unforum

CatasTrope · Boot Joined: 25 Mar 2010 Posts: 55

[Trailhead] theyareliars

**Posted:** Wed Apr 14, 2010 7:02 pm

AUZ505

The numbers: 30:32:20:2f:20:31:39:20:2f:20:32:30:30:37

**Posted:** Wed Apr 14, 2010 7:21 pm

_________________
Playing:

RAD24

Well as far as I can tell, nothing important happened on the date in the spoiler. Nothing substantial for "7471" yet, either.

EDIT: There are also 2 mp3's in the source: http://www.theyareliars.info/1.mp3 and http://www.theyareliars.info/2.mp3

**Posted:** Wed Apr 14, 2010 8:51 pm

MrToasty

I'd be very careful going to that first site. Looks like it's trying to download and run an exploit.

**Posted:** Wed Apr 14, 2010 9:28 pm

vapor

**Posted:** Wed Apr 14, 2010 9:57 pm

CatasTrope · Boot Joined: 25 Mar 2010 Posts: 55

Just noticed that the aforementioned twitter account is following hell.com

however having browsed http://www.hell.com for a while I can't make head nor tail of it.

**Posted:** Thu Apr 15, 2010 7:21 am

vapor

hell.com has been around since the mid-nineties. The website is notorious for having "weird" stuff on the main page.

http://en.wikipedia.org/wiki/Hell.com

**Posted:** Thu Apr 15, 2010 10:22 am

RAD24

Alright, a couple things. First of all, I'm not going to that first site anymore and no one else should unless they have a good firewall and antivirus/spyware stuff, because McAfee caught and quarantined a Trojan right after I went to it.

Second, some new tweets:

vapor

Yeah I think my firewall prevented it from running. I ran a virus and malware check to be sure and did a system restore to be on the safe side.

If you strike up any more conversations with him/her, ask why the fuck they have a trojan exploit script running on their website.

*unfollows*

**Posted:** Fri Apr 16, 2010 9:51 am

RAD24

Well, I'm hoping it did no harm to my computer. I've got a firewall and everything, but I'm never too sure about things like this. If anyone would like to know, the Trojan is called "Exploit-Eleono", and I can't find really any info on it, because it's apparently fairly new. I've got it quarantined now, but should I just delete it?

And yeah, I've notified theyareliars about it.

**Posted:** Fri Apr 16, 2010 10:02 am

vapor

Heh...yeah sorry if my last post sounded kind of harsh. I don't know if a word exists in the glossary for something like this but "shit trail" comes to mind.

BTW, good to see you RAD24.

**Posted:** Fri Apr 16, 2010 10:22 am

RAD24

**Posted:** Fri Apr 16, 2010 10:29 am

Delta Grapher · Boot Joined: 13 Oct 2009 Posts: 32 Location: Kensucky

Out there, but maybe the Trojan is apart of the ARG.

Totally wrong, I'm sure. But, that would be some lulz.

Quick, someone sacrifice their computer for the greater good of the ARG community! Laughing

**Posted:** Sun Apr 18, 2010 1:48 pm

liffington · Boot Joined: 17 Apr 2010 Posts: 36

Does anyone have any leads?

**Posted:** Wed Apr 21, 2010 6:20 am

TremereBear · Boot Joined: 15 May 2005 Posts: 51

There's a new cypher posted on the twitter account -

0c0423e85048a888dac08dfd3c16e31b

Then theres one on the 17th that looks like no one grabbed -

Fnzhry oebhtug qnexarff? Vf ur qrnq? Qvq gur Nexf jva?

which goes to

**Posted:** Wed Apr 21, 2010 10:59 am