Spyware scan redirect on home page,

Fri, Jun 5 2009 17:15
lustacular
Posts 77

Am I the only one getting a browser redirect to a spoof spyware/virus scan when I visit the Peachy homepage? It started late last night/early this morning for me. Happens every time now.

Fri, Jun 5 2009 17:39
PeaceDog
Posts 1,617

Yes it has infected Mozilla Firefox on my work computer (this morning) and home computer (just now in the evening).  I'm not sure if it also infects Internet Explorer. 

Fri, Jun 5 2009 19:02
finbar
Posts 6

Me too, whenever I open up a new link in Firefox from PeachyForum I get a script running that links to a spyware scan

Fri, Jun 5 2009 19:20
lustacular
Posts 77

I'm using IE, so it does. I notice some of the ads on the site are new as well, so I wonder if they are the cause.

Fri, Jun 5 2009 21:18
funky2004
Amsterdam
Posts 90,340
Retired Moderator

It has nothing to with Peachy homepage.

Check your computers for DNS Changing malware !!  Most probably that Ukranian trojan caught you off-guard.

(....and use an AntiVirus program which is updated at least once a day !!)

Sat, Jun 20 2009 8:50
TopCat22
Posts 555

I had this same thing happen to me and it must be a bug on peachyforum. Im now also getting a re-direct on peachy to a blank page: http://pages.etology.com/imp2/64434.php

I think its the adverts causing the problems

 

Fri, Jun 26 2009 10:51
satanicus
Posts 96

I got this on Saturday, and Peachy was the first site I hit after checking my Gmail. It was a stubborn bastard, with all sorts of false screens. I ran a scan w/Super antispyware (which has worked very well for me in the past) but before it could finish scanning I got a (probably fake) blue screen which I couldn't get out of.

I ended up doing a system restore to a couple of days earlier--luckily, I hadn't really done anything important in the intervening time, so I didn't lose anything.

Don't doubt that it was from the Peachy home, it started downloading itself as soon as I brought up the page and hadn't clicked on anything yet.

Just saying, is all...

Fri, Jun 26 2009 20:47
PeaceDog
Posts 1,617

I have also been having problems on only one of my  2 computers and only with it's Firefox program.  My other computer with Firefox isn't bothered.  Neither does it seem to infect Internet Explorer.

Sat, Jun 27 2009 9:45
SLY9
Posts 96

This happens to me sometimes.  It's malware embedded in the advertising on Peachy. Since the ads rotate, not every visit will infect.

 

Sat, Jun 27 2009 11:36
Vatsis
cold capital of Finland
Posts 3,384
Moderator
SystemAdministrator

What is the name or URL of the spoof spyware virus scan? Is only Firefox affected? And what is the country you are from?

I'm trying to gather the evidence for the advertising network managers that one of the advertisers is running redirect script...

Sat, Jun 27 2009 11:50
funky2004
Amsterdam
Posts 90,340
Retired Moderator

[quote user="Vatsis"]

What is the name or URL of the spoof spyware virus scan? [/quote]

It's that url mentioned above:  pages.etology.com/imp2/64434.php causing that havock.

It's still active today.  Not sure which ad is triggering it. 

Only remedy I figured out sofar is blocking cookies from that site and block site alltogether in IE8 (haven't been able to find out a way to block a complete site in FF).  It's affecting both FF and IE browsers.  Not only redirects but also causing serious damage to browsers.  In 1 case I had to uninstall and install IE8 again.

Fri, Jul 3 2009 11:13
FoggyNotion
Posts 42,935
Moderator

Sounds like there is a lot of this type of thing about. I found this information, maybe not exactly the same as experienced here, but certainly similar

http://www.theregister.co.uk/2009/05/30/mass_web_infection/

 

Thu, Jul 9 2009 22:08
SLY9
Posts 96

More info regarding the trojans coming through Peachy ads:

 

Earlier I opened the Peachy home page OK.  I clicked on a discussion thread and noticed that my Java suddenly was activated and I was getting inundated with data from srv.v-i-e-w.net (that's the site verbatim, hyphens and all.)

This is a known malware source.  See: http://safeweb.norton.com/report/show?name=v-i-e-w.net

I added the following to my hosts file as a precaution:

127.0.0.1    srv.v-i-e-w.net

 

Sat, Aug 1 2009 13:44
SLY9
Posts 96

Today I got hit again, presumably from malicious code in one of Peachy's ads.  This one downloaded its payload from sva.a-s-x.net

Again, this uses embedded Java commands and installed the following on my computer:

Trojan.Downloader
Trojan.Agent
Trojan.FakeAlert
Malware.Trace
Trojan.TDSS
Trojan.Dropper


Tue, Aug 4 2009 11:59
spybot
Posts 61

It is defiantly coming form the Ads on Peachyforrum site, I have hit it twice. It is not that big of a deal if you have the right software but it is defiantly something Peachy needs to work on. Google has a couple of complaints and if they get a few more then PeachyForum will get the dreaded "This site is not safe" when you click Peachyforum. if that happens it will be the death of this site. A good site advisor will help but once again Peachy has been turned in and most site advisors will give you a "not safe" site warning.

 

 

hope the admin is taking this threat seriously, if not Google will give Peachy a site advisor of "NotSafe" and that will end of this site.

Thu, Aug 13 2009 15:41
pinkbits69
Posts 351

I got a stinker from here, i ended up rebooting with provided disc, first time i went on peachyforum and it came straight back, closing firewall, then spoof scanner popped up, all as before. I rebooted again, i have broused for a good few day's with no problems, this is my first time back here. Good luck all.

Sun, Aug 30 2009 1:34
markjuicy
Posts 409

when i type this in my browser PEACHYFORUM.com

 

 

ist this the site where comes !!!! :-((((((((((((((((((

 

http://www.iis.net/

 

Whats wrong with this shit ????

Sun, Aug 30 2009 3:25
markd88
Oilyann NY
Posts 64,960
Moderator

[quote user="markjuicy"]

when i type this in my browser PEACHYFORUM.com

 

 

ist this the site where comes !!!! :-((((((((((((((((((

 

http://www.iis.net/

 

Whats wrong with this shit ????

[/quote] 

I had that problem also/ See 2nd post.

http://peachyforum.com/forums/t/273029.aspx

 

But as of now, it is working OK, At least for me?

Mon, Aug 31 2009 8:15
funky2004
Amsterdam
Posts 90,340
Retired Moderator

[quote user="markjuicy"]

when i type this in my browser PEACHYFORUM.com

ist this the site where comes !!!! :-((((((((((((((((((

http://www.iis.net/

Wats wrong with this shit ????

[/quote]

 

Use http://peachyforum.com/forums/ as main URL, also in your bookmarks.

If your browser allows it also change setting by blocking all cookies from clicksor.com and myroitracking.com.

Sat, Sep 5 2009 13:07
Gohan
Fuerteventura (Canarias)
Posts 621

[quote user="funky2004"]

Use http://peachyforum.com/forums/ as main URL, also in your bookmarks.

If your browser allows it also change setting by blocking all cookies from clicksor.com and myroitracking.com. [/quote]

Thank you.   It caught me earlier today.  Had to reboot almost everything.   I despise those people doing this.


Sort Posts: