Error message/ virus

I have had several members complain of virus issues on my site over the past few days.

Here is a post by one of those users:

While I haven't had any problems visiting that site in the past, yesterday I took a peek, and both of my virus detectors went off. There are some serious virus's there. A couple of different kinds of Trojan's,

rootkit-Agent DM,
Downloader.zlob.AKF
Adload_R.HW
Injector.CD

and a virus called win32/heur.

So far, they are only in my temporary internet files, but the adware on that site appears to be malicious. I am running top and low level scans on that computer now.

Can someone who is over at that board contact the webmaster and let him know? And then check your computer?

And my apologies to any who have had problems from malicious adware due to that site. I had no intention of causing that!

fordfans.forumotion.com

Do you know what could be causing these viruses and/or how to correct the problem?

Thanks.

I can't answer your questions, but I am very glad to see this subject mentioned.

Three members of our forum have had their computers BADLY brought down by this very malicious virus... every one of the three had to wipe and re-format their hard-drives. Not good... not good at all. It seems to have been a trojan masquerading as a virus protection!

My question is this: What is ForuMotion doing to protect itself from any further attacks? I would really love to hear from a ForuMotion representative about this.

Thank you for your time. Our forum members need some reassurance.

I have never seen such a complaint, of virus attacks. Also on visiting your site, my virus scan(updated everyday) never detected anything. To recheck my notion, i used my bro's laptop who has a different antivirus still nothing. There is nothing wrong with forumotion, or virus attacks due to forumotion.

I'm also having similar issues with the ads on my forumotion site redirecting members and causing their anti-virus software to take action. I went on the site as a guest and my anti-virus flagged this.



As you can imagine, this is quite disturbing for me considering I'm trying to encourage new membership and if my guests are redirected - or think they have entered a site full of virus activity...why join my site?

Otherwise I'm extremely happy with the site hosting. Could the ad activation be allowing malicious sites to post their adware on my site? Can I screen this somehow?

Thanks,

Garmar.

Sanket wrote:There is nothing wrong with forumotion, or virus attacks due to forumotion.

Sanket, I appreciate your confidence, and I also appreciate your reply. However, the fact of the matter is that there ARE malicious pop-ups originating from individual ForuMotion sites. I really would appreciate someone in security at your site looking into this matter and getting back to us as soon as possible.

I would also like to note that a couple of the forum members who were attacked/infected were using a much safer browser than Internet Explorer (Firefox, in fact) which is much more difficult to hit, being very prudent at blocking pop-ups and recognizing threats.

We have forum members waiting for the word that all is well.

Garmar, thank you for posting your experience also.

Garmar, can your provide your forumotion URL. Let me check it on my bro's laptop which does have Norton(Updated) if it too has the same error.

whatzit I seriously am confident, that there are no pop-up ads on forumotion.

Sanket wrote:I seriously am confident, that there are no pop-up ads on forumotion.

You can have full confidence that there are no PAID pop-up ads on ForuMotion, but that does not include the malicious intrusive viral pop-ups that did NOT arrange with admins to be there. I assure you, these exist. I have been on three different ForuMotion forums over the past two years or so, and I have never seen anything like this problem before. I too, am shocked and dismayed.

If you would like more information (specifics) about our situation, please PM me, as ours is not a public site.

Thank you for looking into this.

we've had complaints on our site too, about possible viruses, spyware and trojan horses

http://bleachsociety.motionforum.net

Just "warnings" in the sponsors/ads thing, and one member says the screen of her anti-virus goes red for a split second when she clicks sends on PMs

I personally never had problems on the forum, with AVG anti-virus, but that's maybe because it isnt the best anti-virus in the world ^^;;

whatzit, its upto you if you want me to check it or not.

Kumiko, sorry but i don't find anything.

Sanket wrote:Garmar, can your provide your forumotion URL. Let me check it on my bro's laptop which does have Norton(Updated) if it too has the same error.

http://review-group.forumotion.com/index.htm

I didn't post it originally because I wasn't sure if it was against forum rules.

It is an intermittent problem. I run Firefox also and I get redirected when I go to my site sometimes. Several of my members have sent me a PM about this issue also.

Thanks,

Garmar.

Garmar, glad you waited before posting the link.

I don't see any warning by my virus scan. Don't really see a problem.

This is a very odd issue. Is it possible that some of the Google Ads at the top of my screen contain malicious programs? I just went on and no problems. Like I said - it's intermittent. I've been to sites before that redirected you as soon as the page loaded and one thing in common was the Google ads running.

I appreciate you looking in to this. Is there any way for me to screen out malware from my site? Like the firewall on my computer, but for the website? To be frank, I'm worried that some new malware from one of those ads has infected my computer and the computers of my other members. Because Firefox should not be allowing the redirecting and pop-ups since I have these set up to filter out such problems. Thankfully my anti-virus caught the attack this morning.

Thanks,

Garmar.

Edit: note that the ads change periodically, so the problem exists some times and not others.

Thank you for having checked out my site.

I'll say like Gramar: The ads change/rotate, so not all ads may do this, but one in particular does. Seeing it's google ads, it has to be a problem that google can look into it too.

I'm not an expert, but I still wanted to share my opinion if you guys can do anything about it ^^;

And to top it off, I'm getting posts like this from members. Received less than 15 minutes ago.

Actually, my computer has frozen up completely on more than one occasion when this site attempted to impose popups . . . one of which has a guy shouting at me through my speakers!

If I was not a strong supporter of you, Gary, I would not return to this site. It's just too scary and intrusive, especially knowing that there is a major new virus set to trigger on April Fools day. If possible, I'd find another server/arrangement.

Tell your server company that!

Personally, I don't think it is a server issue. I think it's more an issue of the Google screening process. I have had seven members that complained to me about this that haven't come back.

What we have here is basically like when you hear a strange noise coming from your car and take it to the mechanic - and guess what? It doesn't do what it was doing anymore. The mechanic has to make more than one pass at it to catch the offending noise (malware) in the act.

If there is a way to deal with this I'd very much appreciate it. With only 21 members and about 6 or 7 active (and that's declining) I can't afford such problems. Picture if your friend sent you a link to a site and the first thing to happen was it activated your antivirus software or redirected you to a different site. What would you do? I highly doubt coming back or spending much time there would be high on your list of things to do.

Garmar.

All i can suggest you is keep your anti virus updated every time. I personally, have never faced an issue like this. Also, if you could find out any other info on this like some information of the source, you can PM me about it.

I'm sorry. this is an issue I don't want to let go because it's important. I'm quoting some people on my forum. It's in the headline section, so I'm not making this up.

Hoshi wrote:i've noticed a bit of something at times. i use site advisor on my home computer. sometimes the little thing turns red for a second (warning about spyware and such) before turning back to green. if there are viruses on this system, it's in the split second screens that pop up after you hit send and stuff like that...

Kyuzo wrote:...oh i noticed something too.....well...after you post a message and try to exit out of the window...an unlimited number of other windows pops up...i mean you have to restart the computer

....but it only happens if after you posted and it saids you did...right when its about to go back to the forum and you exit out i'll do that..........hmmmmm...it only happened about...i guess 4 times to me right now....but idk if its happened to anyone else :confused2:

Aki wrote:hmmm, when I had my old laptop, I had multiple windows of the same thing keep poping up after I sent a post or a pm, and when i ran a virus check on the old computer it had caught 3 viruses I rebooted it and everything and not to long after that it caught another one. But since i got my new laptop, everythings been doing ok

Kuragari wrote:my mums computer got a virus not long ago the virus scan said that it was from one of the google adds on this site........thats the first time id seen that happen........

Can't one of the mods address this issue to Typlo? At least let him know that some of his users are experimenting problems with the google ads, so maybe he can contact google himself?

Thanks, Sanket. I'll get a screenshot and the website I got directed to next time. I'll have my members do the same. Maybe if we can narrow down which sites are causing these problems, we can take a step toward fixing this.

Garmar.

Kumiko, you need to provide evidence only then will i forward it to Typlo. Thats the reason i am saying forward some information on this to me maybe screenshots etc, or the virus scan screenshots showing source of the virus..something of that sort.

I see that others are still having this problem, as evidenced by the new thread started on this issue:
https://help.forumotion.com/other-problems-f46/virus-question-t39812.htm#252228

May I ask, what is being done to investigate this?

And another:

https://help.forumotion.com/other-problems-f46/virus-alert-big-problem-t40084.htm#252230

I'm sure these users are not appreciating that so many replies insinuate that this is imagined. As I have already mentioned, three forum friends of mine have had their hard-drives systems thoroughly and absolutely ruined, all three needing to be wiped and re-installed!

I disagree with the theory that it is from the Google ads. One, they are not pop-ups, and two, no one clicked on these things to become infected. It would seem that the Forumotion host site itself has been infected for so many to have felt this sting.

Where is the security department for Forumotion? Why are these threads just dying? If nothing is done about this, I can tell you, our busy little forum will be DEAD... too many folks there have been affected, if not INFECTED.

whatzit wrote:

I disagree with the theory that it is from the Google ads. One, they are not pop-ups, and two, no one clicked on these things to become infected. It would seem that the Forumotion host site itself has been infected for so many to have felt this sting.

Well, considering I have been un able to detain any virus' from any forumotion forum, I don't believe that you are accurate

Where is the security department for Forumotion? Why are these threads just dying? If nothing is done about this, I can tell you, our busy little forum will be DEAD... too many folks there have been affected, if not INFECTED.

The "forumotion security department" is the techs
the techs also don't have any active accounts here.
The techs are represented by Typlo...profile
He is also, absent from the forum - un known reason's

These threads are dying simply because, ForuMotion is french, and the french team is un able to help us here on the English support forum

Thank you for your replies, Darren1.

I am very sadly coming to the conclusion that nothing is going to be done about this at all...

whatzit wrote:Thank you for your replies, Darren1.

I am very sadly coming to the conclusion that nothing is going to be done about this at all...

Well, I forgot to say this before...sorry.

The database is only accessible by the ForuMotion technician's, (not us users) and there forth, they are completely safe.

Anyhow, bumping this thread will now provide any further assistance, nor will it provide a solution.
It is best to let the techs do their job.

I think there might be a possiblity it is Google. It wouldn't be the first time. Google Ads were attacked in 2007 and no you didn't have to click on anything. Here is one article from 2007.

The reason I'm thinking it's Google is that I belong to a forum hosted on Zetaboards and I was attacked recently. I have the free AVG installed on an old laptop and I did end up with a Trojan. Since I don't use the laptop very often I knew the trojan originated from the Zetaboard. Lucky for me it was an old laptop that I only use occasionally for browsing. Since I run the free AVG I also run a few other free programs. I can't remember which one found the trojan. My good computer has Norton & a warning is still occasionally popping up when I visit the Zetaboard forum with Google Ads.

This is why I'm guessing it is not limited to just the Forumotion boards. I'm just wondering if Google is aware that they may have been attacked again.