Virus?

I was surfing this site and got a virus notification from McAfee....

virus name was some trojan called vundo!grb

We use McAfee at work and I have Norton at home. So far I have not seen either report a virus or trojan.

This might be better in The Outer Circle forum.

I just visited this thread, and got an automatic download request for a pdf file. =/

same here, symantec caught it for me.

While you're at it make sure it's not one of the several variations of Conficker that's been going around, you can test if you have conficker at http://www.confickerworkinggroup.org...feyechart.html

Hmmmm, nothing unusual for me. Don't tell Inde I said so, but maybe you should consider switching to firefox as using something to block giraffes.

Nah nothing unusual for me either...

Good news: this is a low-profile malware, nothing like a virus.

Bad news: you're probably using Internet Explorer?

Kill the giraffes...

Sounds like it could be a hijacker as well. I do agree with the above, switch to Firefox as well.

Oh by the way, I use Avast and Firefox, and have had zero issues with this site.

If you are having virus/spyware issues, download malwarebytes (google it). I have Spybot S&D and Symantec antivirus. Malwarebytes found a ton of stuff that the other 2 didnt find. Oh and its FREE!

While browsing the riverside Symantec came up with the warning for Bloodhound.Exploit.196. There was also a request to download an Active X control which was denied.

i dont think this is the usual hacking, it could be an actual ad with a virus from our regular ad provider, if you could provide the whole virus report + a screenshot of the page with the ad that got the virus report

Starting yesterday some forum links send me off to a site blocked by my AV software. The site I am redirected to is http://boqwez.info/rp/in.php. Has the guru server been hacked?

For kzap - Today, I was trying to access http://www.guildwarsguru.com/forum/s...php?t=10366819 when I got redirected. I am sure this is what the others were reporting. Attempting a second time I was able to access that thread with no problem.

Snapview.ocx is a control that comes with Access. It used to silently download and automatically itself in the background, being a Microsoft-signed control. At which point, vulnerabilities in snapview.ocx would be used to exploit a user's machine.

This mode should outdated for these reasons:

1) the vulnerabilities are (in theory) fixed for any user with updates past mid-August 2008, or anyone who has XP SP3 or Vista
2) If your security settings for MIE are properly setup, you should be prompted to download the control
3) The average user has no use for it, so you don't have to download it when prompted.

Bloodhound.Exploit is a generic Symantec label for the file (or files) which downloads and open a pdf via the Adobe Reader. The pdf then loads a site which infects your computer; in this case, the malware in question is Vundo, a well-known and prolific trojan that, while not particularly dangerous, is extremely annoying, causes severe system degradation, and hard to remove.

I've included some basic protection and removal instructions here. For downloading most of the files mentioned in this post, you may wish to use Tarun's Anti-Malware Toolkit. His company's wiki at Lunarsoft has a lot of good advice on more in-depth cleanup and security. If this post doesn't help you remove Vundo from your system, head over to the Technician's Corner.

The best way to protect yourself is:

Internet Explorer (if you must...): SpywareBlaster, Spybot: S&D (use immunization, disable TeaTimer)

Other useful protection:

Internet Explorer (if you must...): ZonedOut w/ IE-SpyAd

Make sure that you have the latest Windows and Java updates. Windows Defender is decent Real-Time Protection.

Get an Anti-Virus program. There are several free AVs that are okay:

Avira
Avast!
AVG

Also make sure your security is properly configured for:

1) FireFox: Tools -> Options -> Security:
- Warn me when sites try to install add-ons: Yes (in particular)
2) Internet Explorer (if you must...): Tools -> Internet Options -> Security -> Internet:
- ActiveX: Disable Everything. Use Trusted Sites for ActiveX functionality.

To remove Vundo:

CCleaner
Malwarebytes' Anti-Malware
SuperAntiSpyware

Download and update each program. Restart into Safe Mode (F8).

Run CCleaner with these settings:

Cleaner -> Windows -> select everything except for:
- System -> select everything except Memory Dumps and Windows Log Files
- Advanced -> only select "Old Prefetch Data"

Note: selecting the Autocomplete Form history deletes your saved passwords.

Cleaner -> Applications -> select everything

You will need to close FireFox in order to clean its temporary files.

Registry -> select nothing
Tools -> ignore this part

Click "Run Cleaner."

Run SuperAntiSpyware, specifically with these settings under Preferences -> Scanning Control:

- Close browsers before scanning
- Scan for tracking cookies
- Terminate memory threats before quarantining

Note: These settings are targeted specifically for the removal of Vundo, not for more general scans.

Run a complete scan on your primary hard drive.

Run Anti-Malware, with every box enabled under Settings, including "Terminate Internet Explorer..."

Run a full scan on your primary hard drive.

If Anti-Malware prompts you to reboot to finish cleanup, do not reboot into Safe Mode; this will cause the next phase of cleanup to fail. Restart normally.

Finally, run a complete scan with your anti-virus program (using updated definitions).

Why would they not consider it? We've selectively wiped out posts on software that is likely prevent infection, we've delayed on making announcements for a problem that is confirmed both internally and externally, and we've provided almost zero help or advice on removing the infection. This comes only two months after being spidered by google and listed as an attack site. The only good thing is that kzap has (so far as I can tell) removed most of the problem ads from the rotation.