server.exe / server123.exe DO NOT DOWNLOAD/RUN

Discussion in 'Empire News' started by Aikar, Jul 31, 2012.

Thread Status:
Not open for further replies.
Page 1 of 4
  1. Update: Issue occuring again on 8/10/12 with server123.exe and sohtt.exe

    I recommend joining us on IRC and taking a break from the site. You can chat with us on IRC and get updates on when its safe. Follow the instructions below:

    The site is experiencing an issue right now where a virus is trying to download/run on every page load called server.exe

    THIS IS NOT MEANT TO HAPPEN! It was not placed their by EMC staff, and should be blocked by any means necessary.

    Please sure you are running antivirus, I personally recommend http://avast.com

    This file will cause harm to your PC, and i'm trying my best to get ahold of Justin to get this resolved.

    Please hold tight and avoid this file. More details will follow from one of us as information is found.
    Aikar, Jul 31, 2012
    #1
    TerryDaTerrorist, hayleycolgan, marknaaijer and 10 others like this.
  2. I also highly suggest Avast antivirus :p
    Tehwafflez, Jul 31, 2012
    #2
  3. This is terrible
    Zoebearfun105, Jul 31, 2012
    #3
  4. Microsoft Security Essentials removed it (checked my history of virus')
    nfell2009, Jul 31, 2012
    #4
    NissanHD likes this.
  5. If your on windows, and worried this might of been ran, check to see if this file exists:

    Open Start Menu, and in the search box type:
    %SystemRoot%\system32\

    Then see if the file 360SP2.dll exists.

    If it does, you've likely been infected and recommend running Avast scan and Malware Bytes immediately.

    http://avast.com
    http://www.malwarebytes.org/
    Aikar, Jul 31, 2012
    #5
    vividOptimism likes this.
  6. Win32/FarFli.K its called

    Btw MSSE /\ "Quarentiented" it make sure to load MSSE up History look through those lists with the O's and Remove All
    nfell2009, Jul 31, 2012
    #6
  7. nope im clean :D
    nfell2009, Jul 31, 2012
    #7
  8. i haven't seen it
    DogsRNice, Jul 31, 2012
    #8
  9. What if your on mac?
    Zoebearfun105, Jul 31, 2012
    #9
  10. Thanks for the warning. Looks like I'm ok, but I'm doing a Norton scan just in case.
    will_iamd, Jul 31, 2012
    #10
  11. .exe doesn't start on macs :D
    kyllingman2, Jul 31, 2012
    #11
    hayleycolgan likes this.
  12. Good.
    Zoebearfun105, Jul 31, 2012
    #12
  13. Why would I be asking if I didnt have a mac?
    Zoebearfun105, Jul 31, 2012
    #13
    nfell2009 likes this.
  14. .exe is a application that works only on Windows because Microsoft (keep typing minecraft) use Open Source will Apple use Closed Source code so they have to be passed by Apple to work on macs
    nfell2009, Jul 31, 2012
    #14
  15. I'm all good. :)
    pat2011, Jul 31, 2012
    #15
  16. Ok so from our investigation it does not look like EMC itself was hacked, as the servers look fine and the issue is gone.

    Based on the evidence, we believe one of the other parent computers in the network chain may of been compromised (IE: The web host or network providers) in a way that would of affected more than just EMC.

    These are servers outside of EMC's control.

    Essentially, every web page you load typically actually passes through about 15-25 different computers first...
    if you ever have done a traceroute, this is those "hops" it mentions. However some "hops" are actually invisible to you once it reaches the final destination, but they are still there.

    If one of the computers in the middle of the chain gets hacked, they can modify everything that comes through them. We believe this is the case here, as what we saw doesn't make sense based on how EMC is configured for EMC to have been specifically targetted.

    Justin has wrote a quick monitoring tool that will alert him immediately if it sees the issue come back.
    Aikar, Jul 31, 2012
    #16
    PenguinDJ, MarioLuigiEpic, TheTrufflehunter and 3 others like this.
  17. Yay!
    nfell2009, Jul 31, 2012
    #17
  18. Thanks Aikar. A good friend of mine in game told everyone to avoid the EMC website and said there was this virus. I told her I have had the site loaded on my browser all day today and never saw this. She said it might be the browser I'm using...which is Google Chrome.
    topdawg657, Jul 31, 2012
    #18
    Jeanzl2000 likes this.
  19. Finally Someone else that has a mac!
    TheEpic5, Jul 31, 2012
    #19
  20. Why do you guys ask this? Those of us that use Macs are fine with them, or they're using Windows. It's getting annoying. -_-
    Not necessarily. Apple only has to approve the Mac App Store apps. Anything else just has to be packaged in a different format.
    SpaceShuttleFan, Jul 31, 2012
    #20
Page 1 of 4
Thread Status:
Not open for further replies.