Fortress Forever - FPSBanana Infected Again

Fortress Forever (https://forums.fortress-forever.com/index.php)

- Tech (https://forums.fortress-forever.com/forumdisplay.php?f=47)

- - FPSBanana Infected Again (https://forums.fortress-forever.com/showthread.php?t=21980)

FPSBanana Infected Again

This isn't that surprising. I've been infected from browsing FPSB before. I even made a thread here. I figured the problem had been resolved, but apparently it hasn't.

Quote:

The site is currently infected with the 'Black Internet' trojan.

It's embedded in the site itself somehow, which means all you have to do is go there-- you don't have to download anything, and you'll be infected. All the following programs did not detect the trojan AVG, Ad-Aware and Windows Defender.

If you've been to FPSBanana in the last day or less, check your task manager. Look for iexplore.exe running-- or multiple instances of it if you are surfing with internet explorer, of course. You might also be hearing audio advertisements and/or multiple weird noises and mouseclicks.

Apparently this trojan infects the MBR, to fix the virus problem make all folders viewable in the control panel -> large icons -> folder options -> view -> show hidden files, folders and drives, then reboot in Safe Mode and go here:

C:\Users\YOURUSERNAME\Appdata\Local\Temp

and deleting these two files:

Loader.exe
Smss.exe

And until further notice I strongly suggest that you avoid going to the website.

Quote:

The new FPSBanana virus is a Rootkit virus known as "Black Internet". It is extremely dangerous to your system and security on your computer. A Rootkit virus buries itself into your Master Boot Record which forces the virus to load upon startup. You cannot disable the virus through safe-mode or "msconfig".
!NOTE!
VIRUS SCANNERS WILL NOT DETECT OR FIND THIS VIRUS! ONLY REAL-TIME VIRUS PROTECTION CAN DETECT AND STOP THIS VIRUS FROM BEING INSTALLED.

As of right now, the only working real-time detection and stopping of this virus is Kaspersky. Kaspersky will NOT remove the virus if you already have it.
The virus is obtained through a Java exploit from the advertisements on FPSBanana. Adblock will NOT stop you from getting this virus. Even if you have Ripe, you can still get this virus.

What does it do?
First, the virus buries itself into your Master Boot Record to keep you from detecting and removing the virus easily with any type of virus protection software. Afterwards, it loads up an application that will keep Internet Explorer open and showing you ads in the background or hidden voice ads. There are also reports of this being a Backdoor virus also which can transfer your sensitive information to the creators.

Symptoms
- Internet Explorer opens with ads randomly
- Windows keep minimizing
- Your computer sound will keep turning up and down randomly
- You will hear the clicks of pages being browsed in the background
- Visiting websites might not work

Do I have the Virus?
Even if you think you do not have the virus, you could still be infected!
There is an easy way to test if you have the virus. Follow these steps...

Step 1)
Press CTRL+ALT+DEL on your keyboard. Click "Open Task Manager".

Step 2)
On the Task Manger, click the "Processes" tabs.

Step 3)
Look through your processes for "loader.exe". If you have that file running, there will also be one or multiple instances of "iexplorer.exe". If so, You are infected!

Image

Removing the Virus
To remove this virus, you are REQUIRED to have a Windows disk corresponding to your version of Windows OR a recovery drive that came from factory. If you do not, you are pretty much screwed... There are other ways but they have a 10% chance of working.

So now, insert your Windows disk into your CD/DVD drive and restart your computer. When it says to "Press any key to continue..." do so. If you have a recovery drive, you will either have to press a key that is defined on the Bios screen or press F8 before Windows loads. Choose to recover your Windows installation.

After you choose the option to recover your Windows Installation, you can choose to use Command Prompt to do so. Once the Command Prompt opens, type the following...

Windows XP: fixmbr
Vista or 7: bootrec.exe /FixMbr

After the process completes, you can then close command prompt and Restart your computer. When the computer loads up again, the Virus has been disabled. You just need to delete the file.

You can either use CCleaner to delete all over your Windows Temporary Files or goto your temp folder in the following location...
Windows XP: C:\Documents and Settings\Application Data\temp
Vista or 7: C:\Users\[YOUR USERNAME]\AppData\Local\Temp

Find the file "loader.exe" and delete it.

You should be all set now and the infection should be gone. Double check by following the the steps to check for the virus above.

Apparently, you can prevent this using Adblock. Put the following into your Adblock filters:

Quote:

*lau9.cn*
*o9Ji.cn*

(Adblock is a free Firefox plugin that removes advertisements. It's highly recommended.)

Or Run NoScript

Quote:

The virus is obtained through a Java exploit from the advertisements

Visited just a couple of hours ago if that. Was linking someone on Steam forums.

I don't have loader.exe or iexplorer.exe running.

I use Addblock Plus (with fanboy's and that default list), Microsfoft Seurity Essentials and Peerblock...

Edit:

Quote:

Originally Posted by Pixel

The virus is obtained through a Java exploit from the advertisements

Guess that's why I'm OK then. Or not..

FPSBanana is slow as fuck too. Sometimes I can barely get stuff to work. Thanks for informing me ,I have a few maps uploaded there.

Quote:

Originally Posted by Pixel (Post 472843)

Or Run NoScript

Thats what i been using for sometime now its great it blocks alot of bs scripting/advertising/etc.

Is No Script a Firefox plugin?

Yes

Having AdBlock Plus and No Script active is a good idea.

NoScript

Adblock Plus

In all the years since I first started using firefox with noscript and adblock I have not had one infection.

I still scan everything I download first before running it, and I still do scans on my system now and then but every scan has been clean.

I haven't had any infections since I started using Firefox to be honest. But I do like a good popup blocker, thanks!

Haven't had a single malicious file pop up in Malwarebytes in months. I have UAC and al the Windows safety precautions turned off. The trick is to only browse legit sites and torrent from trusted uploaders. I am however considering using AdBlock, cuz more and more websites are moving towards advertisements with audio/video that always autostart, and they piss me off.

Quote:

Originally Posted by GenghisTron (Post 472876)

But how will you know if you won?

Quote:

Originally Posted by Etzell (Post 472879)

But how will you know if you won?

Intuition. :lol:

Guys, this is one area in which you might consider virtualization. Virtual box is free...run your Windows guest with a baseline snapshot. If your guest gets nailed....roll back to the snapshot. I use Firefox with a number of plugins...including noscript and adblockplus...I'm also not on sketchy sites. But if you are...virtualization is a surefire way to ensure your system stays safe.

Is it still infected? I need to visit the site. :)

Quote:

Originally Posted by moosh (Post 472981)

Is it still infected? I need to visit the site. :)

This, bscly. I was on there just a few days before all this started too.

Do what Innoc said
Or
Try http://www.sandboxie.com/
Or
If your're feeling brave use noscript, addblock as suggested.

I visited without noscript and as far as I know I am not infected.

Just get adblock plus and noscript.

there are 2 iexplore.exe in my processes tab but no loader.exe does this mean im infected?