FFXIAH virus warning

[Tobatobu]

This was likely another case of a random ad in their add pool have malware code. It has happened on their site in the past, as well as Allakazam a couple years back.


A few recommendations for everyone:

• Protect yourself as others have already mentioned in this thread. Any website, even those that you trust, has the possibilty of rotating ads on that page, or malware being injected by a tactful hacker.[/*:m:3rhkbqnb]
• To make this clear, I currently work on a number of websites. If I was using rotating ads, I wouldn't even trust my own page. No page is safe.[/*:m:3rhkbqnb]
• Playonline currently uses your primary login to two log ins. Make sure these are different and use a combination of uppercase, lowercase and numbers. Store one login, type the other.[/*:m:3rhkbqnb]
• By storing one, and typing the other each time, you prevent your computer from being hit by a standard key-logger or a standard FFXI password grabber; they can get one or the other. An advanced trojan and could contain both these methods of password retrieval.[/*:m:3rhkbqnb]
• Don't share your accounts! You may trust your friends and family, but do you trust the websites they visit?[/*:m:3rhkbqnb]
• Open up Task Manager on your computer, using CTRL-ALT-DEL. Write down in a seperate file any processes that are open. Use Google to try identify each of these personally, in order to understand which are safe, and which programs they belong two. Then when your computer is running slower, compare the active list against the one you saved. (Update your list if you update/install new software)[/*:m:3rhkbqnb]

Finally, a bit on the paranoid side, but I rather be paranoid, then see friends loose their gear.
If you notice your computer is running differently, slower, getting pop ups, or you located a virus:

• One Virus or malware, can download more. Make sure the infection is gone before continuing.[/*:m:3rhkbqnb]
• Always keep your virus scanner and malware scanners up to date. If your antivirus has expired, you are at risk.[/*:m:3rhkbqnb]
• Do thorough scan, not just the quick scan, with heuristics ON! (This is able to find new viruses)[/*:m:3rhkbqnb]

I used to do Tech Support for a living, and the most common problem anyone had was a slow computer. More often than not, it was just caused by outdated definitions and someone thick headed web surfer who thought having a Virus scanner installed was enough to protect them.

My Recommendations for Virus Scanners / Trojan Detectors (I know everyone has their own list)

• Mcafee Command Line Scanner[/*:m:3rhkbqnb]
• AvG[/*:m:3rhkbqnb]
• Ad-aware[/*:m:3rhkbqnb]
• Spybot Search & Destory[/*:m:3rhkbqnb]
• CWShredder - Cool Web Search Web Hijaack remover.[/*:m:3rhkbqnb]

[Conrad]

You know what, I got a "Virus attempt blocked" from Norton last night while on FFXIAH.

Seems like this is legitimate, would suggest no one uses Microsoft Internet Explorer anymore

FIXED!

Hi, I use Firefox.

Though I do agree with your statement :bagel:

[Darus Grey]

I also use firefox with noscript and AVG does a virusblocked every so often on ffxiah last couple days. They're diversifying their exploits it seems.

[Vivify]

Can someone using Firefox with Noscript and Adblock please post their settings? When I visit FFXIAH with this browser, I can look up items but the price history won't show, and the server resets to Bahamut every time.

[Aikar]

http://www.windower.net/forums/viewtopic.php?t=11323

Use FlashBlock too!

And above poster, follow the guide i just linked, itll teach you how to use noscript.

[Vivify]

Thanks Aikar, I'll look into FlashBlock, but setting up Noscript was not my problem.

FFXIAH does not function properly (as in showing price history and not resetting the server to default Bahamut), unless I add the domain to the Noscript whitelist, which pretty much defeats the purpose of viewing FFXI related websites without jeopardising my POL account info.

So, I need to know from someone who uses Noscript and is able to view FFXIAH properly without putting it on the whitelist, which boxes do you have checked and unchecked?

[Doofus]

I'm not a computer expert by any stretch of the imagination, but I have been using noscript for awhile and if I understand it correctly, the point is you can allow sites that you trust but still keep the ad sites themselves blocked without doing any harm? Someone correct me if i am wrong

Like i know parts of Mininova's search function won't work if you don't have the domain on the whitelist, but I still have all the ad sites blocked.
I assume the same is true for FFXIAH

[OctavoGilgamesh]

Well this won't protect you if a site gets hacked and malicious code is added, but a good way to block rotating ads from websites and protecting yourself from the possible rogue ad is to add the ad domain to your etc/hosts file and point it at yourself.

I.E.
127.0.0.1 ads.fleckz.com

Adding that line to the end of your etc/hosts file will disable the current rotating ads host from ffxiah.com. Since I often surf at work and want to keep my screen looking acceptable in a business environment, I pretty much have done this for any and all ad sites that host porn or any ads I deem possibly offensive to my boss or others who might walk by while I am slacking at work.

the hosts file is located in the root drive of your windows pc, usually C:.
C:\windows\system 32\drivers\etc\hosts

Open the file in notepad and add whatever site you don't want to see to the end of the file, each in a new line.

[Septimus]

http://www.windower.net/forums/viewtopic.php?t=11323

Use FlashBlock too!

And above poster, follow the guide i just linked, itll teach you how to use noscript.

Don't forget to add http://www.bluegartr.com to your flashblock whitelist. I personally wrote all of the flash for the main page, if anyone tries to put something malicious into them I will hunt them down and injure them severly.

[Tagus]

This just happened to me while i was on ffxiah.com..... I would suggest staying away from the site for the time being.

[HadesChubbs]

nice necro

Bet you just scared a hundred or so people who dont read dates of post

[Silenka]

Or maybe instead of making a new thread he used an old one because the virus is back?

???

>.>

I didn't get nothin', firefox+noscript+adblock etc

[HadesChubbs]

Or maybe instead of making a new thread he used an old one because the virus is back?

???

>.>

I didn't get nothin', firefox+noscript+adblock etc

Why use an old one? New problem new thread! Plus, he didnt describe what happened, just said "this". Then recommended we stay away from a site that most of us use daily.

[Spekkio]

would help for the "op" to indicate if it's a banner ad or embedded in the site where the attack is since ffxiah requires whitelisting in noscript to function and would be a threat if it's in the site, but no threat if it's an ad.

[Souj]

nice necro

Bet you just scared a hundred or so people who dont read dates of post

would help for the "op" to indicate if it's a banner ad or embedded in the site where the attack is since ffxiah requires whitelisting in noscript to function and would be a threat if it's in the site, but no threat if it's an ad.

I lol'd

[ShuttleXpC]

Not getting anything on my Firefox+NoScript+AdBlock, I even went on my laptop without a FFXI install or any FFXI info stored using IE and nothing came up on Kaspersky when I went to multiple pages of the site.

[altwight]

when you guys use noscript on FFXIAH do you allow FFXIAH?

[ShuttleXpC]

when you guys use noscript on FFXIAH do you allow FFXIAH?

Even if they did, it doesn't allow other sites that you haven't added into NoScript yet. Which is why NoScript is so nice, you can allow certain elements of each site while blocking others.

[Gulkeeva]

I block all sites, none are on favorites.

Not always is a "script injection" directing to another site, it could be implanted on that site itself.. the trojan/virus to bypass stuff like that.

Like.. if a virus trojan was on this site, or my site, or ffxidats etc etc.. and someone had those sites on their whitelist for something like noscript.. you'd get owned and never know it ;/
I pretty much have every site java/flash/iframe etc blocked

[Tagus]

Why use an old one? New problem new thread! Plus, he didnt describe what happened, just said "this". Then recommended we stay away from a site that most of us use daily.

I'm really sorry! I didn't realize that you guys were so fucking stupid that by using the word "this" to describe an event that happened in a thread called "FFXIAH virus warning", you wouldn't be intelligent enough to realize that I received a virus warning on FFXIAH. Next time I'll be sure to start a new thread, so I can get flamed there for starting a new thread on a subject that's already been covered.