Virus on Forum

kneukm03 · #1 (**permalink**) 09-28-2008, 01:50 AM

Using details from GoRightAndYouCan'tGoWrong, and after testing around with several computers accessing this site, I was able to get one of the computers infected with a virus from this site using Internet Explorer. So it is clear that somehow a virus is infecting people through the site.

I don't believe that this was caused by the ads on this site given what happened to the computer I infected. I think the confusion is because what hit my computer is some kind of malicious advertising software. In essence, it automatically starts sending you to its own advertisements (popups, etc.). I think this is why people were saying "the ads gave me a virus" - there is confusion about what the site's ads are. The only ads that this site recently put up were two banners. Stuff that takes you somewhere else was not part of that. What I think happened is that the ads did not give you a virus - the site has a virus that took you to a bunch of other ads.

The virus that I got was through an ActiveX control (not something the ads could run to my knowledge). I didn't have to click on an ad - it simply ran without my permission and installed itself. It only happened via Internet Explorer, and didn't happen with every computer I used.

I would be very careful visiting the site with IE. I would try Chrome or Firefox for the time being instead. If you do use IE, do not allow this site to install any ActiveX controls or other software.

Googling around based on stuff I saw, I found several other Vbulletin forums that had something like this. My theory right now is that the site itself may be infected somehow. I'm having the host look into it (they will have to scan the server). At least one other forum managed to get rid of their problem via the web host. I'm taking the ads down for now to see what happens.

Please report in this thread if you experience anything that appears to be a virus from this site. Remember, though, I need DETAILS. Saying that you got a virus or trojan horse doesn't help - I need the exact text of whatever your virus program said. The exact text of whatever ad web sites you were sent to, what the ads were for, etc. I want this to send to the web host to help them search.

Sam · #2 (**permalink**) 09-28-2008, 02:07 AM

Thank you for the information and your efforts.

I have not had any problems, but other posters have.

kneukm03 · #3 (**permalink**) 09-28-2008, 02:11 AM

If you don't have problems with it my guess is you still won't. As far as what I can tell right now, to be infected you have to: 1) probably use internet explorer and 2) have your settings a certain way so that they allow the site to install stuff without you doing anything.

nonsqtr · #4 (**permalink**) 09-28-2008, 02:19 AM

Yes. It does appear to be trying to install something. And yes, I can verify that it happened "without" me clicking on an ad. I posted the IP address earlier, and moments later I got a second one from a similar address, but it had a 154 in the third octet.

Kneukm03, you do know, that this behavior is ILLEGAL, correct?

This is ILLEGAL UNDER FEDERAL LAW, what is happening with these ads. These people can be SUED in a court of law, and you can WIN if you can prove they're doing it.

And, depending on the particular State they're in, there may be even MORE stringent law that applies - the wording here in the State of California, for instance, is, "access or cause to be accessed", which is very broad.

This is very serious stuff. Thank you for paying attention to this.

kneukm03 · #5 (**permalink**) 09-28-2008, 02:27 AM

The big problem would be finding them. I would bet a lot of money they aren't in the United States. Most of this junk comes from Russia, China, etc. - if they were here, I wouldn't just sue them - I could get them thrown in jail.

Nonsqtr, it sounds like you are still seeing it. Was it still trying to install something when you made this post, or are you talking about stuff you saw earlier? If you can verify that it would be very helpful.

GoRightAndYouCan'tGoWrong · #6 (**permalink**) 09-28-2008, 04:04 PM

Thank you 03.

cottonbroker · #7 (**permalink**) 09-28-2008, 04:12 PM

For some reason I have been lucky and have no virus from anywhere.

GoRightAndYouCan'tGoWrong · #8 (**permalink**) 09-28-2008, 04:17 PM

Quote:

Originally Posted by cottonbroker

For some reason I have been lucky and have no virus from anywhere.

Well I updated Norton early, and since I’ve had no problems…Keeping fingers crossed, but I hadn’t been infected just attacked. Norton has been spot on with catching them, it was just that every other time I visited the site I was getting attacked with something and it would lock everything up….

Gummer · #9 (**permalink**) 09-28-2008, 04:56 PM

Quote:

Originally Posted by GoRightAndYouCan'tGoWrong

Well I updated Norton early, and since I’ve had no problems…Keeping fingers crossed, but I hadn’t been infected just attacked. Norton has been spot on with catching them, it was just that every other time I visited the site I was getting attacked with something and it would lock everything up….

Oh lord hon..... try McAfee... when i had a pc.... I bought Norton.... that pile of crap slowed my puter so much it was nearly .... unuseable... <---- is that a word?

Doug Rozenek · #10 (**permalink**) 09-28-2008, 05:33 PM

Thanks for the info and for looking into this further Kneukm! I've been able to completely remove the infections from my system, but was able to keep some info about where I was being re-directed to.

P.S. I don't recommend that anyone follows these links, they are just posted here for info for Kneukm

www.freeonlinescanner9.com
PC Doctor|PC Fix|Registry Cleaner|PC Diagnostics|PC Checkup
Registry Repair, Clean Up & File Fix for Windows

I don't know if this will help you in anyway, but that's all the info I was able to retain from the attack.