[Moogable]

Apparently a number of other TFF'ers are having issues accessing the site. Avast comes up as saying that there is a virus here and it automatically aborts the connection. I'm using a beta version of kaspersky, so nothing's come up for me, but that might just be that my AV is failz.

Anyword on whether there's a certified problem or not?

Additional Information from Sheena

Apparently it picked up a "gzip" file at hXXp://www.thefinalfantasy.com/\gzip
(T's are replaced with x's for safety reasons), and the script name is HTML: Script-inf

So...yeah, any info would be much appreciated!

[Meier Link]

Trojan Downloader Problem

This has already been adressed here.

[Aerith Heartilly]

This may be too late to say anything,but.Everytime I log on my computer blocks a virus.Lucky I have a virus blocker,has anyone else experienced this?

[Mistress Victoria]

Meier, this is a completely different thing. So no it has not been solved. This isn't a trojan. This is a virus/worm.

[Waterdragoon]

I havent gotten this but, i have been getting dogpile, and trojan's. ood thing i have Norton 360 ^^

[Unknown Entity]

Originally Posted by Outdoor2497

I havent gotten this but, i have been getting dogpile, and trojan's. ood thing i have Norton 360 ^^

I have Norton 360 too, and I'm not getting any problems. So... I'm sure thats not the issue. =S

[Meier Link]

Bloodhound.Exploit.156 | Symantec

This is what both of my anti-virus programs are picking up on. It is not limited to the main forum anymore, I have managed to pick up virus alerts all over the forum.

I am using McAfee Premium and also have Norton Corporate edition at work. Both have picked this up multiple times.

I think as long as your software is up to date you will be fine. It is easily contained and elminated but it is getting annoying having to see the damn pop ups all of the time.

[Mistress Victoria]

I don't get anything, and I use Avira Security Suite. I also use FireFox with adblock.
So I guess for those who get it, uh.. start using Firefox with adblock?

Because Fuzz just went through everything and he got nothing.

[Waterdragoon]

Ok, ty Meier and Sheena ^^ and Unknown ^^

P.S. Unknown your awsome ^^

[Fuzz]

Sorry to hear that some people are still getting this ghost virus. I'm not entirely sure what the deal is - as there are no infections on the server. As I mentioned earlier, I am migrating to another new machine within the next couple of days... I will take that opportunity to do a deep clense of the site.

The new server has more updated software, scripts, and kernel on it, so we'll be moving into a fortress.

In the interm, I'll keep you posted if I hear or find anything about this virus. Otherwise, this will for sure be resolved after the move. Thanks

UPDATE: Ok, now that we're on the new box and my DNS has propogated, I am getting down and dirty on this bastard... along side doing some hardcore cleaning.

UPDATE: I FOUND THE ****ER!

UPDATE: It was a SQL injection in the 'forum' table... bah. Well, good news is that is from the old server and just came along with the DB backup I made. Now that we have all the latest PHP/MySQL versions, we shouldn't have any more of those. Thanks to all who helped report this. I hate malware!

[Meier Link]

Live update as of now. I have scrolled through the forums multiple times and have yet to see notifications of a virus on either of my comps. I would have to say the issue has resolved it's self (if that is what we really want to call it).

Fuzz (if you are reading this) I am curious, did you find something during the move? Or was it probably the security of the new server that rendered this exploit useless and dead?

[Fuzz]

Yeah, well, I guess what happened is the exploit was actually transferred over to the new server since it was in the database backup. However, after the DNS synced in and I visited the forums for the first time with the domain pointing to the new IP address; NOD32 barked at me with a few malicious warnings.

Have the error actually in front of me helped me get the appropriate info to do a fulltext search on it in the database. I guess my AV only warns you once and then tucks the warning away? Oh well, doesn't make much since, but none-the-less it is fixed

Apparently many other FF and WoW related sites have the exact same exploit... makes me wonder if it is the content relevant ads that injected the code.

Well at least we all updated PHP, mySQL, and vBulletin packages now, so we are definitely back up to speed. thanks again for your help!