Malware Warning

[Fuzz]

I was just informed by the Google Search Quality team that there may be a possible malware attack somewhere on the forums and the main website. They have put a warning no the site until I isolate the problem and request review.

I think it was the bottom ad network I had running... I have just removed that and deleted a lot of old/unused files on the site. I'm hoping this will resolve the issue. In the meantime, you may need to adjust your browser's security settings to view the site...

Sorry for the trouble. Any help would be nice on isolating this problem... i know a few of you have reported some odd things lately.

thanks,
steve

[Secret Weapon]

Yeah I've been dealing with the same diffuculties this past week. I've been trying to log on this site and everytime I would log in, my password would disappear before it got me in the system. Now I can't even check my character for some supernatural reason. But that's a relief that yall got that cleared up. I'd appreciate if I could get some help on checking up on my character,please!

[Victoria]

I've actually never noticed anything.. But then again I use FireFox and adblock.. >_>;

[Aerif]

The only problems that I encountered was the main website being blocked off completely, as for the forums, they seemed to be working most of the time for me but there were a few periods when Firefox thought the forum didn't exist >.<

As to the advert thing, yeah, I agree with you in saying that it's probably caused by some of the adverts around the site. I think I've told you before that sometimes the adverts aren't always appropiate for the audience that TFF is designed for, and more than likely they're causing problems as they're the typical websites that send out viruses.

[L Lawliet]

The only thing that I thought was strange was that the main site was down sometimes but I usually just had to refresh to be able to get in. Never noticed anything else.

[Furore]

I figured out what it was. (Unless there were multiple malware goodies for us).
It's a Trojan.Vundo and I do believe it was present in an ad.
Odd that as they're normally found on sites linked from spam emails I've tended to find.

Regardless, the file you're looking for if infected is C:\WINDOWS\system32\webperform.dll

Easy to get rid of, and it doesn't do much anyways apart from display annoying popup advertisements. Cheers.

[Fuzz]

Thanks for sharing all the info guys.

Well - I just 'disabled' the Xbox LIVE addon. I'm sure most of you won't care, but just wanted to make a post about it incase someone was curious. It has an exploit that required me to disable it until the author of the modification can provide a fix. All data is still stored... It will be back as soon as a fix is made. Sorry for the trouble!

[Rocky]

FYI I just got the malware warning from this site again today, don't know if you attempted to solve the problem yet. I was on Internet Explorer, and even though I was through my college's access internet provider, I am about 99% sure it wasn't triggered because of that, since it never happened while I was on here through college internet before.

[Fuzz]

FYI I just got the malware warning from this site again today, don't know if you attempted to solve the problem yet. I was on Internet Explorer, and even though I was through my college's access internet provider, I am about 99% sure it wasn't triggered because of that, since it never happened while I was on here through college internet before.

Ah, that is discouraging to hear... I thought I got rid of it! Thanks for letting me know... can you provide anymore details? Where in particular were you in the forums? what was the message? Let me know if you remember anything else, it will help me isolate this problem.

thanks

[OceanEyes28]

Okay, seriously?

I just got a "We need to scan your computer" pop-up, I exited it, and then everything came to a halt. I had to turn off my computer and when I turned it back on, I got some screen saying it was checking my disks.

I know it takes a while to figure out what the problem is, but this really needs to be sorted out. My membership here is not worth losing my files.

And now that I think of it, it's quite possible that the last virus I got that caused me to do a system restore came from here. That's not right. I use Firefox, so I don't want to hear about how I should switch. But whether or not I use Firefox, I should not have to worry about viruses when I come to this forum.

EDIT: I had tabs open in the SOLDIER, Journal, and General Chat sections of the forum when I got it. If that helps.

[Fuzz]

I am sorry to hear that you have been infected... I have tirelessly been working to isolate this issue for the last month and am probably as frustrated as you are. I have been working with Google and StopBadware.org to figure out the issue. I have removed pounds of code from the entire site and still people are reporting problems... I have removed files and upgraded php scripts to patch all security holes... this is the 1st i have heard in a while though? can you be more specific on what happened??? I am a little optimistic since you reported this within the last 24 hours though... I DID put back an old banner in the showthread template... it HAS to be that now. I have removed it again and will never touch that code. I'm not 100% sure that is the culprit but the pieces fit with your post and the time frame I put it back up.

thanks for the reporting, it really helped me!!!

[Victoria]

And again I'll have to say I've gotten nothing as of yet, and just did a scan recently, and came with nothing. x_X;
But then agian, I have adblock, so.. I see no ads or popups.

[OceanEyes28]

I'm running a virus scan right now, and so far it has isolated something called

Microsoft.WindowsSecurityCenter_disabled

That doesn't sound pleasant at all. If I get anything else, I'll let you know.

[Merlin]

That entry isn't a virus. It means Windows Security Center is currently disabled. Go into your settings and make sure your security center is running.

As for your computer checking files when you rebooted it, thats a normal Windows feature that has been around for many iterations. Whenever your computer crashes it is set by default to bitch at you that it crashed and check the drives. It doesn't mean your hard drives were hosed. Its just Windows being anal-retentive.

Like Toph, I haven't had any problems. Unlike Toph, I have been using IE7 with no popup/ad/malware or anything else running and have no problems. My computer hasn't crashed or had a virus since I installed Vista on it when it first came out. I got AVG Free and thats it. Now that doesn't mean other people won't have problems, because the ads are random. So its up to probability on when/if you receive it.

[OceanEyes28]

Well there's a question answered.

However, now that the scan is done, it's picked up things like

AdRevolver
BlueStreak
BurstMedia
CasaleMedia
DoubleClick
FastClick
MediaPlex
TagASaurus
Zedo

So perhaps that will help more than my windows ignorance will. I don't know if all that is from here (or if it's even bad), but it's something to look out for.

[Merlin]

What virus software are you using? Most of those are usually tracking cookies which aren't viruses... just crap that keeps tabs on what you are doing. Of course, deleting them is always a good thing. I won't swear to what they are since I'm not sitting at your screen..

All I can say is make sure you have the most updated version of whatever browser you choose to use and never click on an ad, no matter what it is.

I'd dig around in the ad code, but really I have no idea wtf Fuzz is using or not using in code at this point... :\ He was using Google stuff and non-google stuff.

Just keep informing us of anything fishy and what the ad is. Sometimes its the best method, unfortunately. The whole random thing is a pain in the arse since its usually one specific ad, not the whole thing.

In other news, I downloaded Spybox S&D just to see if it picks up anything on my comp. Halfway done and nothing yet. On my XP comp it would have 5000 things by now...hah

EDIT: It came up with an almost identical list to yours. They were all tracking cookies in Firefox. Internet Explorer didn't have any at all. That's pretty damned funny, seeing as how FireFox is supposed to be so much better.

[Fuzz]

good news! TFF is finally officially off of the stopbadware.org malware list. Took almost 3 weeks to figure this out, but there shouldn't be any more problems. Now the Google warning is gone for our link on their index. Wow, what a ride. I can't even tell you how much security patching I had to do, haha. At least we're safe now and PLEASE report any suspicious issues! Better for me to handle it before it gets flagged again... however, I don't suspect any more problems. Thanks again for the help guys.

[Draken Benvolaid]

Hey did you find a usable version of the Xbox Live thing-a-ma-jig?

Some of the forums I go to use the same vBulletin as TFF, but have a working XboxLive thing-a-ma-jig.
Would you like me to ask them on what they use?

[Fuzz]

Nah, you don't have to ask them. I am going to wait until there is a more stable version of the modification. It shouldn't be too long. As of now, the mod takes way too many server resources and is a bit buggy. I will be sure to announce something when it is back! Sorry for the inconvenience.

[VidenTheColdOne]

I noticed that my Avast Antivirus program will give me a warning about malware when i go to the site, it give me the option to abort the connection, but i just ignore it.

[Refieth]

Well there's a question answered.

However, now that the scan is done, it's picked up things like

AdRevolver
BlueStreak
BurstMedia
CasaleMedia
DoubleClick
FastClick
MediaPlex
TagASaurus
Zedo

So perhaps that will help more than my windows ignorance will. I don't know if all that is from here (or if it's even bad), but it's something to look out for.

All cookies. Harmless.
Anyway, thank goodness we're off that list! Is that why the site was down earlier?

[Victoria]

No, it wasn't.

[Fuzz]

I noticed that my Avast Antivirus program will give me a warning about malware when i go to the site, it give me the option to abort the connection, but i just ignore it.

When did you get this warning? Today? The site is completely clean right now, so I'm curious as to why you got that warning? did it have any additional details?

[VidenTheColdOne]

I did get it today. It just said that malware was found, and gave me the option to abort the connection to the site. I tried getting the message again, but i havn't been able to. Im going to clean out my cookies and cache, and try to get it again and see if it has any more info.

[VidenTheColdOne]

there ya go, hope it helps.

[Fuzz]

Hey thanks for the screenshot, that really did help!

I did some investigating on 1ive.net malware and found that it is infact something to look into. It looks like it has only infected sites that pertain to WoW or FFXI... so I'm thinking it has something to do with Gil Farming.

I will keep you posted. If you find anything else you think will help, please share. Thanks again,

[Fuzz]

Ah HA! I found the culprit. I searched all the text in every file on the server and found a 'Fantasy.js' script running. Please try exiting your browser and refreshing the main page again... do you still get it? I'm not getting it, so it is hard to test. I hope this fixed it. thanks again for pointing this out.

[Victoria]

I've never gotten that either, but then again I use FireFox with ad-blocker. >_>;

[SailorCallie]

I've never gotten that either, but then again I use FireFox with ad-blocker. >_>;

So do I. I'm lucky to use Firefox as my default browser with Ad-Block Plus, so I'm very fortunate that I did not get the virus.

[VidenTheColdOne]

I'm glad i could help.

I exited out of my browser, and cleaned my cookies, avast didn't give me any warnings this time, so it looks good!