Zlob, other Trojans, Spambot and phpbb

[Drew***]

Spammers trying to draw traffic, have heavily abused one of our domains.
Either that or they are seeking revenge for some unknown reason.
If you google the domain it will show 200,000 + results.
Unfortunately, only 5000 to 10,000 legitimately reference our domain.
The rest are used in an attempt to download Zlog.
The majority of the sites that host the spam (85 to 90%) are barely maintained phpbb boards.
So the question is, is there anything that can be done about it?

Is it possible to create a bot that will analyze Search Engine Results and notify board owners that their site is displaying spam?
The alternative is, if the boards are not being maintained at all, the bot could atleast notify the search engines to de-list pages with spam
If it were possible it would certainly be the killer application.

and so the bot wars begin

In this post I have purposely not linked to the site referenced here, because it does allow some nudity.
If you want to know the name of the site to perform a Google search, and see what we're talking about just shoot me a PM.

[Drew***]

Damn I hate following my own posts

Just finished filing another batch of removal requests with Google and 94% are phpbb2 boards (list available on request)

It may be a pie in the sky idea, but I can't help but think that the search engines would throw some money at it.

[Drew***]

Why be concerned?

I got a bit of a shock today when one of our moderators pointed out that she had searched for our "domainname.com" + "viewtopic.php" to see which pages were showing up in the search engines.

On Google, out of 100 returned she got these results:
1 link to our site (#3 in results)
1 to a linkfarm (#7)
2 legitimate sites (#4 and #28 )
96 spam sites featuring the Zlob trojan
The results of the search are available on request.

Just a few months ago we had thousands of pages from our forum indexed in Google's search engine and they showed up very well. Does this mean that Google is now devaluing pages from phpbb forums because of the spam problem? All of our sites are clean and have never used any kind of deceptive means for search engine rank. The site I am referring to here has always ranked well with Google, and the pages from the main site continue to rank well, however the forum pages have all but disappeared.

We are going to apply a rewrite program to our forum and see if that makes a difference.

[Drew***]

*sniff* *sniff* did I forget to put on deodorant?

Another idea ( I know some of these are dumb but they may trigger a better solution ) is end of life option. In other words some one has to log in to the ACP every so often to indicate that the board is active.

This is how easy it is to find a quarter million spambot posts with almost a 0 error rate. Although the phpbb software itself is not exploited or compromised, the result is the same - the visitor gets infected.

[Drew***]

A few useful resources

http://msmvps.com/blogs/hostsnews/default.aspx
http://www.dslreports.com/forum/r206310 ... Hijack-DNS
http://en.wikipedia.org/wiki/Zlob_trojan
http://www.jahewi.nl/lists/fakecodecs/fakecodecs.html
http://malwarebytes.besttechie.net/


help with removal
http://forums.spybot.info/forumdisplay.php?f=22

[ChrisRLG]

One reason you did not get any replies - you posted in the wrong place.

This is the development site.forum for phpbb.com - NOT the support site.

Try the community forum at http://www.phpbb.com instead.

[Drew***]

Chris, thank you for taking the time to reply

I intentionally posted it back here because the people who can do something about this issue read the posts in area 51. I do not see much value in making a big public fuss, as would have been the case if I had posted this on the main board.

[Highway of Life]

Unfortunately, I’m afraid there is not much [anything] we can do about this type of situation. -- other than contacting either the site owner and/or the hosting provider for the sites with the spam listed, I’m afraid I don’t have any other suggestion for you.

[Drew***]

It is true that nothing can be done about the past installations; it is with an eye to the future that made my initial post. Unattended phpbb forum installations are creating a haven for spammers, and this, I believe, will cause search engines to devalue phpbb forums in their index. So while the software is very good, and spammers are unable to hijack the software itself. They are in my opinion, hijacking the community.

This past summer in an effort to salvage one of our domains we hired a young lady on her summer break from college to request spam removals. The response rate from forums was about 8% but of those who responded almost 100% removed the spam. Obviously the issue is neglect rather than malicious intent.

Because of the low response rate we came to the conclusion quickly that it was a more judicious use of time for her to request removal from search engine indexes of spam links that referenced our domain.

Since most, but not all, of those requests for removal contained a link to a phpbb forum, that can't be good for phpbb. Unfortunately, since we didn't want our domain associated with underage porn or trojans we felt we had little choice in the matter.