Fortress Forever

Go Back   Fortress Forever > Off Topic > Tech

Reply
 
Thread Tools Display Modes
Old 07-14-2010, 03:37 AM   #1
Bridget
Banned
 
Bridget's Avatar
 
Join Date: Sep 2008
Class/Position: Soldier
Gametype: AVD
Affiliations: TALOS
Posts Rated Helpful 5 Times
Exclamation FPSBanana Infected Again

This isn't that surprising. I've been infected from browsing FPSB before. I even made a thread here. I figured the problem had been resolved, but apparently it hasn't.

Quote:
The site is currently infected with the 'Black Internet' trojan.

It's embedded in the site itself somehow, which means all you have to do is go there-- you don't have to download anything, and you'll be infected. All the following programs did not detect the trojan AVG, Ad-Aware and Windows Defender.

If you've been to FPSBanana in the last day or less, check your task manager. Look for iexplore.exe running-- or multiple instances of it if you are surfing with internet explorer, of course. You might also be hearing audio advertisements and/or multiple weird noises and mouseclicks.

Apparently this trojan infects the MBR, to fix the virus problem make all folders viewable in the control panel -> large icons -> folder options -> view -> show hidden files, folders and drives, then reboot in Safe Mode and go here:

C:\Users\YOURUSERNAME\Appdata\Local\Temp

and deleting these two files:

Loader.exe
Smss.exe

And until further notice I strongly suggest that you avoid going to the website.
Quote:
The new FPSBanana virus is a Rootkit virus known as "Black Internet". It is extremely dangerous to your system and security on your computer. A Rootkit virus buries itself into your Master Boot Record which forces the virus to load upon startup. You cannot disable the virus through safe-mode or "msconfig".
!NOTE!
VIRUS SCANNERS WILL NOT DETECT OR FIND THIS VIRUS! ONLY REAL-TIME VIRUS PROTECTION CAN DETECT AND STOP THIS VIRUS FROM BEING INSTALLED.

As of right now, the only working real-time detection and stopping of this virus is Kaspersky. Kaspersky will NOT remove the virus if you already have it.
The virus is obtained through a Java exploit from the advertisements on FPSBanana. Adblock will NOT stop you from getting this virus. Even if you have Ripe, you can still get this virus.

What does it do?
First, the virus buries itself into your Master Boot Record to keep you from detecting and removing the virus easily with any type of virus protection software. Afterwards, it loads up an application that will keep Internet Explorer open and showing you ads in the background or hidden voice ads. There are also reports of this being a Backdoor virus also which can transfer your sensitive information to the creators.

Symptoms
- Internet Explorer opens with ads randomly
- Windows keep minimizing
- Your computer sound will keep turning up and down randomly
- You will hear the clicks of pages being browsed in the background
- Visiting websites might not work

Do I have the Virus?
Even if you think you do not have the virus, you could still be infected!
There is an easy way to test if you have the virus. Follow these steps...

Step 1)
Press CTRL+ALT+DEL on your keyboard. Click "Open Task Manager".

Step 2)
On the Task Manger, click the "Processes" tabs.

Step 3)
Look through your processes for "loader.exe". If you have that file running, there will also be one or multiple instances of "iexplorer.exe". If so, You are infected!

Image

Removing the Virus
To remove this virus, you are REQUIRED to have a Windows disk corresponding to your version of Windows OR a recovery drive that came from factory. If you do not, you are pretty much screwed... There are other ways but they have a 10% chance of working.

So now, insert your Windows disk into your CD/DVD drive and restart your computer. When it says to "Press any key to continue..." do so. If you have a recovery drive, you will either have to press a key that is defined on the Bios screen or press F8 before Windows loads. Choose to recover your Windows installation.

After you choose the option to recover your Windows Installation, you can choose to use Command Prompt to do so. Once the Command Prompt opens, type the following...

Windows XP: fixmbr
Vista or 7: bootrec.exe /FixMbr

After the process completes, you can then close command prompt and Restart your computer. When the computer loads up again, the Virus has been disabled. You just need to delete the file.

You can either use CCleaner to delete all over your Windows Temporary Files or goto your temp folder in the following location...
Windows XP: C:\Documents and Settings\Application Data\temp
Vista or 7: C:\Users\[YOUR USERNAME]\AppData\Local\Temp

Find the file "loader.exe" and delete it.

You should be all set now and the infection should be gone. Double check by following the the steps to check for the virus above.
Bridget is offline   Reply With Quote


Old 07-14-2010, 04:04 AM   #2
Bridget
Banned
 
Bridget's Avatar
 
Join Date: Sep 2008
Class/Position: Soldier
Gametype: AVD
Affiliations: TALOS
Posts Rated Helpful 5 Times
Apparently, you can prevent this using Adblock. Put the following into your Adblock filters:

Quote:
*lau9.cn*
*o9Ji.cn*
(Adblock is a free Firefox plugin that removes advertisements. It's highly recommended.)
Bridget is offline   Reply With Quote


Old 07-14-2010, 04:54 AM   #3
Pixel
if(0>1){printf("broked");}
Beta Tester
 
Pixel's Avatar
 
Join Date: Mar 2007
Location: Amerika
Class/Position: O
Posts Rated Helpful 3 Times
Or Run NoScript

Quote:
The virus is obtained through a Java exploit from the advertisements

Last edited by Pixel; 07-14-2010 at 04:55 AM.
Pixel is offline   Reply With Quote


Old 07-14-2010, 06:14 AM   #4
Paft
Beta Tester
 
Paft's Avatar
 
Join Date: Mar 2007
Location: UK - http://forums.fortress-forever.com
Class/Position: [O] Med
Gametype: CTF/Skills
Posts Rated Helpful 67 Times
Visited just a couple of hours ago if that. Was linking someone on Steam forums.

I don't have loader.exe or iexplorer.exe running.

I use Addblock Plus (with fanboy's and that default list), Microsfoft Seurity Essentials and Peerblock...

Edit:
Quote:
Originally Posted by Pixel
The virus is obtained through a Java exploit from the advertisements
Guess that's why I'm OK then. Or not..

Last edited by Paft; 07-14-2010 at 06:25 AM.
Paft is offline   Reply With Quote


Old 07-14-2010, 12:52 PM   #5
moosh
WhenNailGrenWillOut?
Beta Tester
 
moosh's Avatar
 
Join Date: May 2009
Gametype: mp_prematch
Affiliations: [:)] - Frag Happy, babe|
Posts Rated Helpful 29 Times
FPSBanana is slow as fuck too. Sometimes I can barely get stuff to work. Thanks for informing me ,I have a few maps uploaded there.
__________________
[[ ff_hotfudge - bhop_theonlyone ]]
"As the the new year approaches I await for it like an case of explosive fecalomania otherwise know as diareha or the massive shits. I am gripping the sides of the toilet as my stomach produces the first hollow thud out of the anus of the year to come." DarkeN_HellspawN
moosh is offline   Reply With Quote


Old 07-14-2010, 02:43 PM   #6
EquilibriuM
G9-
D&A Member
 
EquilibriuM's Avatar
 
Join Date: Sep 2007
Location: Florida
Class/Position: D Solly,Engy
Gametype: ALL
Posts Rated Helpful 0 Times
Quote:
Originally Posted by Pixel View Post
Or Run NoScript
Thats what i been using for sometime now its great it blocks alot of bs scripting/advertising/etc.
__________________
EquilibriuM is offline   Reply With Quote


Old 07-14-2010, 06:13 PM   #7
Lost
Fear teh crowbar.
Retired FF Staff
 
Lost's Avatar
 
Join Date: Jan 2005
Location: Oklahoma
Gametype: CTF ftw, yeh
Posts Rated Helpful 6 Times
Send a message via Yahoo to Lost
Is No Script a Firefox plugin?
__________________
Do what you want cuz a pirate is free!

You are a pirate!
Lost is offline   Reply With Quote


Old 07-14-2010, 06:54 PM   #8
Gwarsbane
Slayer of humans
D&A Member
 
Gwarsbane's Avatar
 
Join Date: Sep 2007
Location: Mostly on earth though in some alt dimensions
Class/Position: I'm an Offensive Defensive person
Gametype: Fortress Forever
Affiliations: I'm a merc, only thing that talks is money
Posts Rated Helpful 3 Times
Yes

Having AdBlock Plus and No Script active is a good idea.

NoScript

Adblock Plus


In all the years since I first started using firefox with noscript and adblock I have not had one infection.

I still scan everything I download first before running it, and I still do scans on my system now and then but every scan has been clean.
Gwarsbane is offline   Reply With Quote


Reply

Tags
fpsbanana, hacked, infection, rootkit, virus


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT. The time now is 01:17 PM.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2024, vBulletin Solutions, Inc.