Virus Alerts

[-Matt-]

My computer is wigging out.... barely able to type this.


If someone can have bob text me or something i could really use his help


Just letting you know mary that something on here is kicking my computers ass

[guspech750]

I have noticed a few warnings lately from my antivirus while on MM.net. Never had them before. But nothing has wigged out my computer...................... ..Yet!

[SC Cheesehead]

I've been getting pop-up warnings too. Something is causing Symantec to block virus attacks while I'm on MM.net.

[Blackened300a]

I haven't had any issues. Im also running Ad block Plus through firefox so maybe one of the banners is glitched.

[guspech750]

My computer is wigging out.... barely able to type this.


If someone can have bob text me or something i could really use his help


Just letting you know mary that something on here is kicking my computers ass


I've been getting pop-up warnings too. Something is causing Symantec to block virus attacks while I'm on MM.net.
Maybe its the CV.net guys getting Back at us for letting Bawazir into their fraternaty!

[-Matt-]

"antispyware soft" is destroying my computer

[CooLManZilla]

Matt,

Had some problems and posted about it a few weeks ago.

seems to be ok now.

antivirius was catching something and blocking it.

Try cleaning out your temp files

[CooLManZilla]

Jinxed myself!

Antivirius just alerted.
this site has a HTML virius . downloaded as "ad[3]" or something

[FordNut]

"antispyware soft" is destroying my computer

That's a bad one.

[-Matt-]

what do?....

[FordNut]

My Mom got it, we had to reload the OS.

[-Matt-]

ouch.... the damn things not letting me open any of my anti-spyware programs

[TooManyFords]

Stop running Internet Explorer. It is the devil!

+1 for Google Chrome.

[silver_2000]

there has been a recent BIG surge in infections that are being emailed by your friends. They often show up as an email from a close friend with no subject and simply a link in the email.

Since many of you spend a great deal of time here any infection from any source will appear to affect MM - with no proof that it came from here. The vast numbers of daily visitors here would pretty much assure that if the site were infected hundreds of people would be impacted daily.

The server runs a number of technologies to prevent an exploit that might cause an infection. The one thing that cant be controlled as a malicious banner ad. Im running a scan now to be sure there is no resident issue - it wont detect a bad google banner though

Many current viruses wont let you get to sites to dload tools to clean them.
In a quick google search it appears that malware bytes works for that listed infected. To solve the problem of not being able to get to sites to dload tools, a few years ago I started hosting copies of tools I use on my website. I havent updated them in a few months but they are available here
www.bosshelp.com/tools - some of those tools can and will destroy your PC in the hands of an amateur

you can load the tools to a USB key and boot your PC to safe mode

Finally - if you are still running XP you are taking risks with an out of date - inherently more insecure OS

this looks like a good link
http://www.bleepingcomputer.com/forums/topic317515.html

[BAD MERC]

Use Mozilla first and foremost. Download and run Malwarebytes.com, superantispyware.com and freefixer.com . They work flawlessly and have always taken the worst infections out of my computer. If you want a boot-time scan go to ad-aware.com (lavasoft) and use their downloadable boot scan. You have to sit through the whole thing but it is thorough!!

[boatmangc]

By a Macintosh!
I have 1 PC that I only use for marine engine diagnostics. It only goes online to update software from the Mfg. It does not have email, and I have never opened IE.
It might last as long as my Mac which I use fearlessly.

[-Matt-]

I dont normally open IE.... Firefox wasnt loading MM.net yesterday and i was forced to open IE to check the site.... now im getting blasted

[musclemerc]

I've been having warnings too for a few weeks now.

[Pat]

My computer went bonkers a couple of months ago, It was attributed to an anti virus ad ware. Go figure. Communist, pink-O bastages.

Took it to Mr. Fix-It and now works OK. My anti virus program has not pinged on anything since then.

Good luck,

BTW don't e-mail me. LOL

[guspech750]

So is everyones computers ok now?

[SC Cheesehead]

So is everyones computers ok now?

Got several virus warnings last night, Symantec caught them, so no harm to my PC.

So far, so good today.

[fastblackmerc]

Haven't had a virus issues while on the site.

[justbob]

Matt, if needed download the free version of malwarebytes.com onto another system and click save. Insert a zipdrive and transfer it over to your PC and click run and let it do a scan. I came up with 12 Trojan alerts from here a couple weeks ago and had no internet capability.

In the end, all I lost was my saved Emails. I was able to regain internet access by doing this:

1)Start menu
2)Control panel
3)Internet options
4)connections
5)LAN settings
6)uncheck proxy server box

I hope this helps.

[guspech750]

Matt, if needed download the free version of malwarebytes.com onto another system and click save. Insert a zipdrive and transfer it over to your PC and click run and let it do a scan. I came up with 12 Trojan alerts from here a couple weeks ago and had no internet capability.

In the end, all I lost was my saved Emails. I was able to regain internet access by doing this:

1)Start menu
2)Control panel
3)Internet options
4)connections
5)LAN settings
6)uncheck proxy server box

I hope this helps.
Maybe you have a career at.......... plus a way coolio car.

http://www.bothfavorites.com/blog/wp-content/photos/geek_squad.jpg

[SAAAAAC]

Do a system restore to a date back before you had the issues, if it allows you to. And for future reference, don't click on stuff if you don't know what it is.

[Egon Spengler]

Do a system restore to a date back before you had the issues, if it allows you to. And for future reference, don't click on stuff if you don't know what it is.
A big +1 to the system restore. I have done that before when I had a virus and it worked quite well.

I have not had any issues with the site at all (knock on wood)

Good luck with the viruses everyone! Hate the thought of someone putting a virus on this site!

[silver_2000]

Scans finished on the server

the only issues found were inside users emails

Doug

[Egon Spengler]

Scans finished on the server

the only issues found were inside users emails

Doug
Thanks Doug! I feel more comfortable now! haha... Started to get a little nervous seeing as how I am on here quite a bit at work and would hate to get a virus on my work computer!
:beer:

[silver_2000]

In my experience System restore is a worst case solution. Often times system restores are infected. If not it simply allows you to get back in to the system to then do a thorough scan and clean. Keep in mind the hole in your PC that allowed the infection is still there unless you take steps to stop it

Id love to do an informal survey to know
what % of "infected" people are running XP
What % are using Internet Explorer
What % are using PCs that arent updated

[-Matt-]

it wasnt from an email see as i never open any... it was something raw that came from this site... im just sayin

and no, its not fixed yet

[MM03MOK]

Question, Doug. If one has multiple windows open pointing to different websites, it is possible, that another window running behind MM.Net's browser window could be the entry point for a virus? With the way some web pages automatically refresh, could that be a possible explanation?

[silver_2000]

There are over 2000 unique visitors a day to MM.net - if the site were infected the number of people impacted would be WAY more than half a dozen.

Im willing to try to help, but so far there has been no details provided to help point to where the problem is. No screenshots, no logs, no thread numbers.

If you can tell me exactly how this is happening Ill try to reproduce it. I have an XP machine with no security software - if the infection is coming from here that PC would get it.

[Blk Mamba]

Had to flush mine this AM, second time in a week, couldn't get on MM.net at all yesterday, but could get on all other sites.

[silver_2000]

Question, Doug. If one has multiple windows open pointing to different websites, it is possible, that another window running behind MM.Net's browser window could be the entry point for a virus? With the way some web pages automatically refresh, could that be a possible explanation?

Mary
malware does exist that CAN infect sites that CAN push down a virus or malware to a pc with no user intervention. And yes it could have come from ANY site, once infected it will appear to impact many sites.

Its a very small possibility that the malware came from this site. Perhaps a thread contains words that generate specific malware infected Google Ads.
As I said before I need details to figure out what might or might not be happening. Ive sent a PM to matt offering some more options.

[guspech750]

I have had no issues except a few blocked attacks according to my antivirus while on MM.net the last couple of days. My lap top uses XP with Norton 360 and I also use Internet Explorer.

[silver_2000]

I have had no issues except a few blocked attacks according to my antivirus while on MM.net the last couple of days. My lap top uses XP with Norton 360 and I also use Internet Explorer.
Can you look at the norton logs and see what was blocked ?

[justbob]

Mary hard deleted a known infected page a couple weeks ago that infected a handfull of people who opened it on here. That is where I got my infection from, just as Matt, I never even check email more than once a month. Hope this helps someway.


Edit:
I run vista and Internet explorer, and microsoft security.

[-Matt-]

Seems to be when a crown vic discussion comes about.

[justbob]

Agree 100%

[CBT]

I have microsoft, windows xp, I run avast! and somethingsomething defender, and they flagged 180 threats/viruses in a 15 minute span before one shut me down. I don't think i was in a thread talking about cvn, tho. No biggie, just took a few hours to re-do everything. I wrote down 2 of them but it's at home right now.

[Mike]

I use Kaspersky Anti-Virus and I haven't had any trouble.

[SC Cheesehead]

Seems to be when a crown vic discussion comes about.


Agree 100%

Yup, was thinking the same thing. I think the last time I had an issue was in relation to a link posted for or by a CV guy. Not trying to stir the pot, but maybe somebody's got it in for us.

[justbob]

Mine were as follows:

Trojan:Win32/fakespypro
Trojan:Win32/fakespypro
TrojanDownloader:win32/Renos.KF
trojan:Win32/fakespypro
trojan:Win32/fakespypro
trojan:Win32/fakespypro
trojan:Win32/fakespypro
trojan:Win32/fakespypro
VirTool:JS/Obfuscator.D
Trojan:Win32/Alureon.CO
Trojan:JS/Redirector.E
Trojan:JS/Redirector.E
Trojan:JS/Redirector.E
Trojan:JS/Redirector.E
Trojan:JS/Redirector.E
Trojan:JS/Redirector.E
Trojan:JS/Redirector.E
Trojan:JS/Redirector.E

[-Matt-]

Did a safe mode boot scan and i think i cleared her up... running multiple back-up scans now

[silver_2000]

if anyone gets alerted to a specific thread here send me the thread URL in PM and Ill access it using XP machine with no security software on it

See if the sacrificial lamb gets slaughtered

[illwood]

I haven't had any problems using a dual boot XP/Vista laptop running the latest Firefox with AVG antivirus and the occasional Spybot S&D "Immunize" on the XP partition.

BTW, silver_2000 is your XP machine with no security a virtual machine? I'm just a curious computer geek.

[silver_2000]

BTW, silver_2000 is your XP machine with no security a virtual machine? I'm just a curious computer geek.

yes its a VM - specifically "XP Mode" VM running on Win 7

I could also run XP in VMWare fusion on my MAC but that would take work

Doug

Still looking for details of what happens on this site . Screen shots - URLs to "infected" threads

[Egon Spengler]

This is all jibberish to me!!! LOL

[tjl006]

Just finished removing the antispywaresoft virus whatever it is. I followed the bleedingcomputer.com tutorial. what a pain

[Ms. Denmark]

Just chiming in to say that our computor was attacked by a bogus antiviral software scam 2 days ago........right after we opened a pm from Doooooooom! :D (I'm sure it was a coincidence!) Anyway , our computor geek friend fixed it last night. We'll pick it up from him today. He recommends malware.

[Egon Spengler]

Just chiming in to say that our computor was attacked by a bogus antiviral software scam 2 days ago........right after we opened a pm from Doooooooom! :D (I'm sure it was a coincidence!) Anyway , our computor geek friend fixed it last night. We'll pick it up from him today. He recommends malware.
I got the anti viral software scam around christmas time. I had to buy a whole new hard drive! I did everything including erasing the hard drive and reloading everything and I still had to buy a new hard drive!

[justbob]

Doug, I highly doubt that you can retrieve this hard deleted thread, but this one here affected a few of us here. I had brought it to Mary's attention and she concurred and hard deleted it. Hope this helps.

http://www.mercurymarauder.net/forums/showthread.php?t=62461

[silver_2000]

Google indexes the site nearly daily - "clicking" on nearly every link to add it to the Google index - If MM.net was infected for as long as is claimed Google would know.

here is the results of the Google scan


Safe Browsing
Diagnostic page for mercurymarauder.net

What is the current listing status for mercurymarauder.net?

This site is not currently listed as suspicious.

What happened when Google visited this site?

Of the 3 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-04-28, and suspicious content was never found on this site within the past 90 days.



Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, mercurymarauder.net did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.
the results say 3 pages but that is misleading

[silver_2000]

Doug, I highly doubt that you can retrieve this hard deleted thread, but this one here affected a few of us here. I had brought it to Mary's attention and she concurred and hard deleted it. Hope this helps.

http://www.mercurymarauder.net/forums/showthread.php?t=62461

Thats the kind of detail I need BUT unfortunately its gone

im going to upgrade the forum this afternoon just to be sure

[silver_2000]

update done

[LeoVampire]

Nortons picked it up and aparently it was serious enough where it did an emergency shut down on my PC and performed a memory dump to protect it.

It says unauthorized access loged and it's target was actualy my Nortons security engine.

I do have windows XP Prof. but it is the Service pack 3 edition which is still suported by Microsoft and gets updates all of the time.

If you need any other info let me know.

[silver_2000]

Nortons picked it up and aparently it was serious enough where it did an emergency shut down on my PC and performed a memory dump to protect it.

It says unauthorized access loged and it's target was actualy my Nortons security engine.

I do have windows XP Prof. but it is the Service pack 3 edition which is still suported by Microsoft and gets updates all of the time.

If you need any other info let me know.
See attachment
Once mainstream support is over the OS becomes more vulnerable. They still offer security updates BUT those updates and the teams responsible are NOT the priority.
That and you are counting on an OS that was released 9 years ago to protect you from todays problems..

[LeoVampire]

See attachment
Once mainstream support is over the OS becomes more vulnerable. They still offer security updates BUT those updates and the teams responsible are NOT the priority.
That and you are counting on an OS that was released 9 years ago to protect you from todays problems..

Ya I know I should update just nervous about doing it because I have and play a lot of video games on the PC.

To do an upgrade to the newest windows is not an easy process for me due to what I have installed right now for an operating system. It has to be a full install so I have to find a way to safly move more than 100 games that take up more than 750 GB of storage space on my hard drive. Simple back ups won't cut it unfortunatly.

And I am not running the XP home edition as you indicated I have the Profesional edition.

[-Matt-]

All im saying silver is that most of the members that are getting hit are getting hit with the same "antispyware soft" virus.... it cant be just pure luck

[Vostok]

I just spent the last couple hours fighting this garbage.....

First thing I had to do to get it under control was to disable all the startup programs in "MSCONFIG" then reboot the computer.

Then it finally allowed me to run the proper scans to remove it.

[silver_2000]

All im saying silver is that most of the members that are getting hit are getting hit with the same "antispyware soft" virus.... it cant be just pure luck

~ 14 months ago the first versions of that program infected 30 million PCs. (http://arstechnica.com/security/news/2008/10/report-fake-antivirus-programs-claim-30-million-victims.ars)
30 million - thats a MONSTER number. Probably double that number by now - They all didnt come from one site or type of source.

I agree that its a tough coincidence. BUT the server this site runs on runs very tight firewall and security, and hosts about ~40 other websites that haven't been affected. 3 scans of the system have turned up no evidence of current infection on the server.

Ive offered to connect to peoples infected PCs and try to help clean them and determine root cause but so far we have no solid information that points to the source being here. It may be a malicious Google banner which would be nearly impossible to track down. Which is why Im begging people to give me solid details - screenshots - urls - something.

here is a link to Microsoft info on the problem (http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32/FakeSpypro)

there are over 3800 google links related to Win32/FakeSpypro - Its VERY common recently

[-Matt-]

Seems as if im either still fighting it or that im getting it over and over.... sigh

[Mr. Man]

We got torpedoed this week also. Had a friend do a fixer. He loaded the Malware program and so far so good. Lost all our quick links and now my screens are slightly different looking but will get used to them eventually. Wish I knew a lot about computers as I would reverse send a killer virus to the bastards who send these things out in the first place.

[Green96]

I was getting some alerts from Kaspersky as recently as a week ago while on mm.net, but nothing recently. I am running windows 7, Firefox, Kaspertsky internet security, and Adblock plus. I remember that the last time I got a warning here the add at the top was for the hitch company, but I do not think that was the problem because Kaspersky substitutes a red box in place of the infected add.

As I mentioned I have not gotten any warnings from mm.net this week, but I am getting a lot of adds on foxnews.com blocked by Kaspersky.

[dakslim]

Just had a pop up warning on my computer...I have AVG. No harm though.

[Ms. Denmark]

Me too. It was a red background with a warning statement that said something like ""mm.net had been reported to Microsoft as being corrupt and a security threat to this computer." all I was doing at the time was reading Dom's thread about band camp.:eek:

[MM03MOK]

PLEASE TAKE A SCREEN SHOT OF ANY WARNING NOTICE AND EMAIL IT TO ME.
Marauder03@comcast.net

[Ms. Denmark]

Sorry I didn't think of that Mary. I will now keep the camera next to the computer in case.

[silver_2000]

I was getting some alerts from Kaspersky as recently as a week ago while on mm.net, but nothing recently. I am running windows 7, Firefox, Kaspertsky internet security, and Adblock plus. I remember that the last time I got a warning here the add at the top was for the hitch company, but I do not think that was the problem because Kaspersky substitutes a red box in place of the infected add.

As I mentioned I have not gotten any warnings from mm.net this week, but I am getting a lot of adds on foxnews.com blocked by Kaspersky.

Thanks for the details - good start

Dont forget there is an ad at the bottom

As Mary Said please take a screen shot

[silver_2000]

Sorry I didn't think of that Mary. I will now keep the camera next to the computer in case.

Most keyboards have a prnt screen key
It copies the screen to the clipboard

Then just open an HTML email and paste the screenshot to an email

If you cant paste to en email paste it to a word doc then send the doc

Doug

[tjl006]

Would the report from malwarebytes help any?

[knine]

Sorry I didn't think of that Mary. I will now keep the camera next to the computer in case.
..........um, o.k. ..............:shake:

[MM03MOK]

Google ads turned off...

[Ms. Denmark]

Most keyboards have a prnt screen key
It copies the screen to the clipboard

Then just open an HTML email and paste the screenshot to an email

If you cant paste to en email paste it to a word doc then send the doc

Doug


..........um, o.k. ..............:shake::o.....:o .....:o..... It's the new thing I learned today.

[Ladyhawke]

:o.....:o.....:o..... It's the new thing I learned today.

Every day should be a learning experience. ;)

[silver_2000]

Would the report from malwarebytes help any?

yes - depending on the level of detail

send me a PM or Mary

[martyo]

I got this too and have not been able to irradicate it.

I am shipping the computer to my tech.

What a mess.

[TooManyFords]

Here's my secret weapon to fix infected computers:

http://dlpro.antivir.com/package/rescue_system/common/en/rescue_system-common-en.iso

Download this, burn the ISO to a CD and boot from it. This will clean everything. The reason this works is because most of the harmful junk out there are due to Root Kits that infect Windows at such a low level that other scanners, and even Windows itself, cannot see them on the drive. If the other programs cannot see them, they cannot clean them up.

Because this is based on a Linux kernel and runs entirely from the CD, there is no chance for the root kits to be loaded and hide from it. It will do a complete scan and clean and you're ready to update your current antivirus program in Windows and move on.

But I have to say, if you're not running Microsoft Security Essentials (FREE), you are wasting time and money.

If you do decide to use this, a couple things you should know. 1. The default is non-English prompts, so click on the British flag at the bottom of the screen so you can read the prompts. 2. Before scanning, on the configuration screen, set the option to clean the infections and rename them if it cannot remove them. It will rename all the files it finds with the ".XXX" extension so you can remove them from Windows later.

[silver_2000]

Here's my secret weapon to fix infected computers:

http://dlpro.antivir.com/package/rescue_system/common/en/rescue_system-common-en.iso

Download this, burn the ISO to a CD and boot from it. This will clean everything. The reason this works is because most of the harmful junk out there are due to Root Kits that infect Windows at such a low level that other scanners, and even Windows itself, cannot see them on the drive. If the other programs cannot see them, they cannot clean them up.

Because this is based on a Linux kernel and runs entirely from the CD, there is no chance for the root kits to be loaded and hide from it. It will do a complete scan and clean and you're ready to update your current antivirus program in Windows and move on.

But I have to say, if you're not running Microsoft Security Essentials (FREE), you are wasting time and money.

If you do decide to use this, a couple things you should know. 1. The default is non-English prompts, so click on the British flag at the bottom of the screen so you can read the prompts. 2. Before scanning, on the configuration screen, set the option to clean the infections and rename them if it cannot remove them. It will rename all the files it finds with the ".XXX" extension so you can remove them from Windows later.

Thats a great Idea - the users will need to a CD writer and the software to burn a CD from an ISO - and likely a uninfected machine to do that ...

Here is Kapersky antiviruses version of the same kind of disk (http://bosshelp.com/tools/kav_rescue_2008.iso) -( from my tools site ) no language problems with it

[TooManyFords]

If they use this link: http://www.avira.com/en/support/support_downloads.html
There is a version of the Avira AntiVir Rescue System that is the executable (shows the square program icon to the right) that is the same as the ISO that also will burn the CD itself, no other PC or software required.

I did not link it directly because of the .exe extension.

[Blackened300a]

Sorry I didn't think of that Mary. I will now keep the camera next to the computer in case.

Paula, another easy way is to press "Print screen" then open up windows "Paint" and press "Ctrl V" It will put the picture into the screen and you can edit it if need be.
I have a netbook running windows XP with a basic AVG anti-virus and not a single issue. My home PC runs windows XP and I use a ad-blocker through firefox and never had a single issue with this site. Something had to be linked and then clicked that messed you guys up.

[MM03MOK]

Bumping this thread....remember to take a screen shot "Prt Scr" of your screen when you get a virus warning. Mail the picture to me and also tell me what other browser windows you have open at that time and anything else you might have been doing. Google ads are still turned off. We can't find any problem unless we get details.

[justbob]

So far, everything with mine is good Mary.

[Dennis Reinhart]

AS many of you know several months back, I got a note on face book from a trusted friend, I clicked on the link and instantly my virus alert quarantine the Trojan horse, but not before coping my address book, and sending email to every person on in it. That will not happen again, now recently I have started getting emails from known friends, and in the body there is a link, and nothing else, this is a dead give away NEVER click on a link like this. So I replied to all and told them it was a virus, this last person was a member here so I called him and he said he contracted it here by clicking on it here, so I thought I would pass this on I know Mary is real sharp on this, and I cannot see it happening here, he must have got it some place else.

[MM03MOK]

Our website is scanned weekly. Last night's scan showed no suspicious items or viruses. It's not MM.Net that's infecting anyone's computer. It behoves everyone to pay attention to their virus and malware program updates. I know McAfee looks to download updates multiple times a day. Do not ignore those updates. For as fast as there are updates, there are new viruses being created.

[Dennis Reinhart]

Our website is scanned weekly. Last night's scan showed no suspicious items or viruses. It's not MM.Net that's infecting anyone's computer. It behoves everyone to pay attention to their virus and malware program updates. I know McAfee looks to download updates multiple times a day. Do not ignore those updates. For as fast as there are updates, there are new viruses being created.


I agree Mary, the member did save his computer and I told him I have never seen a virus here.

[Donny Carlson]

It could be a coincidence, but two of the Challenger boards also have this thread, with people getting warnings about the websites. There was some speculation it could be malware in an advertisment, but FWIW, my McAfee never showed a warning on those boards, or here.

[silver_2000]

Most recent report of problem showed THAT issue was related to in infected PDF file. (Mal / PDFJs-P) Make sure you are running a CURRENT version of Adobe reader. And as always dont dload PDFs from people you dont know

[silver_2000]

Another thing that would be VERY helpful is to see the Page Source.

On any web page in any browser there is a source page that shows all the code the server sent to the browser. That would be proof positive of the cause of he problems.

In most major browsers you can simply right click the page and choose view source or view page source - that will open a new window with a bunch of text

email or PM Mary or myself the text file that results

for example the first few lines of the source for the page that Im currently using to post this is:


DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en">
head>
meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />
meta name="generator" content="vBulletin 3.8.5" />


You can see it will look like gibberish - But it will be helpful