FFXIAH virus warning

[ubermonkey]

Not sure if this is old(ish) news, but I didn't see anything on the front page of advanced, so it's worth any flames I might eat to warn anyone who isn't aware of it...

Went to FFXIAH about 20 mins ago and got hit with an auto downloading popup dealie. Downloaded This (spywareguide link). I'm unsure if it's done anything else but AVG isn't picking up anything more, and I've yet to check with anything else.

Thought I'd spread the word though.

[Zarath]

What was it exactly <<?

[Allundaria]

I'm going to venture a guess and say you were using Firefox, and the "malware" popped up a bunch of windows that looked like system windows that didn't let you close them and kept saying your system was infected and that you should buy some kind of computer cleaning software.

[ubermonkey]

A popup that DLed the program listed in the link above, and a couple of trojans, looks like.

AVG appears to have failed to remove one of the trojans (wavvsnet.exe) since it's showing up on a second scan.

I'm going to venture a guess and say you were using Firefox, and the "malware" popped up a bunch of windows that looked like system windows that didn't let you close them and kept saying your system was infected and that you should buy some kind of computer cleaning software.

I'm not using firefox, but basically correct.

[Allundaria]

Hmm interesting, it's not the same banner ad exploit I'm thinking of then :bagel:

[Shadowhusky]

A popup that DLed the program listed in the link above, and a couple of trojans, looks like.

AVG appears to have failed to remove one of the trojans (wavvsnet.exe) since it's showing up on a second scan.

I'm going to venture a guess and say you were using Firefox, and the "malware" popped up a bunch of windows that looked like system windows that didn't let you close them and kept saying your system was infected and that you should buy some kind of computer cleaning software.

I'm not using firefox, but basically correct.

Inb4 IE sucks. Use firefox, adblock, noscript, etc.

Edit: I just searched my computer and nothing of that sort comes up. Though I'm not using any antivirus, I know what I'm doing online. Using firefox, adblock, noscript. Have visted ffxiah multiple times and no problems.

[Guyverarmor]

same here, use Firefox with adblock and noscript and have visited FFXIAH 10times in past 2 days, nothing has popped up on AVG or Windows defender



















lolIE :rocl:

[Attila]

All the same, if someone knows how to contact the FFXIAH guys directly, now might be a good time to do so.

[Aikar]

I'm going to venture a guess and say you were using Firefox, and the "malware" popped up a bunch of windows that looked like system windows that didn't let you close them and kept saying your system was infected and that you should buy some kind of computer cleaning software.

I think you meant to say 'using IE' ?

And I sent cliff an IM.

[Jeny]

I'm going to venture a guess and say you were using Firefox, and the "malware" popped up a bunch of windows that looked like system windows that didn't let you close them and kept saying your system was infected and that you should buy some kind of computer cleaning software.

I think you meant to say 'using IE' ?

And I sent cliff an IM.

Were you able to get a hold of him?

[Spira]

hmm.. my mcafee picked up some virus thing today too and it was after visiting FFXI AH today.. I didn't think the 2 events were interlinked.. but i suppose they are.

[Quizno]

I'm using IE and I had Norton block what it referred to as "worms" several times yesterday.

I don't know jack about computers other than e-mail and excel, so forgive my ignorance of the term.

Anyways, it does seem to be related to one ad or set of ads. I would get the warning that an intrusion was blocked only some of the time and it would generally happen two times in a row if I went to a page, left, and then hit "back".

[Scragg]

AVSystemCare is rogue antispyware. It's not new and it's exactly the thing from before. It is just hard to block because it compromises other ad campaigns and we can only contact the adhost about it. If you're on IE, it'll try to install adware/spyware then recommend you download their product to fix it. On Firefox, it'll probably just ask you to install it. Just hit the x (close) button for dialog boxes.

[Conrad]

You know what, I got a "Virus attempt blocked" from Norton last night while on FFXIAH.

Seems like this is legitimate, would suggest no one uses FFXIAH right now :x

[Rags]

I visited the site late last night and didn't get any attempts to compromise my system. This mornings AVG run shows nothing on my system as well.

I guess Firefoxs adblock, noscript did its job.

[kuronosan]

Fuck this garbage, where's our version update update?

[AzazaelFenrir]

site should be safe

[11:36] <@scragg_> anyone know which ad it was
[11:40] <@scragg_> I just banned all flash ads from one network, shotting in the dark though


Let them know which ad it is (post here) if you can.

[Seditedi]

You know what, I got a "Virus attempt blocked" from Norton last night while on FFXIAH.

Seems like this is legitimate, would suggest no one uses Microsoft Internet Explorer anymore

FIXED!

[Olo401]

Just checked it out on my work computer deliberately using IE - Didn't see any popups, no activity on Norton, visually looked for the little hidden IFRAME box and checked the IFRAME references in the page source and didn't find anything malicious.

I think they caught this one and removed it already.

[Aymee]

same here, use Firefox with adblock and noscript and have visited FFXIAH 10times in past 2 days, nothing has popped up on AVG or Windows defender

I feel kinda dirty saying it, but Defender isn't 100% suck. Stacked with spybot and norton I'm ALMOST confident enough to use IE on my new pc. ...Almost. Key being, that's IE and you're using Firefox. I know a few people who work for Microsoft and even they admit IE is a deathtrap in comparison, and having Firefox on your office pc is like the ultimate corporate taboo