Virus from guru ads/attack site

[Belicosos Finos]

Have just had some popups from antivirus software (sophos in this case) with some virus warnings as Ive been reading through guru

virus identified is Mal/Iframe-G and the ad (or at least the site generating it) is
www.fun6677.com/ js / index.htm (without spaces)

[Yang Whirlwind]

Thank you for bringing this to our attention.
I have forwarded your information and the link containing the virus should be removed shortly.

[Raven Wing]

I' ll just mention I had the same.

[Raven Wing]

and another:
http://adserver.mmoguru.com/defaultads-tribalfusion-leaderboard.php
In this case its avast! discovering it.

[Fates Monk]

Warning: Visiting this site may harm your computer!
The website at www.guildwarsguru.com contains elements from the site www.fun6677.com, which appears to host malware – software that can hurt your computer or otherwise operate without your consent. Just visiting a site that contains malware can infect your computer.
For detailed information about the problems with these elements, visit the Google Safe Browsing diagnostic page for www.fun6677.com.

[Ultimate Flash]

If you're afraid of websites loading scripts without your knowledge I suggest you use Firefox and the addon No Script. Stay away from IE if you can!!

link to find Firefox www.mozilla.org

link to download No Script addon http://noscript.net/

This way you can block any Javascript, Java, or Flash from loading any questionable software/malware on you system.

[Painbringer]

1 Before locked

Report to site feedback or moderator 1st before causing mass panic.

There is also a snapview.ock that keeps tring to load. BTW

P.S. clean your browsing history

[Misa]

same here
avast blocked the same thing from guru (http://www.fun6677.com/)

[stretchs]

This is unfortunately a common occurrence here, be sure to have script stopping/blocking on your browser can/will help, but as anyone knows anywhere you go on the net could lead to bad places

[Jensy]

Yeah, I have FF with noscript and I'm not getting any warnings O_o

[Feathermoore Rep]

Thats a message generated by Google Chrome. I actually just received the same message. It automatically checks the websites against its own database of reported malware/spyware/harmful websites and automatically lets you know when your browser directs to one, stops you, and asks if you wish to proceed.

I just accepted the warning and went on browsing. W/ith the ads its really no surprise that its registers as malware.

[Neez]

Malware is found by Avira everytime I open a thread, whichever it is.



13-01-2009 22:14 Malware found
Virus or unwanted program 'HTML/Dldr.Iframe.JI [virus]'
detected in file 'C:\Documents and Settings\n"\Local Settings\Temporary Internet Files\Content.IE5\35SGBZRM\index[1].htm.

[Inde]

Thanks everyone. Resolved.

[KZaske]

I have warning from Avira concering malware and redirects from not one but two different web sites along with two pop-unders are from yieldmanager.com (cpxinteractive.com) and quizrocket.com. The site seems to reset itself about once every two minutes

[Neez]

Looks like it has been solved. :)

[KZaske]

Everything seems to be fine now. Thanks Inde for getting this taken care of so quickly.

[cosyfiep]

I just got a very strange warning from avg (yea I have it paid for for the next 2 years not going to change now)....I have attached a screen shot of the warning...its really late so my brain is not computing what it means other than I should just go to bed now----(and maybe I should not us chrome).

[bsoltan]

I'm getting this today:

http://i41.tinypic.com/2rgyk28.jpg

Whenever I visit any page on Guru.

Edit: Yep same one cosyfiep. Chrome + Nod32.

[Lord of kryta]

I'm getting it as well, using eset.

[baltazar knight]

http://i255.photobucket.com/albums/hh141/Baltazar_knight/VirusAlert.png

ESET NOD32 and Avira Premium found it, so probaly no false positive.
It tries to acces your computer without your permission. Everyone without antivirus will have troubles.

Description as it isn't clear:

Contains recognition pattern of the ''HTML/Dldr.Lframe.JL'' HTML script virus.

[Metatail]

That's a cool pic you got there sir.

[Malice Black]

It's a running issue. It's due to goggle ads and not Inde trying to haxxor your computer. PM the details to Inde/kzap and they'll get it removed.

[dan_dv]

When i browse to Guildwarsguru with IE, I get two warnings from Norton Internet Security about infected file beeing removed.

[code1101]

I just got it on my free avg antivirus ... its true guys.

a yellow bar apears on the top of the windows asking to run a realplayer activex ... when i clicked it a virus tried to enter my PC

[thig]

Well theres a simple solution to it all...don't use a insecure browser like Internet Explore. Switch to Firefox and install the no script plugin.

[papryk]

I just got it on my free avg antivirus ... its true guys.

a yellow bar apears on the top of the windows asking to run a realplayer activex ... when i clicked it a virus tried to enter my PC


same here...it's true

[CE Devilman]

http://img4.imageshack.us/img4/5724/ugotviracv6.jpg

just on guru webpage..

[thral]

Avast keeps blockng something for me so yeah...

[Schmerdro]

I use Firefox with the NoScript extension and I never got any kind of warning from my AVG anti-virus.

Lesson: Don't use shitty web-browsers.

[ag3ntblak]

http://i8.photobucket.com/albums/a8/ag3ntblak/gurutrojan.jpg

http://s8.photobucket.com/albums/a8/ag3ntblak/?action=view&current=consistent.jpg

Almost every thread I goto in guru is downloading this trojan into my computer. Is this why this forum is always so laggy?

[baltazar knight]

http://www.guildwarsguru.com/forum/showthread.php?p=4485326&posted=1#post4485326

h**p://www.safe6699.com/js/index.htm

Avira detected it.
I'm using Firefox.

[IattackU]

I use Firefox with the NoScript extension and I never got any kind of warning from my AVG anti-virus.

Lesson: Don't use shitty web-browsers.

Same here except I use Avast and not AVG.

Haven't gotten a message at all and I actually just installed NoScript after I read this.

[just call me jimmy]

Call me crazy but shouldn't the Moderators of Guru be informing their members of Trojans on their website? Regardless of who is at fault, the fact is people are at risk by just loading your website. I would say you have an obligation too inform people, of any risk loading Guru, what you are doing to fix it, and what your community should do if they receive these Trojan messages.

To the people that said "I use Firefox so no worries" I am sorry to say this, but you all have the IQ of a pea. Please uninstall the internet immediately, as you are a risk to it not blowing up.

Here is what my AVG picked up.

Trojan Horse Downloader Generic c .ACM - count29.51yes.com

hope you get it fixed

[Inde]

We're aware everyone and taking care of it (and to Jimmy, sometimes we sleep. It's a bad habit I know. So when it takes us an hour or two to know of an issue it's just because my IV of caffeine hadn't started yet to wake me up). Thank you for the updates.

[Arcanus]

I get the same message from my avg as most people here do.
my question is tough : should we ingnore it or rather leave guru off for the moment till it is fixed by you?

[just call me jimmy]

:)

http://www.youtube.com/watch?v=yo3uxqwTxk0

Hopefully makes you laugh Inde, while having what will probably be an annoying day!!!

[Necro Quink]

Well, i have been on guru the whole day (using IE7) and didnt had any problem.

[bsoltan]

FYI: Getting this now as soon as I visit the forums

http://i43.tinypic.com/iop3xw.jpg

[seut]

firefox / google
http://img144.imageshack.us/img144/9504/gurubadgy6.jpg (http://imageshack.us)

[Dmitri3]

http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=http://www.guildwarsguru.com/forum/usercp.php

Site is listed as suspicious - visiting this web site may harm your computer.

Of the 25 pages we tested on the site over the past 90 days, 1 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-02-08, and the last time suspicious content was found on this site was on 2009-02-08.

Malicious software includes 1 scripting exploit(s). Successful infection resulted in an average of 12 new processes on the target machine.

Malicious software is hosted on 1 domain(s), including safe6699.com/.

This site was hosted on 1 network(s) including AS33070 (RMH).

EDIT: Had to disable safe browsing just to post this. I'd expect a drop in traffic from people who use Firefox or Google Chrome if this isn't fixed soon.

[Saffron]

Anyone else get this message? I got it on firefox 3 on both my pc and mac.

http://img.photobucket.com/albums/v341/lunaregina/gurumalicious.jpg

[Mangione]

I am using Firefox, but nothing ever came up, until today with the google safebrowsing.

May I have been infected, or is it something just IE related?

ps - as Dmitri, I had to disable safebrowsing to post this.

[drago34]

Anyone else getting that Guild Wars Guru is a reported attack site when they try to visit it?

[Owik Gall]

My browser warned me it could contain malicious stuff when I got on today. Never happened before.

[refer]

Firefox 3.1 or NOD32 didn't hasn't warned me of anything, never has. No tweaking of settings either.

[Lonesamurai]

Looks like it has been solved. :)
I just this moment got:

Reported Attack Site!



This web site at www.guildwarsguru.com has been reported as an attack site and has been blocked based on your security preferences.



Attack sites try to install programs that steal private information, use your computer to attack others, or damage your system.

Some attack sites intentionally distribute harmful software, but many are compromised without the knowledge or permission of their owners.

when I tried to use the site and every time I goto a new page on Firefox...

[Darcy]

I got the malware warning from Google Chrome. I had to check a box stating my awareness of the danger before it would open the website.

Here is the Google Chrome warning.

Warning: Visiting this site may harm your computer!
The website at www.guildwarsguru.com appears to host malware – software that can hurt your computer or otherwise operate without your consent. Just visiting a site that hosts malware can infect your computer.
For detailed information about the problems with this site, visit the Google Safe Browsing diagnostic page for www.guildwarsguru.com.
Learn more about how to protect yourself from harmful software online.

[check box] I understand that visiting this site may harm my computer.

[naughteblonde]

Did you just upgrade to the new Firefox?
If so had the same prob - Look under tools > Options > Security and theres an exceptions tab there.

[MattJJ]

same problem here, i tried going to tools->exceptions and allowing the site but it still doesnt work. i'm still getting blocked....any help here?

[baltazar knight]

The attack stopped.....

[DarkWasp]

Isn't there some way we could get a cleaner ad chain?

[MrTickle]

Seems fixed now so thanks for the quick response getting us up & running again admins :)

[ShoGunTheOne]

i'm still getting the warning, kinda annoying that i have to click ignore everytime i open a thread/page

[NoXiFy]

Woah... I had to turn McAfee off to come to Guru today. It was like "THIS SITE CONTAINS SOFTWARE THAT WILL STEAL YOUR PERSONAL INFORMATION, YOU WILL NOT BE ABLE TO VIEW THIS WEBSITE UNTIL IT IS RESOLVED"

[refer]

Well I just got the warning now... I remember I had it off because the same thing happened before to another legitimate site. At Google's Webmaster Tools you can get another review of your site, wonder if this has been mentioned. This link also comes up when you say the site isn't an attack site:

http://www.stopbadware.org/home/reviewinfo?hl=en-US&url=http%3A%2F%2Fwww.guildwarsguru.com%2Fforum%2Ff orumdisplay.php%3Ff%3D17

[Felixious]

Running an up to dat version of Kaspersky, and i have no problems at all accesing guru. In fact i've never, EVER seen an ad on here because they're blocked. :3

Don't know if it's Kaspersky doing what i payed for it to do, or if there's something i'm missing?

[Inde]

We are still working on it everyone. Thank you for the updates! I'll get more posted as I can.

[Puebert]

Yup, getting "Reported Attack Site!" nonsense.

Probably should just play GW til this gets resolved. :/

[Inde]

Quick question, were any of you that were getting virus warnings this morning STILL getting them? More specifically, have you gotten a virus warning in the last 2 hours? I'm not looking for Google results here but rather Macafee, Avast, Norton, etc.

I'm not referring to the "attack site" label by Google but the virus' warnings in particular. Thank you.

[MithranArkanere]

I do, though.

My FF with NoScript considers guildwarsguru.com and attacking site.

[slothdroid]

When I try and load up this site in Firefox, I get the 'Reported Attack Site' message. The reason as given by google is as follows. I thought I should let you know, I haven't had any probs while I vistit here...

Safe Browsing
Diagnostic page for guildwarsguru.com

What is the current listing status for guildwarsguru.com?

Site is listed as suspicious - visiting this website may harm your computer.

What happened when Google visited this site?

Of the 25 pages that we tested on the site over the past 90 days, 1 page(s) resulted in malicious software being downloaded and installed without user consent. The last time that Google visited this site was on 2009-02-08, and the last time that suspicious content was found on this site was on 2009-02-08.

Malicious software includes 1 scripting exploit(s). Successful infection resulted in an average of 12 new processes on the target machine.

Malicious software is hosted on 1 domain(s), including safe6699.com/.

This site was hosted on 1 network(s) including AS33070 (RMH).

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, guildwarsguru.com did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.

How did this happen?

In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

Next steps:

* Return to the previous page.
* If you are the owner of this website, you can request a review of your site using Google Webmaster Tools. More information about the review process is available in Google's Webmaster Help Centre.

Updated 5 hours ago

©2008 Google - Google Home

wasn't sure where to post this, hope you get it resolved! ;)

[snidersin]

not sure if this is the right place to post but...

ive been using guru for a while now, browsing through forums without a problem

but i came on today to recieve a "reported attack website" warning when i came to the site

so i ignore the warning and continued to guru, but now every time i click a link in guru i keep getting the warning, and have to press the ingore button

has anyone else had this problem recently?
and can any help me to stop it?

[Shayne Hawke]

I'm running the latest Firefox and NoScript, and I'm having similar issues.

I think I was browsing GWGuru earlier this morning and had no trouble, but the past couple hours have just been like this.

~5 hours later here, I'm still getting the message.

[bsoltan]

Quick question, were any of you that were getting virus warnings this morning STILL getting them? More specifically, have you gotten a virus warning in the last 2 hours? I'm not looking for Google results here but rather Macafee, Avast, Norton, etc.

I'm not referring to the "attack site" label by Google but the virus' warnings in particular. Thank you.

I'm no longer getting the warnings about the malware/trojan from my antivirus (Nod32) on either Chrome or Firefox. Just the 'attack site' now.

Hope you can get it resolved soon. :)

[PowerRAV]

hmm in order for me to even sign in to the site I had to go to...

Tools > Options... > Security Tab > Uncheck "Tell me if the site I'm visiting is a suspected attack site" box

I tried adding guildwarsguru.com to the Exceptions... box in that same tab and it did not work for me.

So I'll just have to remember to check that box back when leaving guildwarsguru. Hopefully this problem will be fixed soon. =D

I'm using firefox 3.0.5 btw

[StormDragonZ]

hmm in order for me to even sign in to the site I had to go to...

Tools > Options... > Security Tab > Uncheck "Tell me if the site I'm visiting is a suspected attack site" box

I tried adding guildwarsguru.com to the Exceptions... box in that same tab and it did not work for me.

So I'll just have to remember to check that box back when leaving guildwarsguru. Hopefully this problem will be fixed soon. =D

I'm using firefox 3.0.5 btw

I've been doing the same thing, but it still says the warning when I do have it check marked. I also hope the problem gets fixed soon... you know, I had a thought this is how rawr/zero plan to get back for losing cape trim... wouldn't that be funny...

[Skuld]

Firefox: Tools -> Options -> Security -> Untick "tell me if i'm visiting a suspected attack site"

[obliteratus]

Exactly what the topic says. It didn't happen some days ago. Do you know what's wrong? I think this is absurd!

[Diddy bow]

Read the thing above this ---^

[Katsumi]

Guild Wars Guru Reported Attack Site

We are aware that Google is listing us as an "Attack Site" from our infection this morning. We were spidered while it happened but the infection has been resolved. We are working to resolve this with Google and will give you updates as we have them in our Site Feedback forum.

You mean this?

[Snograt]

Thanks for taking the time to register and let us know, though :)

[baltazar knight]

It don't get any warning anymore.

Btw cleaner picture:

http://i255.photobucket.com/albums/hh141/Baltazar_knight/Virusguru1.png

http://i255.photobucket.com/albums/hh141/Baltazar_knight/Virusguru1.png

[hellknight17]

Why am i getting this message on firefox now? Says guru was reported as an attack site and is being blocked according to my preferences. Any one else?

[Alex Dimitri]

I get the same massage, what is going on ?

[Hammer Drawn]

Read the great big notice above the first post....

Notices
Guild Wars Guru Reported Attack Site

We are aware that Google is listing us as an "Attack Site" from our infection this morning. We were spidered while it happened but the infection has been resolved. We are working to resolve this with Google and will give you updates as we have them in our Site Feedback forum.

[phan]

Yesyes ; Arky has been naughty

[HawkofStorms]

I would suggest NOT unticking the "tell me if site is an attack site" option on Firefox. After all, what happens if you visit a site that legitimately is an attack site? Don't decrease your security options. Just wait a few days till guru gets this resolved with google admins (who, by the way, are total pains to work with from my experience with Google Ads people).

[Unlucky Slayer]

Or you could, ya know, not go to shady sites if you do uncheck that box while this is resolved.

[Winterclaw]

Or you could use IE to visit guru for a few days.

[MisterB]

I'm using Opera(9.63) to bypass the warning from Firefox. Clearing all Guru cookies is still required before logging in with Opera. My PC was not affected by the malware.

[Lasareth]

Keep your maximum security settings on while browsing, that's always a good idea regardless of whether a site is suspected of anything or not. As for me, I am doing fine with malicious script blockers on firefox, I just turned the "notify me of suspected attack sites" option off. If you really must visit your naughty sites, just close gwg, turn it back on, and have at it. Takes like 2 seconds to do.

[MrTickle]

It's happening again. I thought it was sorted.

[Lasareth]

The infection has been worked out but the warning is still there according to the notice, unless you are getting another virus, in which case post details please.

[Inde]

As just an update, there is no update! It's still showing as "processing" from Google so we're just awaiting word. I can tell you that some of the other domains on the site have been cleared so it's really just a matter of time.

[Hyper.nl]

Guru is no longer listed as "containing malware" using Google search. By the way: what does the virus / malware do when you are infected?

[Yang Whirlwind]

The warning is still displayed if I activate the "notify me of suspected attack sites" option. So the problem with Google has not been solved yet.

The virus that was removed was a trojan (http://en.wikipedia.org/wiki/Trojan_horse_(computing)).

Just to make sure everyone is clear on this: the virus itself has been removed! It is only the Google warning that lingers now.

[Acehigh]

I don't get the warning anymore. Maybe it's been sorted now?

[Shayne Hawke]

I'm having no problems anymore navigating GWGuru with "Tell me if the site I'm visiting is a suspected attack site" flipped on.

[seut]

The warning is still displayed if I activate the "notify me of suspected attack sites" option. So the problem with Google has not been solved yet.

As far as i know Firefox downloads the attack site list to your computer and updates it regularly, maybe yours hasn't updated yet.

[Lykan]

Mine seems ok now too. No attack page and no warnings on avg/google link scanner.

[Inde]

And it's cleared! Thank you all for your patience. :)

[Lonesamurai]

And it's cleared! Thank you all for your patience. :)
20.19, Tuesday 10th Feb and still getting the warning even after updating AVG and Firefox

[Katsumi]

Clear all your cache, cookies, all that crap. It's not doing anything in my Firefox.

[Lonesamurai]

Clear all your cache, cookies, all that crap. It's not doing anything in my Firefox.
Did it and restarted too as I was having connection issues with the radio station too

[mrmango]

Had this error yesterday night, but today it's fine. I was using FF, don't have noscript, and got that red google message seut posted.
Good luck I suppose

[I pwnd U]

All fixed on this end, using FF. Good work Guru staff. :)

[Lonesamurai]

all clear on my end