virus?

[GuGu]

okay, it's been happening for over a month now. at first i thought it was just my home computer but it's happening at work too. when i click on a link to a thread or something on spcnet it re-directs me to a totally different site! it's so annoying! like a few minutes ago i clicked on the thread and i was sent to an online interviewing site. i didn't want to complain so i let it go before but it's happening more often now. is there something wrong with my computers? and like i said it's also happening at work. anyone else experiencing this?

[expression]

Exactly the same happened to me, been a month.

I was infected by the sticky Vundo. Neither Norton nor Symentec seem to work. Finally got rid of it by Malwarebytes. You can download a free version of it. Make sure you disable System Restore (where Vundo hides) before scanning in Save Mode. I now subscribe to the real-time protect version of malwarebytes.

A week ago I got a virus alert the moment I logged on to spcnet. Luckily the program seem to have blocked it. I'm quite sure Spcnet's been hacked.

[Bubblegum]

Today I had a similar issue the moment I replied to a topic, but thankfully my browser had blocked whatever site it was, and redirected me to this warning page:

http://i15.photobucket.com/albums/a3...ty/warning.png

It's only the first time I've come across such an issue here.

It would be useful to take screen captures of any problems you might find.

[GuGu]

if it's a virus then how come it doesn't affect the other sites i visit? it only happens when i'm on spcnet. is the virus only 'active' on spcnet?

[expression]

Vundo, the virus/trojan I got, supposedly causes more damage to XP than Vista. Both my personal laptop (Vista) and ahem... office computer (XP) got infected. My laptop still functions except for some annoying pop-ups. My office computer went completely wonky and they ended up wiping it and reconfiguring the whole thing... No way I'll go on Spcnet again at work.

Vundo has an initial downloader component that automatically downloads pop-ups as well as other viruses, so the harm can accumulate... maybe certain firewalls/protection programs blocked many of these to keep some computers going while XP was especially vulnerable to most of these stuff.

These seem to be consistent with the theory that someone got their dirty hands on Spcnet.

[spcnet]

Please post here if it happens again. We highly suspect it's from an ad that's getting served up from our ad networks and trying to work it out. If it happens again, we'll disable all the ads and investigate one by one.

[GuGu]

i didn't mean to trouble you at all spcnet. sorry if my complaint got you to investigate.

but it's been good today. i haven't been sent anywhere else when i come here. GOOD JOB!

[remember_Cedric]

Please post here if it happens again. We highly suspect it's from an ad that's getting served up from our ad networks and trying to work it out. If it happens again, we'll disable all the ads and investigate one by one.

Hi SC, I've come across a few dodgy ads which I did not know if it is supposed to be in the site. I could name a few:-

1) "Click here to apply for American Greencard"
2) "You have 1 message." (sometimes it appears like some sort of "love message" from secret admirer)
3) "Click here for free Screen saver"

Not sure if that would help. Hope it does.

[expression]

I got that Green Card thing too.

[spcnet]

Thanks those ads are concerning too. We're trying to filter those out, so please continue posting concerns. The most concerning of course are the pop-ups, redirect and trojans. We're trying to get to the bottom of that ASAP.

[remember_Cedric]

Hi SC, speaking of the devil, I've just caught a screenshot of 3 potential parasite ads, which I've mentioned.

One, being the "secret admirer" message, and the other 2 being the "US Greencard application". Msge1 looks very dodgy to me.

Hope this helps!

[GuGu]

Hi SC, speaking of the devil, I've just caught a screenshot of 3 potential parasite ads, which I've mentioned.

One, being the "secret admirer" message, and the other 2 being the "US Greencard application". Msge1 looks very dodgy to me.

Hope this helps!

those are just banner advertisements they don't actually take over your whole screen or divert you to another site like how it was doing to my computers. i think those are safe as long as you don't click on them. most sites do have those advertisements on the page to generate profit for the site.

[remember_Cedric]

those are just banner advertisements they don't actually take over your whole screen or divert you to another site like how it was doing to my computers. i think those are safe as long as you don't click on them. most sites do have those advertisements on the page to generate profit for the site.

Aha! Ok! I may be no IT expert but I was in a mass of thought like CSI, any suspect can possibly be the "Killer". Anyone appeared at the criminal scene is a suspect (when "the murder take place", that is). And, in this case, we wouldn't want to give chances of having a trojan or such attaching to an ad using it as a decoy.

[Lianazhu]

Please post here if it happens again. We highly suspect it's from an ad that's getting served up from our ad networks and trying to work it out. If it happens again, we'll disable all the ads and investigate one by one.

I have avast firewall and antivirus software and each time I try to vist spcent (the site as a whole not just the forums) it goes insane with warnings of malware or trojans trying to get into my machine. Its been doing it almost a week now. Aside from avast I also have MBAM, Spybot S&D, Hijackthis, Zone Alarm, and lastly a new one called Exterminate-It (which strongly reminds me of Dr Who) Since i'm currently broke I have no way of professionally cleaning this machine I have here at home. However advice was given to me when using Exterminate-It and so far so good I guess.

Several of Avasts warnings were from a few ads, this is just a few of the ones I could remember off the top of my head

• The speaking ad saying "congratualtions, you won" and the ad is flashing
  
  • Avast warns ofi a trojan trying to access my machine when the voice is going off
• the "you have a new message" as saying a fake dating site (two fake dating sites were IDed not too long ago, one of them was match.com, or a replacement thereof)
  
  • Avast goes off warning of a exploit
  • Spcnet as a whole also slows to the speed of a fallen apple at the same time (it continuesly relaods the page so the ad can load)
• Any flashing ad saying "this is not a joke you are visitor number XXXXXX"
  
  • Zone Alarm warns of an exploit
  • Avast warns of an exploit, also a trojan

Exterminate-It however helps in cleaning the main resident areas where the virus might go to hidfe (the compy registry itself) So far I have been able to keep my computer cleanafter i had downloaded it and used it as a guide to find and kill off the fake keys the virus made. (my machine is XP Pro)

Hope this helps
~Lianazhu

PS: It also took me almost half an hour just ot get to this thread alone because of the constant reloading of the ads I mentioned above

[GuGu]

it's happening again to me too! in the last 2-3 days the site just freezes up my whole computer that i can't even exit it. the bottom of the page where the links display go crazy and keep flashing like it's opening hundreds of pages at a time. then eventually my firewall pops up and tells me your site is not safe. what's going on?

[spcnet]

We have just disabled one of the suspected ad networks. Please let me know if you continue seeing issues. Again, this problem is very difficult to pinpoint, so I appreciate your help and patience.

[Lianazhu]

As of right now the only ad at this time is for YesAsia, avast and zone alarm are both quiet however both scanned thesite even when I wass broswing there, I think that is he only safe site for ads from to here I guess.

Another ad the popped up was a free ringtones ad, avast scanned it and found an exploit, zone alarm found the same. The "Make Money Now" ads also sned both gouing nuts as well

Only ads that don;t set off alarms are from YesAsia or relevant sites thereof

[GuGu]

it's doing fine today. no screen has been frozen! ^_^

[Yeung Gor]

It happened just a few minutes ago. It tries to redirect my browser to some unknown site but my security blocks it as malware. It has happen a few times before that...

[spcnet]

Thanks for posting. We have disabled another of the possible culprits. Let me know if you see anymore. Thanks!