Trojan Alert

[Scott Greczkowski]

We have been alerted by a handfull of users of a possible Trojan that is trying to be delivered by one of the syndicated ads displayed on our homepage.

One user got a screenshot of the ad in question and we have submitted it to our ad agencies which run the ads on our site in an attempt to find the offending ad and fix the issue.

The trojan in question (W32/Trojan3.BT) seems to effect Adobe Acrobat 8. Newer versions of Acrobat are not affected by this trojan.

As always all data on our SatelliteGuys servers are 100% virus free and we employ three different services to continuously scan our servers. In addition our servers are ceritifed virus free by Mcafee and Norton.

This issue is due to a third party server and hopefully we have it resolved shortly. I am working on reprgramming the site so that the ads are not shown on the hompage until this issue is resolved.

SatelliteGuys urges all members to run Anti Virus software on their PC's a good one we recommend is AVG which can be downloaded from AVG Free - Download antivirus and antispyware software for Windows XP and Vista, this software is free and is considered one of the better softwares out there today.

Unfortunately we must display the ads in order to survive / pay the bills which is why we serve these ads from the ad agencies. As a thank you to our supporters (who also help us pay our bills and keep the lights on here at SatelliteGuys) don't see these syndicated ads. We thankour pub members and founders for their support.

In addition the site will be down sometime today for about 5 to 10 minutes as we upgrade our software. This software fixes a number of bugs and is a necassary upgrade.

Thank you for being SatelliteGuys (and SatelliteGals too!)

 

[RandallA]

Do we know how far back this trojan started infecting computers?

 

[navychop]

Thank you for the fast work. And while you're keeping the day job, too!

 

[Scott Greczkowski]

The first alert I got was on Sunday, but the alert had no details in it.

 

[Scott Greczkowski]

The ad in question has been found and has been disabled by the ad agency. This hopefully takes care of this issue.

If you ever see anything strange like this which is a concern for us all please provide us all the details you can, including screen shots if possible so that we can quickly fix any such issues.

Thank you for your support.

 

[berck]

The trojan in question (W32/Trojan3.BT) seems to effect Adobe Acrobat 8 running unders Windows computers. Newer versions of Acrobat are not affected by this trojan.

Minor correction applied...

Also, AVG is a great product. I too, also highly recommend it for Windows computers.

 

[Poke]

Yeah I been fighting some bugs at work due to there was a bad bug break out last week..

 

[Scott Greczkowski]

Just an update, our ad agency worked to have the website serving the trojan shut down.

 

[Mr Tony]

glad to hear it scott

 

[grumpa]

Thanks for the AVG recommendation and for all the great advice.

 

[Frank Jr.]

I saw it a few times as well when I received a notification from my NIS that it was blocked. I guess I should have said something but thought it was on my end. Live and learn. Good Job though!:up

 

[dfergie]

Be on the alert for Hallmark Cards containing worms

 

[Scott Greczkowski]

Frank you hit on a good subject as there are times when users report issues and after going through things with a fine tooth comb the issue actually ends up being something else running on the members machine.

This makes things like this trojan alert hard for us to track down as we need to figure out whats real and whats not. Its a tough job, especially when the reports come in that "an add" is causing virus alerts.

We work hard to keep the site trojan and virus free as we want you coming back, this is why we take these reports seriously.

Thanks for being SatelliteGuys.

 

[Frank Jr.]

Frank you hit on a good subject as there are times when users report issues and after going through things with a fine tooth comb the issue actually ends up being something else running on the members machine.

This makes things like this trojan alert hard for us to track down as we need to figure out whats real and whats not. Its a tough job, especially when the reports come in that "an add" is causing virus alerts.

We work hard to keep the site trojan and virus free as we want you coming back, this is why we take these reports seriously.

Thanks for being SatelliteGuys.

Dang proud to be here! As always if there is anything I can do to help do not hesitate to ask.

 

[kstuart]

Not directly related... yet similar... is that IE7 periodically is crashed by Satellite Guys on my PC.

No other site crashes IE7 ... I can have several IE7 browsers and only the Satellite Guys one crashes. It has been going on for months, and only happens from time to time.

I go to other vBulletin sites, so I am pretty sure that this is due to something in the ad server...

 

[jwestpfahl]

For a brief moment this morning, the topic
2/16/2009 1:17pm - Uplink Activity Report - 60 changes

was pushing my browser to fling.com I have tried to duplicate the problem but now everything is working without issue. The first couple of times I tried to visit the topic, my page was immediately switched to fling.com. I unfortunately was not able to see which ads were being displayed at that time.

 

[trc]

I have also reported this redirection to fling dot com, to Scott yesterday by email.
Scott...why would you say that it is MY PROBLEM...having some sort of spyware/malware...when there have been reports of this buy others?

To resolve this redirection problem, I have removed ALL ADVERTISEMENTS using Firefox+flashblock+adblock.
As far as I have been testing this for 25 minuets now...redirections to fling dot com has stopped!

Scott, you still have a ad somewhere redirecting visitors!
Tim

 

[trc]

Hi Scott,
Just got your email.
Thanks for the explaintion.
Good luck with this problem!
Tim

 

[Scott Greczkowski]

Three people have reported it overnight.

After logging out and hitting refresh many times I got it to happen to me, so its not a Spyware issue (was testing on a Mac)

Going through our ad networks I found which one it was coming from and have been recoding to remove that ad network entirely from serving ads to SatelliteGuys. (This ad network has been having this issue too much lately and has been very slow to respond to these issues... I guess they are ok with these ads since they are getting paid and are slow to remove them... something I do not like at all!) So far I am about halfway done as its a pain as the ad networks are chained together.

I hate these things as much as you guys do and thank you for bringing them to my attention when they happen.

While I fully understand why people would use adblocker software I would urge folks not to (not that I can stop you of course) as with the economy the way it is ad dollars are not what they use to be and the cost of running the site keeps on going up as we keep getting more and more popular. But again I fully understand if you do. Also remember you can get rid of the syndicate ads by becoming a pub member for under $20 a year which helps to offset the cost of those ads running and helps us to keep the lights on for all.

Again I do work hard to keep the site clean so if you see anything like this please report it so that I can try fixing them as soon as I can. Hopefully by removing this ad agency the problem goes away.

Again my apologies to all who have had this issue.

 

[The Insider]

I dont know why anyone would still browse the web without a program like ad-block running. Makes the web so much faster.