Viruses appears to be back again

[David Schwab]

If I enter from Google, sometimes I get a full screen message that tells me that I need to turn off adblocker in order to enter the site. It pretty much tries to take control of my computer and that is when I get the Virus warning from Windows, asking if I want to open such and such a file. It also warns me that it is a virus of some sort, and I just hit the remove button.

I usually enter the site from a bookmark. But I was Googling something pickup related, and I also got that Ad blocker warning, etc.

So it seems to have something to do with Google.

[Steve Conner]

Yeah, you're right! If I google "music electronics forum" then MEF is of course the first hit.

But if I click on the link in search results, I once got redirected to dollarade.com, where it says "You must turn off Adblock Plus to continue".

"The Dollarade Overlay is the newest, most profitable, and convenient way of advertising video games, music, movies, and any other flash content you can imagine! Once the Dollarade Overlay has been placed on your website, viewers will be required to complete surveys in order to continue using your product. You will earn up to $1.50, or more for every single survey that your viewers complete!"

I assume Tboy didn't install this deliberately?!

[soundguruman]

Just got hit again when I tried to access MEF from Google.
I was redirected to an advertisement, maybe it's the Google server(?)
But then on the next try it worked normally.
This is what it's redirecting to:
http://file2store.info/download.php?id=612775CB
I'm not suggesting you click that link, however. It may be a trap.

[J M Fahey]

I assume Tboy didn't install this deliberately?!

You must be joking ... I hope.

There´s no better way to kill a successful site.

@soundguruman: I searched about what you found: it seems to be a (by itself harmless) file server.
Of course the bad guys use it to store their malware.
A long discussion on how VBulletin Forums are attacked through it:
https://www.vbulletin.com/forum/show...ile2store-info
It might say something useful.

[soundguruman]

No, I'm not joking, but it may be on the google end, and not the MEF end.

[yorkie123]

Our site has the same problem, any tips on how to fix it?

[David Schwab]

No, I'm not joking, but it may be on the google end, and not the MEF end.

I think so as well.

[ken]

I tried to get in here at various times last night, but all I got was a white browser screen instead of the website.

ken

[tboy]

PM sent.

[tboy]

Hey tboy, as long as we have you here, what happened to the Wiki? It's a blank page now.

The wiki is broken. It happened when I installed the latest update from wikimedia. It seems they made some changes with this version that are incompatible with previous versions. I'll get it fixed soon.

[David King]

Hey Tboy,

I just want to register my thanks to you for keeping all this moving and for keeping up with it!

[David Schwab]

The wiki is broken. It happened when I installed the latest update from wikimedia. It seems they made some changes with this version that are incompatible with previous versions. I'll get it fixed soon.

Cool. While you are at it, if you can set me up to admin the Wiki I can prevent all the spam pages that were being created. I had to set up an email when the first page was edited, and vandals would remove the entire page and replace it with spam, sometimes on a weekly basis. If I could ban people's IP addresses that would help. It's the same hand full of offenders.

[big_teee]

I wonder what happened to be off the air this time?
T

[Jazz P Bass]

T Boy has been busy, has he not.
Trying to weed out the BS.
What a bunch of crap!

[bob p]

Part of the problem is that the spammers are so good at doing what they do, that they figure out ways to exploit the board software as fast as it gets updated. They run spammer forums that use the same hosting software that legitimate sites use. They also use the beta versions of the forum software as soon as it becomes available, and they work to have exploits in place by the time that the forum software gets officially released. This makes it a real PITA for be a forum admin, as the bad guys are always one step ahead of you. You're constantly playing a defensive game.

From a users standpoint, there are some things that you can do to really make things easier on youself.

1. Browse on a de-privileged user account. Never browse using a Windows Administrator or Power User account. Browse as a regular user or as a guest. You want to be sure to use an account that does not have privileges to install software.

2. Block Flash. It's a security problem.

3. Block Java. Same as above.

The problems come along when you give your browser the ability to download code from a foreign site and execute it on your computer. That's exactly what Java and Flash are designed to do, and that's the LAST thing that you want from a security standpoint. The way that these exploits typically work is to use scripting to install software on your PC that tries to install other software using your user privileges. Of course, if you're browsing using a root account, you could be in big trouble if malware obtains root privileges on your system. These kinds of privilege-escalation security holes were fixed on most 'nix systems back in the 1970s. It's really sad to see the current versions of windows remaining so vulnerable for so long. It makes me wonder if it isn't done on purpose to sell resource-hogging malware protection software, which in turn consumes so many resources that you're forced into buying a multi-core machine and another windows license.

Flashblock is a good option, but the best way to block Flash is to just not install it. The box that I'm browsing on right now is a 64-bit Linux box, and it doesn't even have flash installed because there isn't a decent 64-bit Flash for Linux. Without Flash, I'm totally protected against flash exploits. I've installed a script blocking add-on for firefox which allows me granualr control of which sites are allowed to execute scripts on my PC. Until I whitelist a site, every site is blacklisted. I guess I'm one of those old-fashioned guys who just doesn't care about the advanced feature set that will be brought to us with HTML 5.0. I just don't want remote sites to instal and execute software on my box.

Using common sense safeguards, I've been able to run an XP box without active/real-time anti-virus protection for the entire lifespan of Windows XP. Just by using common sense browsing, I've never been successfully exploited by a trojan or a virus. On those occasions when I did download a trojan, they've never been able to complete their execution /installation because it was trying to install itself via a non-privileged user account. It got as far as copying itself to the hard drive, but was unable to execute due to lack of proper privileges to install the subsequent stages in the attack mechanism. I found it and got rid of it using a periodic system scan using the free MS Malicious Software Removal Tool. Just to be clear -- I'm not advocating running a naked copy of Windows. I'm just trying to point out that you can add a fair amount of protection to your installation just by adopting the use of non-Administrator/non-Power User accounts for most of your computer use. This is a basic security principle that a lot of computer users seem to have overlooked. You really don't want to be browsing using an administrative account.

HTH.