Pwi Forum And Fake Virus Pop Ups!

pwiqq
pwiqq Posts: 0 Arc User
edited April 2011 in General Discussion
ANYBODY GET LOTS OF FAKE VIRUS POP UPS WHEN BROWSING THE PWI FORUMS? I GET MORE ON PWI FORUMS THAN ON any other sites....


pwi-forum.perfectworld.com/showthread.php?t=1138561&page=2

[SIGPIC][/SIGPIC]
Post edited by pwiqq on
«1

Comments

  • Aubree - Dreamweaver
    Aubree - Dreamweaver Posts: 1,868 Arc User
    edited April 2011
    No I dont get them, and I dont have an ad banner either. You must be carrying malware on your pc ?
  • DeathMethod - Harshlands
    DeathMethod - Harshlands Posts: 114 Arc User
    edited April 2011
    b:scorn Is it possible you seriously do have a virus? I never get fake virus pop ups b:scorn
  • The__Sun - Dreamweaver
    The__Sun - Dreamweaver Posts: 336 Arc User
    edited April 2011
    I would do a scan on your PC, sounds like you have spyware or something
    [SIGPIC][/SIGPIC]
    **** Laws of Physics I'm going to shoot crystals from my hands and summon meteors from the air.... Laws of Psychics
  • RedsRose - Lost City
    RedsRose - Lost City Posts: 12,354 Arc User
    edited April 2011
    I would do a scan on your PC, sounds like you have spyware or something

    ^ 100% this...
    [SIGPIC][/SIGPIC]
    RoidAbuse is awesome, only he would sell his sperm for gear!!

    "Toughest monster? ..... RedsRose b:surrender" - Kantorek
    Where is my 1 v 1 Kan? b:mischievous
  • Jenovadeath - Lost City
    Jenovadeath - Lost City Posts: 217 Arc User
    edited April 2011
    They've had trojan banner adds before wouldn't doubt it if they had another one somewhereb:surrender
  • steveht7
    steveht7 Posts: 0 Arc User
    edited April 2011
    When I was using IE for a bit before, yes I got the fake alert.

    On my usual firefox+adblock now and I'm not getting it.
  • Abstractive - Archosaur
    Abstractive - Archosaur Posts: 1,232 Arc User
    edited April 2011
    pwiqq wrote: »
    ANYBODY GET LOTS OF FAKE VIRUS POP UPS WHEN BROWSING THE PWI FORUMS? I GET MORE ON PWI FORUMS THAN ON any other sites.... b:sad

    Uh-oh...looks like someone's been watching too much online p.orn.
    [SIGPIC][/SIGPIC]
    Bodyguard for Secret Passage at your service, now accepting daily installments of just 2.5m for your leisure.
  • brent40
    brent40 Posts: 49
    edited April 2011
    Its a third pary attachment to your broweser. A pain to get rid of too...
  • Psytrac - Dreamweaver
    Psytrac - Dreamweaver Posts: 2,488 Arc User
    edited April 2011
    b:scorn Is it possible you seriously do have a virus? I never get fake virus pop ups b:scorn
    I am quite sure I don' have a virus, and I get popups on various sites with ad banners
    http://nsa26.casimages.com/img/2011/04/20/110420084144518806.png

    (look closely)
    I'm a guy, not a woman, that is all
    "When you're on Team Bring it, every morning your feet hit the floor, the good lord says "good morning" and the devil says 'Oh **** they're up' " - Dwayne "The Rock" Johnson
    Are you on Team Bring it?
  • Cheze - Lost City
    Cheze - Lost City Posts: 200 Arc User
    edited April 2011
    yes, it's most likely cross-frame scripting from malicious ads displayed on the page. You're probably using IE?
  • o/ - Dreamweaver9
    o/ - Dreamweaver9 Posts: 1 Arc User
    edited April 2011
    Yes i use IE. and it looks like the picture posted. It likes appearing when i browse the pwi fourms.
  • Psytrac - Dreamweaver
    Psytrac - Dreamweaver Posts: 2,488 Arc User
    edited April 2011
    Yes i use IE. and it looks like the picture posted. It likes appearing when i browse the pwi fourms.
    look at my previous post on page 1
    I'm a guy, not a woman, that is all
    "When you're on Team Bring it, every morning your feet hit the floor, the good lord says "good morning" and the devil says 'Oh **** they're up' " - Dwayne "The Rock" Johnson
    Are you on Team Bring it?
  • pwiqq
    pwiqq Posts: 0 Arc User
    edited April 2011
    it is not a virus?


    pwi-forum.perfectworld.com/showthread.php?t=1138561&page=2

    [SIGPIC][/SIGPIC]
  • o/ - Dreamweaver10
    o/ - Dreamweaver10 Posts: 1 Arc User
    edited April 2011
    b:laugh
  • Psytrac - Dreamweaver
    Psytrac - Dreamweaver Posts: 2,488 Arc User
    edited April 2011
    it's a fake, if you look at the picture I posted I got that pop-up while running LINUX (really should have edited that pic, but oh well.. for those that don't know the user account, unlike windows is is /home/<user>/ where windows is C:\users\<name>\ linux does not have letterd drives they all come from one root "/" /media/cdrom0 /media/dvdrom0 /media/usb0 etc)
    I'm a guy, not a woman, that is all
    "When you're on Team Bring it, every morning your feet hit the floor, the good lord says "good morning" and the devil says 'Oh **** they're up' " - Dwayne "The Rock" Johnson
    Are you on Team Bring it?
  • Cheze - Lost City
    Cheze - Lost City Posts: 200 Arc User
    edited April 2011
    yeah I've seen that same fake virus scanner ****. It's just the browser's security vunerability that allows ads which are inside frames to somehow redirect the parent frame. just get ad blockerz :3
  • pwiqq
    pwiqq Posts: 0 Arc User
    edited April 2011
    yeah I've seen that same fake virus scanner ****. It's just the browser's security vunerability that allows ads which are inside frames to somehow redirect the parent frame. just get ad blockerz :3

    ok thanks for the information


    pwi-forum.perfectworld.com/showthread.php?t=1138561&page=2

    [SIGPIC][/SIGPIC]
  • brent40
    brent40 Posts: 49
    edited April 2011
    Its not a virus, more so a malware, that takes over your browser.. check your systems32 folder for a ctfmon.exe file, i
  • Psytrac - Dreamweaver
    Psytrac - Dreamweaver Posts: 2,488 Arc User
    edited April 2011
    brent40 wrote: »
    *snip* check your systems32 folder for a ctfmon.exe file *snip*
    care to explain why it tripped on linux then? there are NO .exe files on linux
    I'm a guy, not a woman, that is all
    "When you're on Team Bring it, every morning your feet hit the floor, the good lord says "good morning" and the devil says 'Oh **** they're up' " - Dwayne "The Rock" Johnson
    Are you on Team Bring it?
  • pwiqq
    pwiqq Posts: 0 Arc User
    edited April 2011
    brent40 wrote: »
    Its not a virus, more so a malware, that takes over your browser.. check your systems32 folder for a ctfmon.exe file, i

    yes i have teh ctfmom.exe file. What do i do with it?


    pwi-forum.perfectworld.com/showthread.php?t=1138561&page=2

    [SIGPIC][/SIGPIC]
  • Psytrac - Dreamweaver
    Psytrac - Dreamweaver Posts: 2,488 Arc User
    edited April 2011
    pwiqq wrote: »
    yes i have teh ctfmom.exe file. What do i do with it?
    it's a windows component, don't mess with it
    I'm a guy, not a woman, that is all
    "When you're on Team Bring it, every morning your feet hit the floor, the good lord says "good morning" and the devil says 'Oh **** they're up' " - Dwayne "The Rock" Johnson
    Are you on Team Bring it?
  • Cheze - Lost City
    Cheze - Lost City Posts: 200 Arc User
    edited April 2011
    pwiqq wrote: »
    yes i have teh ctfmom.exe file. What do i do with it?

    eat it!
  • _Yukari_ - Dreamweaver
    _Yukari_ - Dreamweaver Posts: 28 Arc User
    edited April 2011
    best describes your name
  • Aneurysmal - Heavens Tear
    Aneurysmal - Heavens Tear Posts: 798 Arc User
    edited April 2011
    Run a system restore to the day before you started getting the fake virus scanner popups.
    Main:
    [SIGPIC][/SIGPIC]
    Alts:
    Lypiphera 101 Cleric
    Incompetance 100 Blademaster
    MetalPenguin 101 Seeker

    b:dirtySolara_Craft/Disarmonia_Xb:dirty
  • brent40
    brent40 Posts: 49
    edited April 2011
    it's a windows component, don't mess with it

    He wouldnt be able to delete it anyway...

    but that file was re-written in the HKCU


    http://free.antivirus.com/hijackthis/ go here, follow thier directions...
  • Psytrac - Dreamweaver
    Psytrac - Dreamweaver Posts: 2,488 Arc User
    edited April 2011
    care to explain why it tripped on linux then? there are NO .exe files on linux
    ^explain..

    you can't write to directories without warning and root access most of the time, so how did it come up on linux?
    I'm a guy, not a woman, that is all
    "When you're on Team Bring it, every morning your feet hit the floor, the good lord says "good morning" and the devil says 'Oh **** they're up' " - Dwayne "The Rock" Johnson
    Are you on Team Bring it?
  • Brittany_Mia - Sanctuary
    Brittany_Mia - Sanctuary Posts: 7 Arc User
    edited April 2011
    Ok i dont know hat that link is but if its a link to the pop up you've been getting then.... DONT CLICK ON IT..... im not even going to click the link.. dont need a virus.
  • Psytrac - Dreamweaver
    Psytrac - Dreamweaver Posts: 2,488 Arc User
    edited April 2011
    Ok i dont know hat that link is but if its a link to the pop up you've been getting then.... DONT CLICK ON IT..... im not even going to click the link.. dont need a virus.
    my link: a picture from Linux
    brent40's: an AV program
    I'm a guy, not a woman, that is all
    "When you're on Team Bring it, every morning your feet hit the floor, the good lord says "good morning" and the devil says 'Oh **** they're up' " - Dwayne "The Rock" Johnson
    Are you on Team Bring it?
  • brent40
    brent40 Posts: 49
    edited April 2011
    ^explain..

    you can't write to directories without warning and root access most of the time, so how did it come up on linux?

    Don't know enough about linux to get into a redhat hax pissing match... heh..

    But this explains the ctfmon.exe virus a bit more, maybe ya answeres are there?

    http://ctfmonexevirus.com/


    Anyway, edit to add -sorry been in (another game) all this time- I had the same issues few weeks back, ran system scans, ran virus programs both software, and online ones, went and dug through files manulaly, never once showed any malware, virus, spyware. Then I posted a hijack this and someone pointed out that the ctfmon was showing when and where it wasnt supose to be, and asked me to look in the system32 folder to see if it was compressed (meaning colored in blue) if not, then it was being used, which means an outisde source is useing it as its support as an .exe Basically it re-writes it in the HKEY to call out to that paticular file..


    Anyway, short story to hours of insane ****, that was the source of the problem...
  • Neyda - Raging Tide
    Neyda - Raging Tide Posts: 83 Arc User
    edited April 2011
    I am quite sure I don' have a virus, and I get popups on various sites with ad banners
    http://nsa26.casimages.com/img/2011/04/20/110420084144518806.png

    (look closely)

    For some Reason I think I should congratulate you for succesfully downloading Scareware on your PC. you should run a Malware Removal Tool.