Trojan on TPU

[W1zzard]

next time you get an ad that gets blocked, please click view source and locate the html code for the banner ad that causes it so we can slap the ad company around

 

[TheMailMan78]

The ads we host are usually QNAP, Caseking, OCZ, etc....additionally we let the ad-agencies closest to you host ads. So you have ads specific to your region. I never end up with a tracking-cookie. Those from realmedia, etc., are harmless and can be easily removed/blocked. The ads I get ask me to buy overpriced Dell notebooks, invest in pension plans, etc., since the agency is local to me. Those 2~3 ads we have on the frontpage help support TPU. They are harmless, we have neither interests in nor intentions of violating your privacy.

Bta no one in their right mind would expect a site like this to survive without Ad support OR invade its members privacy. No one is questioning that. I can tell you I'm not. I understand this isn't TPU fault.

However there is an issue. The one I picked up was a trojan. Is there a way TPU can still advertise to make money and keep us from being bombarded with tracking cookies and trojans?


Edit: I see Wizz is already on the ball. Thank you!

 

[95Viper]

That not a nice site.
Norton says,https://safeweb.norton.com/report/show?name=we1woiea.com

This Norton site is easy and neat:https://safeweb.norton.com/

 

[Nick89]

UM WTF https://safeweb.norton.com/report/show?url=www.techpowerup.com&x=0&y=0

Total threats found: 2
Drive-By Downloads (what's this?)

Threats found: 1
Here is a complete list: Threat Name: Process Started
Process name: C:\WINDOWS\system32\cmd.exe
Location: http://www.techpowerup.com/articles/overclocking/voltmods/112




Viruses (what's this?)

Threats found: 1
Here is a complete list: Threat Name: W32.IRCBot
File name: C:\Program Files\ATITool\ATITool.exe
Signature (MD5): 540460e8c405ad48f59545eda902bc78
Location: http://dl.techpowerup.com/Tweaking/ATITool/ATITool_0.25b9.exe

I know these are false positives but they really need to update there site.

 

[Basard]

two threats found now ^^ at that norton site for techpowerup.

man, i just went to take a dump..... leaving techpowerups's homepage up the whole time (stupid)..... i come back, and i've got 3 weird ass program's running in task manager.... (using firefox the whole time) and all the sudden Internet explorer wants to open up about 5 times.

this is lame. what's it been about a month now this is going on?

 

[TheMailMan78]

man, i just went to take a dump..... leaving techpowerups's homepage up the whole time (stupid)..... i come back, and i've got 3 weird ass program's running in task manager.... (using firefox the whole time) and all the sudden Internet explorer wants to open up about 5 times.

this is lame. what's it been about a month now this is going on?

Report the ads to Wizz.

 

[PVTCaboose1337]

O SHI-

I think I found the threat. While in IE, funky stuff started going down on this add up top:

 

[mtosev]

google chrome doesn't have a problem

 

[oli_ramsay]

nor does Opera

 

[Polaris573]

Threats found: 1
Here is a complete list: Threat Name: W32.IRCBot
File name: C:\Program Files\ATITool\ATITool.exe
Signature (MD5): 540460e8c405ad48f59545eda902bc78
Location: http://dl.techpowerup.com/Tweaking/ATITool/ATITool_0.25b9.exe

The one for ATItool is a false positive. Sometimes AV software reports ATITool or GPU-Z as malicious programs because they view/modify driver files. Wherever you got that information hasn't been updated in years. If it makes you feel better I clicked the link, download the file, and scanned it with no result. It's a link to our download server containing an old beta of ATITool. Most likely ATITool contains code somewhere in it that is similar to a trojan (this is not uncommon for software I can list a whole slew of quality programs that get flagged falsely by Anti-Virus for this reason) and it was flagged by a heuristic scanning engine of some AV as a precaution until it was verified as safe.

 

[TheMailMan78]

The one for ATItool is a false positive. Sometimes AV software reports ATITool or GPU-Z as malicious programs because they view/modify driver files. Wherever you got that information hasn't been updated in years. If it makes you feel better I clicked the link, download the file, and scanned it with no result. It's a link to our download server containing an old beta of ATITool. Most likely ATITool contains code somewhere in it that is similar to a trojan (this is not uncommon for software I can list a whole slew of quality programs that get flagged falsely by Anti-Virus for this reason) and it was flagged by a heuristic scanning engine of some AV as a precaution until it was verified as safe.

Polar this seems to be some kind of little epidemic. Its not just one trojan or tracking cookie but a bunch of different things. Hell look at the one I found Win32/Swif.M.

What's up with this man? I'm getting worried I may have to cut down my viewing time on TPU

 

[Silverel]

I use Chrome for websurfing.

Spybot, TrendMicro Officescan, and Avast are always running.

Avast is the only thing with something interesting in it. Some warning popped up a minute ago, but I haven't been able to find a log of it just yet...

 

[Polaris573]

Polar this seems to be some kind of little epidemic. Its not just one trojan or tracking cookie but a bunch of different things. Hell look at the one I found Win32/Swif.M.

What's up with this man? I'm getting worried I may have to cut down my viewing time on TPU

I can't speak for the ad companies all I can say is that for ATITool Symantec corporate detects nothing and false positives are common especially since version 25b9 is from 2005/2006 when ATITool was a lot less common (more likely to return false positives). Once again the page citing it as a trojan probably hasn't been updated in almost 4 years. ATITool is not a virus unless you want to believe that w1zzard made ATITool to create a massive bot net and not for overclocking. If it makes you feel better I'll have him check ATITool, but I'm fairly sure he is aware of the ad problem.

 

[W1zzard]

that report on 25b9 is a false positive due to the way the exe is compressed. why are you worrying about that now after 2 years?

 

[TheMailMan78]

I'm not worried about 25b9. I'm worried about all the other hits people are getting on here from the front page. Win32/Swif.M and such.

Edit: However I know you (Wizz) are aware of the problem. It just sucks I have to keep checking my task manager. I have OCD after all. :shadedshu

 

[W1zzard]

so far there has been no useful input to pinpoint this problem to a certain advertiser

 

[TheMailMan78]

Ok when I get home Ill play the lamb and see if I can get the info for ya.

 

[mtosev]

so far there has been no useful input to pinpoint this problem to a certain advertiser

can't you check every advertiser and eliminate them one by one?

or remove all the ads from the site? i think that the users would like that. (the ads must pay really good for the traffic that Tpu has)

 

[Silverel]

http://www.d-addicts.com/forum/viewtopic.php?p=1147868

Its an Adobe Acrobat Reader exploit that may have infected the ad companies server. I still haven't found a way to pinpoint which ad it comes from on TPU though. Disable Reader in your browser settings and it breaks... Obviously not the ideal solution. You can also upgrade your version of Reader, which should fix it as well. Or use FoxIt.

 

[PVTCaboose1337]

I am posting the ad that has been blocked by NOD32. Here is the page source.

 

[W1zzard]

I am posting the ad that has been blocked by NOD32. Here is the page source.

thanks a lot. advertiser blocked. please keep an eye out if that solved the problem

 

[PVTCaboose1337]

thanks a lot. advertiser blocked. please keep an eye out if that solved the problem

Thanks very much for your help! I will keep checking if any more of those happen!

 

[PVTCaboose1337]

So far, 250 refreshes, no blocked ads. I think we might have gotten it, but waiting for other members to confirm.

 

[Nitro-Max]

Can i just say guys ive had a mass infection before without even opening IE just after a fresh install of xp so now i always make shure im not connected to the net now untill i get my virus protection installed.Its only ever happend theonce but best to be safe.

 

[DaedalusHelios]

Can i just say guys ive had a mass infection before without even opening IE just after a fresh install of xp so now i always make shure im not connected to the net now untill i get my virus protection installed.Its only ever happend theonce but best to be safe.

Thats probably from someone else on your network(another computer etc)