I’ll not touch anything unless I hear otherwise.

If you set his password now, you’ll lock him out.

I was hoping to automatically use a search-n-replace in a database program to clean the up the post quickly, but that much HTML is beyond it. A script might do the trick, but it would take as much time to write as to clean the posts the brute-force way.

I need to hit the DB for a list of affected posts (“ahref” makes a dandy search string), and to see if it recorded the IP address.

Let’s kick that down the road a bit, at least until tomorrow. It’s getting late.

The page overall was copied from a wikileaks article on the topic of the keyword. Might have been fetched based on the keyword in the URL.

But the file is altered in several ways. It loads a JavaScript file from another site. This may be malware, though at first glance it looks innocuous. The page is altered to add a blurb and links to a product, in the case of the “cookbook”, the result was links to a cookbook for sale in a wikileak article on dog cookbooks.

The script is from http://www.taofengen.com/f/getbetterhealthway.js.

It might just be seriously aggressive spam. But it might drop malware, and there’s no reason to think those sites might not be built for both missions.

I wouldn’t encourage people to go to these sites by publishing the links. There are way fewer sites than links, so it might be feasible to google the site names for intelligence.

He established a presence on this board ages ago and worked to gain our trust and respect. To this end he carefully cultivated the persona of a thoughtful writer, and trustworthy scholar- in this way he infiltrated the zone… but it was a ruse- he was just waiting for the opportunity to cash in… and cash in he did! Who knows how much he was paid to blow his cover and spam us with ads… how many millions did he receive for his betrayal?

We need to appoint a special prosecutor !

I saw that ER’s posts had been bumped shortly after I posted for the first time in weeks, thought it odd, but it was bedtime, and didn’t really investigate what was going on.

But sure enough, the last edit stamp for those posts was marked ER. Don’t we have a no edit older than X setting in place?

By the way, I don’t see an e-mail from you on any of the accounts you are familiar with. Did get an e-mail from RL.

I could take a moment and clean up ER’s posts, or he could, of course. Or shall we leave alone for forensics?