Possible Malware in FFXI Atlas Vana'diel Bestiary section

[Aselin]

Possible Malware in FFXI Atlas Vana'diel Bestiary section

Infected URL: http://monsters.ffxi-atlas.com/monsters/?id=

The "id" variable must be followed with a 4-digit numerical id linking to the monster you are looking for that will bring up the warning in Avast. Example: "?id=2564" or "?id=1145" will bring up the warning. At the moment, I can't really verify if this is a false positive or not, but be careful if you are visiting that website for now.

Searching for monsters there will bring up the following warning in Avast:
http://killingifrit.com/forums/uploa...1245430815.jpg

The website seems to be infected (again), and even with NoScript and AdBlock enabled, the page will still open. You will need an antivirus program such as Avast or AVG, and possibly Antivir with active, real-time link scanning.

AVG offers a standalone link scanner here: Safe internet surfing with AVG LinkScanner - Home

Notes:
- AVG's link scanning software may make certain websites unable to load properly
- Link scanning does give a slight decrease in speed in loading web pages as each URL is scanned before being sent to the browser

==================================================

I cannot verify this 100% but seeing that this is possibly the second time this happened to FFXI Atlas, it's best to be cautious for now. A lot of us know from experience what happened when players' computers were infected and lost their accounts due to being keylogged/hacked.

So, until this is proven to be a false positive or not, again be careful on visiting the Vana'diel Bestiary section of FFXI Atlas.

[Not Kuno]

I'm pretty sure this site has had stuff like this going on for quite a while. Though it was cleaned up though, but like somepage, don't even go anywhere near it.

[Pikarya]

Avoid it like the plague, along with somepage. Those websites are rarely ever checked on a constant schedule by the admins.

[byte]

I'm pretty sure this site has had stuff like this going on for quite a while. Though it was cleaned up though, but like somepage, don't even go anywhere near it.

This. I really don't understand why people insist on sticking with these crappy sites when there's so many alternatives lol. And I know there's some people that still use somepage. I mean really... /facepalm. It's just asking for it.

[Aselin]

I've put somepage.com on my blacklist a long, long time ago. Page won't load unless I allow it.

I only go to Vana'diel Bestiary section to find viable XP party spots since Campsitarus-- The guide to FFXI xp camps! ^^ doesn't show spots I can solo, duo or trio in.

They have a nice feature where you can enter party size and expected experience points per kill. This is the first time Avast red flagged this site.

And, yes, I've scanned my computer. Thankfully, it's clean.

[Mayareira]

Somepage is being visited by clueless people mainly because its a quite popular google search return. Less-experienced users are the main target of malwares anyway.
Same with atlas. Type in ffxi map and bam, first result in google.

[terranova]

I use a site that most people probably have forgotten about that's still pretty useful for me.

Besides I stopped using atlas 2 years ago because of this.

[Ksandra]

This. I really don't understand why people insist on sticking with these crappy sites when there's so many alternatives lol. And I know there's some people that still use somepage. I mean really... /facepalm. It's just asking for it.

because no one has yet to give the awesomeness that is somepage's search function. It's sad we can't go there anymore ;;

[Pikarya]

I personally don't see why the site owner just doesn't hand over the shit to someone who will take care of it. I will agree, it does have a very nice search tool.

[millionsknives]

Just to clarify, is this just in the bestiary section and not in the maps?

[Aselin]

Just the Bestiary section.

I got the warning pop up when I did the EXP Mob Search, a feature I wish another website had it or even Campsitaru.

Anyway, after searching for monsters to EXP off of, you will get a list of monsters per usual in the search results. Clicking any of the monsters brings up that Avast warning window.

Therefore, it's anything and all tied to a single PHP file that displays the monsters stats, if you try to open it up.

For example, let's say you click on a monster in the search results and the URL is:
Vana'diel Bestiary - Stray

http://monsters.ffxi-atlas.com/monsters/?id=2156

... if I click it, Avast throws up a warning about finding "HTML: script-inf" virus on that particular page.

EDIT: DON'T CLICK THAT URL. IT'S ONLY MEANT TO BE AN EXAMPLE.

EDIT #2: It seems BG Forums auto-formats the Bestiary URL and concatenates it into what the URL links to. You may want to change that...

[Aselin]

And, just clicking it now, brought up Avast again. Also, if you look up at the screenshot above, it's identity was based on the most recent virus definition update-- June 18, 2009.