Warning : Possible Virus/Malware?

[Vanek! at the Disco]

My ESET Virus Scanner is going nuts when I access the forums today, blocking a website almost every time I refresh the site.

It seems to have issues with cdn . adgear . com .swf files.

Dobber keeps claiming it's all a-ok but I don't buy it. I think what probably happened is that his site got hacked at some point and the hacker tweaked some of the code in the forums to randomly route users to different ads, malware, spamware, etc. So while I'm sure a scan of his server doesn't reveal any issues, that's because it's not a virus, not because there is not a problem. That's how these forums packages like vBulletin work, (along with their plugins) you get a standard version out of the box but you're allowed to change the code however you want to suit your needs and make it work the way you need it to. I'm guessing a hacker has has subtly modified the forum code to exploit it for their own ends and that's why people continue to have issues.

I would be very careful browsing the forums, make sure your malware protection is all up to date and that you have the browser protection enabled and if you see anything weird, close out and do a full scan

[Dobber]

Any issues with the sites or forums is either on your PC or it's an ad.

If it's an ad, just PM me the ad. With 1000s of ads to sift through and "uncheck", sometimes they get through. And the ad makers fool Google sometimes for a few hours, sneaking a pop-up ad in there where it shouldn't be. The way to fix is - either Google roots it out, or we find it and "uncheck" it. But not everyone would see it because often they are regional or by platform

Vanek - your guesses are incorrect, though I can understand your thinking. There is no hacked code in the forum other than what we put in ourselves. It's an ad or it's on the PC. I promise. If it's an ad, just ignore it or don't click it. It will be gone soon. A hacker can tweak the code as you say, but the scan would find that. That's what a virus is. A scan finds any and all re-directs. This isn't even a discussion, no need to float any scary theories - because it's an ad or on the PC. 100%. Zero doubt in my mind.

Anyway, as you should anywhere on the internet, surf with protection.

[doulos]

I'll PM you the links that are being flagged Dobber. I am fairly certain that it's an ad like you suggest.

[Vanek! at the Disco]

Vanek - your guesses are incorrect, though I can understand your thinking. There is no hacked code in the forum other than what we put in ourselves. It's an ad or it's on the PC. I promise. If it's an ad, just ignore it or don't click it. It will be gone soon. A hacker can tweak the code as you say, but the scan would find that. That's what a virus is. A scan finds any and all re-directs. This isn't even a discussion, no need to float any scary theories - because it's an ad or on the PC. 100%. Zero doubt in my mind.

There are so many things wrong with this reply that I scarcely know where to begin. I know you know fantasy hockey pretty damn well, but your grasp of internet security and exploits needs a lot of work.
Believe what you will man, just pray this is a benign phishing attack and you don't wind up with everyone's credit card #s compromised.

[Savvy1982]

It's gotta be a regional/geographic thing.

Apart from one add, one time, 10 days ago, I haven't gotten a single ad on my phone, my laptop, my desktop, or my work computer.

If it was something more serious, I think I'd have had more problems.

[doulos]

Dobber keeps claiming it's all a-ok but I don't buy it. I think what probably happened is that his site got hacked at some point and the hacker tweaked some of the code in the forums to randomly route users to different ads, malware, spamware, etc. So while I'm sure a scan of his server doesn't reveal any issues, that's because it's not a virus, not because there is not a problem. That's how these forums packages like vBulletin work, (along with their plugins) you get a standard version out of the box but you're allowed to change the code however you want to suit your needs and make it work the way you need it to. I'm guessing a hacker has has subtly modified the forum code to exploit it for their own ends and that's why people continue to have issues.

I would be very careful browsing the forums, make sure your malware protection is all up to date and that you have the browser protection enabled and if you see anything weird, close out and do a full scan

Frankly, this feels like scare mongering. It was a specific ad that was causing an issue before (and is no longer causing an issue now since they took care of that specific ad).

The links I have (have not sent them yet, I will later), also look like specific ads.

I am not worried at all and I have to deal with this stuff from clients all the time.

[Dobber]

There are so many things wrong with this reply that I scarcely know where to begin. I know you know fantasy hockey pretty damn well, but your grasp of internet security and exploits needs a lot of work.
Believe what you will man, just pray this is a benign phishing attack and you don't wind up with everyone's credit card #s compromised.

Thanks man! Can you set up a tutorial for me? Also a link to your website, so I can check out the security there and learn a few things.

I'm starting my prayers on this being a benign phishing attack, thanks for the tip.

[Vanek! at the Disco]

Frankly, this feels like scare mongering. It was a specific ad that was causing an issue before (and is no longer causing an issue now since they took care of that specific ad).

The links I have (have not sent them yet, I will later), also look like specific ads.

I am not worried at all and I have to deal with this stuff from clients all the time.

No it's not, I'm a sysadmin. Plus I used to work for Wordpress, I've seen more clever exploits and hacks than you can possibly imagine in a lifetime. Every time we'd plug a hole, the rats would chew out 10 more, if you're not vigilant and you continue to ignore these type of things or treat them like they are some kind of easily detectable "virus" then you're going to have a really bad time, sorry, but that's the reality.

I'm not trying to say this is Dobber's fault in any way, shape or form, what I am saying is that when you run open source, plugin-able software like vBulletin or Wordpress or Joomla, or any of the others that are common, and do so on a public facing site, you open yourself up to every bored 14 yr old trying to make a few extra bucks.

The reality here is that you have multiple users reporting the issue, that's not random and it's not a fluke, that's a pattern. You want to ignore it? Fine, but it's not scare mongering to tell people the truth.

[doulos]

No it's not, I'm a sysadmin. Plus I used to work for Wordpress, I've seen more clever exploits and hacks than you can possibly imagine in a lifetime. Every time we'd plug a hole, the rats would chew out 10 more, if you're not vigilant and you continue to ignore these type of things or treat them like they are some kind of easily detectable "virus" then you're going to have a really bad time, sorry, but that's the reality.

I'm not trying to say this is Dobber's fault in any way, shape or form, what I am saying is that when you run open source, plugin-able software like vBulletin or Wordpress or Joomla, or any of the others that are common, and do so on a public facing site, you open yourself up to every bored 14 yr old trying to make a few extra bucks.

The reality here is that you have multiple users reporting the issue, that's not random and it's not a fluke, that's a pattern. You want to ignore it? Fine, but it's not scare mongering to tell people the truth.

He had multiple users reporting an issue. He claimed it was an ad. He claimed he fixed the ad issue. The problems went away. I'd say he was dead on.

This second issue is an entirely different set of symptoms and websites. Not the same thing at all.

[maximumass]

I thought this was supposed to have been fixed?!

I had an infection come up last week on my laptop. The name of it was Trojan horse downloader.generic.13.BVLU
This is a brand new work laptop (2 weeks old!), I haven't downloaded anything or installed anything on it at all.
I am 99% sure I got it from this site, I checked my browser history, the only sites I have visited other than this one are google search, email, nhl.com, amazon and wikipedia, that's it.
As far as what I clicked on I can't be completely certain but to me it looked like I clicked New Posts button at the top and it launched the ad, I don't I clicked anything on the ad itself but I'm not certain, maybe that's what caused this?
I live on the west coast if that helps.

[Axeman33]

I thought this was supposed to have been fixed?!

I had an infection come up last week on my laptop. The name of it was Trojan horse downloader.generic.13.BVLU
This is a brand new work laptop (2 weeks old!), I haven't downloaded anything or installed anything on it at all.
I am 99% sure I got it from this site, I checked my browser history, the only sites I have visited other than this one are google search, email, nhl.com, amazon and wikipedia, that's it.
As far as what I clicked on I can't be completely certain but to me it looked like I clicked New Posts button at the top and it launched the ad, I don't I clicked anything on the ad itself but I'm not certain, maybe that's what caused this?
I live on the west coast if that helps.

I can tell you, I spend a hell of a lot more time on this site than most of you and I haven't had any issues, none what so ever. I even recently (last night) ran my anti-virus/anti-malware software just for curiosity and nothing.

[Coyote]

I had a warning pop up last night while browsing the forums but I also had about a dozen tabs open to other stuff (reddit, several gaming sites, etc) so I don't know for sure it was from here.

It was some trojan generic type too though so I'd recommend everyone update their protection (I have mine set to download latest definitions every night at 2AM when I'm asleep)

[dooley89]

All good for me, have never had an issue

[Vanek! at the Disco]

I can tell you, I spend a hell of a lot more time on this site than most of you and I haven't had any issues, none what so ever. I even recently (last night) ran my anti-virus/anti-malware software just for curiosity and nothing.

Well then, if you haven't had any issues then it must be all fine I'm sure

Did you even bother to read the thread? Try it, you might learn a thing or two

• If it's from an ad (as Dobber claims) then it is regional, that's how ad networks work, they target by region, device, demographics etc. So unless you're flying all over North America on a daily basis the amount of time you spend on the site here doing god's work is irrelevant.
• If it's not from an ad and is being triggered by some piece of malicious code embedded into the forum then there could be dozens of reasons why you have yet to see it, the most obvious of course being that the last thing a hacker would want to do is alert administrators and moderators to his presence, so he'd likely omit those accounts completely from anything sneaky he was trying to do.

[rougie]

All good for me, have never had an issue

Also never had any problems