1. Hey there Guest,

    The game servers have moved to semi-dedicated hardware and IPs have changed. Please see front page server widget for up-to-date game server information.

What the heck is this? (Malicious page potentially accessed via TF2Maps)

Discussion in 'Off Topic' started by PL-7764, Sep 19, 2009.

  1. PL-7764

    PL-7764 L6: Sharp Member

    Messages:
    376
    Positive Ratings:
    84
    I was opening tabs with a few threads here from that page reached from the "New Posts" link on the homepage when all of a sudden, the page (the "New Posts" one) changed to an obvious virus page with a pop-up that said "Warning! Your PC is in danger and needs to be scanned and cleaned now!" and proceeded to repeatedly attempt to download an .exe file (I canceled every time). It brought up a bogus page with a phony "virus scan" claiming to find tons of "problems," and alternated between bringing up that awful "Warning! Your computer is in blah blah blah" pop-up and the attempted download. Upon trying to navigate away from the page it kept popping up more crap saying "But you need to scan now!!" I almost had to totally force-quit Firefox to get rid of it (managed to get the tab to close eventually).

    I haven't installed any new and/or suspicious software recently that would potentially trigger Firefox to open such a page. The only thing I've installed recently was an upgrade to a paid-for and trusted professional music editing program. The only pages I had open were TF2Maps threads accessed via that "New Posts" page and said page itself. The only logical conclusion I can come to with my admittedly limited knowledge of this situation is that something within that TF2Maps page may have triggered that bad page coming up.

    I'm going to run a full virus scan overnight to make sure it didn't get anything onto my system. Does anyone know what might cause such a bogus page to pop up? Was it something I got from the TF2Maps page? I didn't click on anything except the unread threads linked from that page.
     
  2. LordNor

    LordNor L3: Member

    Messages:
    134
    Positive Ratings:
    15
    o_O did you have any other shady tabs open other than TF2Maps.net? idk run ur virusscan....what program you use? .....also.....didnt you know *conspiratorial whisper* TF2maps.net = hax website :p
     
  3. Terr

    aa Terr Cranky Coder

    Messages:
    1,591
    Positive Ratings:
    405
    Probably some sleazy concern buying a banner ad from the banner ad network.
     
  4. Chaopsychochick

    Chaopsychochick L4: Comfortable Member

    Messages:
    189
    Positive Ratings:
    91
    I just got that now as well, and have not had any troubles with any other site. So there may be something wrong with the banners or tf2maps.net could have been hacked... Which would have sucked. :/ Regardless, that thing is really annoying and I hope it does not appear again.
     
  5. owly-oop

    aa owly-oop im birb

    Messages:
    817
    Positive Ratings:
    1,176
    i blame the ads


    sue the ads and get the money so you wont need ads
     
    • Thanks Thanks x 1
  6. Shmitz

    aa Shmitz Old Hat

    Messages:
    1,129
    Positive Ratings:
    742
    This is why I run AdBlockPlus, and only allow one or two very select ad networks through.
     
    • Thanks Thanks x 1
  7. drp

    aa drp

    Messages:
    2,256
    Positive Ratings:
    2,572
    its probably a malicious ad in the adnetwork. if you can give me the url of this page, i can call burst media and shout at them.
     
  8. drp

    aa drp

    Messages:
    2,256
    Positive Ratings:
    2,572
  9. PL-7764

    PL-7764 L6: Sharp Member

    Messages:
    376
    Positive Ratings:
    84
    The one I saw was called "VirusDoctor" in the page header, according to my browsing history.

    McAfee ran overnight and found 3 known trojans, all in the browser cache and associated with that webpage, so I cleared my cache to hopefully get rid of them and anything else.

    Here's the URL taken from my history: http://rootscan.info/25/24-033wLyEzLGBzL==
    Click at your own risk!
     
  10. littleedge

    aa littleedge L1111: Clipping Guru

    Messages:
    983
    Positive Ratings:
    599
    I got the same thing. That rootscan.info thing. I got it this morning, and did a Virus Scan with Avast! right after I got it to close, just in case.
     
  11. drp

    aa drp

    Messages:
    2,256
    Positive Ratings:
    2,572
    i turned off all the ads until i can get this taken care off. sorry guys.
     
    • Thanks Thanks x 3