FFXIAH infected again?

:O MY HOPES AND DREAMS!!!

In all seriousness, smart browsing habits are going to go much farther for a user than use of a particular browser than another.
 
Javir, that noscript thing is damned annoying lol
 
It CAN be annoying, but, imo, it's worth the time to install, sure, it can be a pain to "temporarily allow xx" every time you want to view something. Or, in my case, as right now, to even post something on a forum.

However, I HAVE had incidents where i-frames have popped and 'lo and behold, some pos program is trying to send out packets, much to my dismay. Luckily, knowing what should and shouldn't be allowed to access the web prevented any number of bad things happening to my computer.
 
Just for those who think they are immune to everything because they use firefox which magically makes them superheroes, I performed an experiment on my laptop here. I installed Adblock, Noscript, and Flashblock on my laptop's firefox and left their default settings (which is how 95% of users are likely to use them) and then went to ffxiah.com. It immediately managed to force my laptop to run a program that infected my laptop with Virtumonde (also known as Vundo or Virtumondo). So just so you know, you aren't always as safe as you think you are. Make sure you know how to use these plugins correctly.

As an aside, if you're curious about how to get rid of Virtumonde if you manage to get it, most commonly used programs (spybot, adaware, etc) aren't going to get rid of it for you. I was able to successfully remove it with freeware though by doing the following:

1) Download ATF-Cleaner and Malwarebytes' Anti-Malware. Make sure that the latter has the newest updated files for it.

2) Disconnect from the internet and reboot (stay off the net till you're done). Run ATF-Cleaner, "Select All" and "Empty Selected".

3) Run a full scan with Anti-Malware and have it fix everything it finds. Reboot again.

Should be gone after that. If you do use SpyBot, make sure you turn off TeaTimer because it usually screws with other anti-virus programs.
 
Last edited:
Rappa said:
Just for those who think they are immune to everything because they use firefox which magically makes them superheroes, I performed an experiment on my laptop here. I installed Adblock, Noscript, and Flashblock on my laptop's firefox and left their default settings (which is how 95% of users are likely to use them) and then went to ffxiah.com. It immediately managed to force my laptop to run a program that infected my laptop with Virtumonde (also known as Vundo or Virtumondo). So just so you know, you aren't always as safe as you think you are. Make sure you know how to use these plugins correctly.

As an aside, if you're curious about how to get rid of Virtumonde if you manage to get it, most commonly used programs (spybot, adaware, etc) aren't going to get rid of it for you. I was able to successfully remove it with freeware though by doing the following:

1) Download ATF-Cleaner and Malwarebytes' Anti-Malware. Make sure that the latter has the newest updated files for it.

2) Disconnect from the internet and reboot (stay off the net till you're done). Run ATF-Cleaner, "Select All" and "Empty Selected".

3) Run a full scan with Anti-Malware and have it fix everything it finds. Reboot again.

Should be gone after that. If you do use SpyBot, make sure you turn off TeaTimer because it usually screws with other anti-virus programs.
Click to expand...

Does Hijack this pick it up?
 
I stopped visiting ffxiah.com since the first hacking incident. Now I have even less reason to re-visit.
 
Gohaan said:
Does Hijack this pick it up?
Click to expand...

Not very well, unless you really understand how the program works and can diagnose things from it. For example if you use one of those online log checkers it'd fine nothing.
 
No-script is kind of stupid in that the basic settings still allow I-frame, which is what they use to infect you. For no script to actually protect you, you need to block them as well.
 
I did as Rappa suggested and got those two programs. I'm clean :D
 
Be advised looks like FFXIAH may have a bad ad again. I just visited the site and it attempted a popup that set off Acrobat PDF Suspicious File and Malicious Toolkit Variant Activity 2 warning in Symantec Endpoint.

One of the IPs that served the exploit traces back to a know malware company. The other went to a hacked website that now appears to have been taken offline. The top banner ad on FFXIAH has also gone missing, so I assume they are aware of it.
 
Last edited:
You must log in or register to reply here.
Back
Top