Malware Warning

Fuzz · 04-17-2008, 02:33 PM

I was just informed by the Google Search Quality team that there may be a possible malware attack somewhere on the forums and the main website. They have put a warning no the site until I isolate the problem and request review.

I think it was the bottom ad network I had running... I have just removed that and deleted a lot of old/unused files on the site. I'm hoping this will resolve the issue. In the meantime, you may need to adjust your browser's security settings to view the site...

Sorry for the trouble. Any help would be nice on isolating this problem... i know a few of you have reported some odd things lately.

thanks,
steve

Secret Weapon · 04-17-2008, 02:43 PM

Yeah I've been dealing with the same diffuculties this past week. I've been trying to log on this site and everytime I would log in, my password would disappear before it got me in the system. Now I can't even check my character for some supernatural reason. But that's a relief that yall got that cleared up. I'd appreciate if I could get some help on checking up on my character,please!

Mistress Sheena · 04-17-2008, 04:16 PM

I've actually never noticed anything.. But then again I use FireFox and adblock.. >_>;

Aerif · 04-18-2008, 01:31 AM

The only problems that I encountered was the main website being blocked off completely, as for the forums, they seemed to be working most of the time for me but there were a few periods when Firefox thought the forum didn't exist >.<

As to the advert thing, yeah, I agree with you in saying that it's probably caused by some of the adverts around the site. I think I've told you before that sometimes the adverts aren't always appropiate for the audience that TFF is designed for, and more than likely they're causing problems as they're the typical websites that send out viruses.

L Lawliet · 04-18-2008, 05:52 AM

The only thing that I thought was strange was that the main site was down sometimes but I usually just had to refresh to be able to get in. Never noticed anything else.

Silver · 04-18-2008, 09:01 PM

I figured out what it was. (Unless there were multiple malware goodies for us).
It's a Trojan.Vundo and I do believe it was present in an ad.
Odd that as they're normally found on sites linked from spam emails I've tended to find.

Regardless, the file you're looking for if infected is C:\WINDOWS\system32\webperform.dll

Easy to get rid of, and it doesn't do much anyways apart from display annoying popup advertisements. Cheers.

Fuzz · 05-04-2008, 12:32 PM

Thanks for sharing all the info guys.

Well - I just 'disabled' the Xbox LIVE addon. I'm sure most of you won't care, but just wanted to make a post about it incase someone was curious. It has an exploit that required me to disable it until the author of the modification can provide a fix. All data is still stored... It will be back as soon as a fix is made. Sorry for the trouble!

Rocky · 05-07-2008, 05:36 PM

FYI I just got the malware warning from this site again today, don't know if you attempted to solve the problem yet. I was on Internet Explorer, and even though I was through my college's access internet provider, I am about 99% sure it wasn't triggered because of that, since it never happened while I was on here through college internet before.

Fuzz · 05-07-2008, 05:59 PM

Quote:

Originally Posted by Rocky

FYI I just got the malware warning from this site again today, don't know if you attempted to solve the problem yet. I was on Internet Explorer, and even though I was through my college's access internet provider, I am about 99% sure it wasn't triggered because of that, since it never happened while I was on here through college internet before.

Ah, that is discouraging to hear... I thought I got rid of it! Thanks for letting me know... can you provide anymore details? Where in particular were you in the forums? what was the message? Let me know if you remember anything else, it will help me isolate this problem.

thanks

OceanEyes28 · 05-10-2008, 08:35 AM

Okay, seriously?

I just got a "We need to scan your computer" pop-up, I exited it, and then everything came to a halt. I had to turn off my computer and when I turned it back on, I got some screen saying it was checking my disks.

I know it takes a while to figure out what the problem is, but this really needs to be sorted out. My membership here is not worth losing my files.

And now that I think of it, it's quite possible that the last virus I got that caused me to do a system restore came from here. That's not right. I use Firefox, so I don't want to hear about how I should switch. But whether or not I use Firefox, I should not have to worry about viruses when I come to this forum.

EDIT: I had tabs open in the SOLDIER, Journal, and General Chat sections of the forum when I got it. If that helps.

Fuzz · 05-10-2008, 08:44 AM

I am sorry to hear that you have been infected... I have tirelessly been working to isolate this issue for the last month and am probably as frustrated as you are. I have been working with Google and StopBadware.org to figure out the issue. I have removed pounds of code from the entire site and still people are reporting problems... I have removed files and upgraded php scripts to patch all security holes... this is the 1st i have heard in a while though? can you be more specific on what happened??? I am a little optimistic since you reported this within the last 24 hours though... I DID put back an old banner in the showthread template... it HAS to be that now. I have removed it again and will never touch that code. I'm not 100% sure that is the culprit but the pieces fit with your post and the time frame I put it back up.

thanks for the reporting, it really helped me!!!

Mistress Sheena · 05-10-2008, 07:13 PM

And again I'll have to say I've gotten nothing as of yet, and just did a scan recently, and came with nothing. x_X;
But then agian, I have adblock, so.. I see no ads or popups.</