (X)
Post title: I have antivirus software

[quote]Henry Dotterer wrote:

Can we be sure there will never be another incident involving malware and viruses in the future? Of course not. So its a partnership, you need antivirus software, etc. Thanks again to those helping out in this instance. [/quote]

As, I believe, do others on this site who got infected. Furthermore, a virus scan showed no results. I believe this was the same for others. Not sure what more I could have done.

Nov 20 malware incident | The malware is gone now

Henry Dotterer — Fri, 23 Nov 2012 15:52:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Henry Dotterer
Post title: The malware is gone now

[quote]Lisa Simpson, MCIL wrote:

What assurances do we have that this won't happen again? Have you pinned the issue down or should we be steering clear of the site until you have? [/quote]
Hi Lisa,

We found it and removed it, it is gone.

Can we be sure there will never be another incident involving malware and viruses in the future? Of course not. So its a partnership, you need antivirus software, etc. Thanks again to those helping out in this instance.

Nov 20 malware incident | What has been reported in this thread has not been reported outside the thread -- we'll be in touch!

Henry Dotterer — Fri, 23 Nov 2012 15:46:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Henry Dotterer
Post title: What has been reported in this thread has not been reported outside the thread -- we'll be in touch!

Hi all,

Thanks again to the people who reported this incident, and to those who have worked with us to search for signs of negative consequences.

There were approximately 6700 people who could have been served ads during the period that the malware could have been active. The notice contained in this thread was sent to all of them (including you, Lisa; your server accepted the email, according to our logs. Would you mind checking on your end?)

Many replied to the notice, and we have followed up with everyone who did. (Unless they just did.) The investigation is ongoing, and we have two fairly tame possibilities that we are continuing to look into, but so far we have not been able to find an instance where it can be confirmed that someone picked anything like a virus up in this incident.

If we are able to validate such a report, even one, we will provide details here, and via email, so that appropriate steps can be taken.

And by the way, opolt, thank you for your postings. Changing a password is never a bad idea.

(You may conclude from my post that what is being reported in this thread goes well beyond anything we have found in our investigation so far. If these reports can be verified and tied to the malware that hit us, the problem would be more significant than it has so far appeared to be. We really need details to substantiate what you have written here, I hope you will be willing to work with us on this. You'll be hearing from one of us if you have not already.)

Nov 20 malware incident | Me too!

Déborah Essers-Jansen (X) — Fri, 23 Nov 2012 15:07:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Déborah Essers-Jansen (X)
Post title: Me too!

I tried to log into my online banking system and got a very suspicious message right after logging in. When I contacted my bank, they said that the problem was probably caused by a virus (at that time I didn't receive the mail from Proz yet) that tried to find out my banking details. They advised me to do a thorough scan of my computer to delete the virus. My normal antivirus program didn't indicate anything, but luckily my husband ran some other programs for me. There were indeed several threats and after deleting those, I was able to use my banking system again. So please, be very careful and take this message from Proz seriously!

Nov 20 malware incident | Might I ask...

XXXphxxx (X) — Fri, 23 Nov 2012 14:50:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: XXXphxxx (X)
Post title: Might I ask...

What assurances do we have that this won't happen again? Have you pinned the issue down or should we be steering clear of the site until you have?

Nov 20 malware incident | Not spreading alarm

opolt — Fri, 23 Nov 2012 14:47:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: opolt
Post title: Not spreading alarm

[quote]Jason Grimes wrote:

The affected ad server is completely separate from the rest of the ProZ.com site, with no access to the ProZ.com site database, code, or the servers that store them. There is no reason as a result of this incident to change your site password, though it's always a good practice to change your passwords periodically.

Thank you for trying to help, opolt, but in the future please get more facts before spreading an alarm that could panic people unnecessarily.

[/quote]

Well no, Jason, with all due respect, I am not "spreading alarm" at all -- I've said that the risk is "theoretical". But the fact is, an internal ProZ server got broken into. Whether there was a viable path for the cracker from the ad server to the rest of your internal infrastructure, whether your other servers were also exposed to that vulnerability, due to the setup of your firewalls etc., we just don't know. Nor do we know whether you've found the vulnerability already, and fixed it. And I'm sure you won't tell us about it, about your network configuration and server and database setup, as that would be quite unwise from the security standpoint. But again theoretically, given that this thing was spreading a Windows virus of some sort, it could also have spread to other Windows servers, if they are indeed Windows based.

Your original email only stated that your "dedicated ad server" was affected, and that was it. I take your word for it, and it's ok for you to keep the rest to yourself. But it was still a server under the control of ProZ, and we, as outsiders, can't be so sure about the rest, the only thing under our control is the password. As you'll know there have been many such server break-ins in the past, on high-profile sites, and often the real damage becomes visible only after some time.

It's all "in the interest of being cautious", Jason, as you said in your original email. So please don't take it personally. If some people got their computers completely crashed by it, it's surely not completely unwise to change the password. The effort involved is very small.

I'm not spreading an alarm here, I'm alerting people to potential (that is including future) risks. That should be in your own interest.

[Edited at 2012-11-23 14:52 GMT]

Nov 20 malware incident | Kudos to Norton

Doron Greenspan MITI — Fri, 23 Nov 2012 14:46:00 +0000

Forum: Safe computing
Topic: Nov 20 malware incident
Poster: Doron Greenspan MITI
Post title: Kudos to Norton

I'd like to add that my Norton Internet Security 2012 discovered it right from the start with a frightening pop-up message ("Severity = High").

That error message popped up as soon as I opened the ProZ.com homepage.

I wrote to a site staffer (out of the website of course) and got an immediate reply.

My kudos to Norton then!

[Edited at 2012-11-23 16:13 GMT]