This forum has ads that attempt to install malware.   

Here you post everything that is not related to other forum areas.
stuff like how you like this forum for example ;)

This forum has ads that attempt to install malware.

Postby Galane » Fri Feb 25, 2011 8:30 am

Just sitting there reading or trying to post and it will jump to some other page automatically. Hit back and it'll go back to the forum then right back to the ad site or a fake "error" page. Some have such a short automatic-forward time that it's impossible to go back to that page on the forum.

One of them did manage to install a phony "antivirus" trick the user type of installer and set up a local proxy. It replaced the Java update scheduler and added the fake antivirus installer as a run at startup program. Overall a very lame and easy to get rid of one, when caught before it's done its dirty work.

You know the type, scare the user into thinking their computer is infected, but it really isn't until they click the "scan" button. Then they really have a mess! I specialize in cleaning up after these, so I know of which I speak.

Fortunately for me I have 28 years experience with computers so I was able to easily get rid of that.

Whomever is running this show needs to clean up and eliminate all those bad advertisements. I know ads help pay for the site, but you do *NOT* want to be responsible for helping to spread malware, viruses, trojans and other nasty things.

I know it is THIS site because this is the only site I go to currently where this crap happens.

CLEAN IT UP!
Galane offline


Junior Member



 
Joined: Fri May 21, 2010 5:17 am
Posts: 50
Has thanked: 0 time
Been thanked: 4 times

Postby nabi » Fri Feb 25, 2011 9:51 am

I sent urgent warning to the admin.
Can you please be more specific about the page or advertising that activates the redirecting to the virus page?
________________________________________________________________________
When I do good, no one remembers, when I do wrong, no one forgets
.
I am in a permanent state of inactivity
I won't answer to any PM, so don't send me any
nabi offline


Ex Super Mod



 
Joined: Mon Dec 28, 2009 5:22 pm
Posts: 2429
Location: somewhere unknown
Has thanked: 39 times
Been thanked: 233 times

Postby Galane » Fri Feb 25, 2011 10:13 am

It's random. If I copy the address from the address bar, close the page and open a new tab then paste the address and go, it doesn't do it. One way to help clamp down on advertisers trying this BS is to specify static image or animated gif images only. No flash, no Java. I've heard good things about Project Wonderful, it's used by many of the most popular webcomic sites.

One other thing that happens, something here launches Winamp, which gives me an error synching to stream. I don't know if it's an exploit attempt or just an audio advert that's failing to work. I forgot about that one, until it just tried to get me again on another page.

Fortunately these "drive by" attempts have been pretty lame. Yanking the page to another one with an auto-forward is so obvious. Replacing the java update scheduler and putting a shortcut to a fake antivirus in the Startup folder in the Start Menu is so outdated.

Those might nail a complete newbie or someone foolish enough to be running without any malware protection at all, but certainly not the sort of people who come to *this* forum to find out how to go poking around inside devices the manufacturers do not want poked around inside. ;)

If Controle de Scripts was updated for Firefox 3.6.13 I wouldn't have experienced any of this. Unfortunately the author stopped work on it way back around Firefox 3.0.x I haven't found anything like it. That kept a very tight rein over what scripts were allowed to do, mostly what they were *not* allowed to do.

Thanks for taking action on this. It's a very useful forum, not good to see some people try to spoil the party.

P.S. I like your sig line, here's one I thought up a while back.

That's not borrowing trouble. That's stealing trouble then trying to sell it back to the guy you just stole it from!

And one of the best lines I've ever read in a Sci-Fi book...

"They were really only teeny little A-bombs, honest!" - Dr. Charles Dart
Galane offline


Junior Member



 
Joined: Fri May 21, 2010 5:17 am
Posts: 50
Has thanked: 0 time
Been thanked: 4 times

Postby nabi » Fri Feb 25, 2011 10:53 am

Thanks for replying. We can't tolerate anyone spoiling everything with malware!

So it's visiting a page that enables the redirect, not clicking on an advertising? No real action required to visit malware pages? Just surfing on the site?
i am sure the admin will find this useful information.
I sent him PM, mailed him and trying on msn. So shortly he will see into it.
________________________________________________________________________
When I do good, no one remembers, when I do wrong, no one forgets
.
I am in a permanent state of inactivity
I won't answer to any PM, so don't send me any
nabi offline


Ex Super Mod



 
Joined: Mon Dec 28, 2009 5:22 pm
Posts: 2429
Location: somewhere unknown
Has thanked: 39 times
Been thanked: 233 times

Postby Hitman » Fri Feb 25, 2011 10:59 am

We are aware that there can be some warnings coming from your security software when ads are loaded.
The ad provider is informed and we hope to get this problem fixed within the next few days.
There is no harmful code on the NT websites and we notify you here as soon as we get a reply from the ad provider.
Since this ad provider is not only used by NT I can only assume that soon other forums and websites will get the problem.
One thing that might help is the fact that the ads are sometimes country specific, so if you use a proxy please try one from a different country to check if you still get warnings (or attacks).
Hitman offline


Junior Member



 
Joined: Mon May 03, 2010 2:12 pm
Posts: 4
Has thanked: 0 time
Been thanked: 0 time

Postby Galane » Sun Feb 27, 2011 12:52 am

I hope it gets fixed real soon now. I had to re-open this page right here in a new tab because something kept wanting to redirect it to [Please Register or Login to download file]

And it just tried it again, tried to install a trojan imposter according to Avast, and IE8 blocked a second attack. Whomever this advertising provider is, they should be blacklisted until they clean up their act. :P

Might be best for the forum to kill the ads until you can be sure they're clean, or change ad providers.
Galane offline


Junior Member



 
Joined: Fri May 21, 2010 5:17 am
Posts: 50
Has thanked: 0 time
Been thanked: 4 times

Postby catymag » Sun Feb 27, 2011 3:21 am

I've got a virus too in these last days using IE,the same java one
a screen from my MS Essentials
Image
It doesnt affect Firefox.
I cleaned my pc many times after coming here. ;)
Today no problems. :)
catymag offline


Banned Users



 
Joined: Thu Jun 17, 2010 11:01 pm
Posts: 6
Location: GPSPower
Has thanked: 5 times
Been thanked: 1 time

Postby Wolfman » Sun Feb 27, 2011 6:02 pm

tendriver wrote:Do us both a favor. Please edit your post 5 into this one and post it here: This forum has ads that attempt to install malware.


As requested...

Whilst replying to your post, I got an AVG Virus warning :-
Threat detected "Exploit Rogue Scanner (type 1862)".
Wolfman offline


Junior Member



 
Joined: Sun May 23, 2010 10:21 pm
Posts: 47
Has thanked: 1 time
Been thanked: 1 time

Postby Capo » Sun Feb 27, 2011 7:11 pm

This have been reported to the ad provider, we are waiting a reply.
BTW, nice to see you there catymag... ;)
Capo offline


Administrator



 
Joined: Mon May 03, 2010 2:47 pm
Posts: 159
Has thanked: 78 times
Been thanked: 104 times

Postby catymag » Sun Feb 27, 2011 8:13 pm

Capo wrote:BTW, nice to see you there catymag... ;)

I cant avoid to spy a bit here :)
btw, since yesterday I had no problems visiting the forum, probably you already solved it.
thanks
catymag offline


Banned Users



 
Joined: Thu Jun 17, 2010 11:01 pm
Posts: 6
Location: GPSPower
Has thanked: 5 times
Been thanked: 1 time

Postby Galane » Mon Feb 28, 2011 4:12 am

As the creepy guy said in "Phantasm II" No. It's not! Just now, twice in a row on the main page of the forum. First time it redirected to a site claiming I'd won a free laptop. The next time it killed IE8 and popped up yet another fake antivirus scan.

This computer I'm using is squeaky clean, just did full scans with MSE, Avast and Malware Bytes before visiting here tonight.
Galane offline


Junior Member



 
Joined: Fri May 21, 2010 5:17 am
Posts: 50
Has thanked: 0 time
Been thanked: 4 times

Postby Wolfman » Mon Feb 28, 2011 9:29 pm

Yeah, sadly the problem is still there.

I've put a block on the following sites :-

[Please Register or Login to download file]
[Please Register or Login to download file]

Not sure if it will do anything but here's hoping.
I'd also add Facebook but my wife uses it.
Wolfman offline


Junior Member



 
Joined: Sun May 23, 2010 10:21 pm
Posts: 47
Has thanked: 1 time
Been thanked: 1 time

Postby Orbilator » Thu Mar 03, 2011 8:40 am

maybe its because IE is lame some times, I had it happen to but to be honest avast just catches it and i click ok, I'll be honest it happens a lot with some of the nice lady sites I visit lool
Orbilator offline


Junior Member



 
Joined: Thu Mar 03, 2011 8:20 am
Posts: 4
Has thanked: 0 time
Been thanked: 0 time

Postby chas521 » Thu Mar 03, 2011 2:04 pm

Orbilator wrote:maybe its because IE is lame some times, I had it happen to but to be honest avast just catches it and i click ok, I'll be honest it happens a lot with some of the nice lady sites I visit lool


Be VERY careful going to those porn sites. Make sure you have a good firewall and anti-virus programs. Plus it's a good idea to have a spyware, malware remover program also.
If it ain't broke don't fix it!
ALWAYS BACK-UP YOUR FILES/FOLDERS BEFORE MAKING EDITING CHANGES!

Please do NOT post any thanks. Simply press the hand icon with the "thumb up" which is the thank you button.
chas521 offline


User avatar Ex Moderator



 
Joined: Sat May 15, 2010 8:50 pm
Posts: 4549
Location: Long Island, NY
Has thanked: 64 times
Been thanked: 1368 times

Postby Orbilator » Thu Mar 03, 2011 3:01 pm

yeah i also use spybot search and destrpy and have a rigid monthly use of malawarebytes.
I pretty clean. I spend most of my time repairing pc's and malware is pretty much 70% of my time.
Orbilator offline


Junior Member



 
Joined: Thu Mar 03, 2011 8:20 am
Posts: 4
Has thanked: 0 time
Been thanked: 0 time

Next

Return to Chit-Chat

 


  • Related topics
    Replies
    Views
    Last post

Who is online

Users browsing this forum: No registered users and 3 guests