Virus from Badass?

Guys, recently a guy named Dave emailed me about some shocks I listed on CL for his RMS and told me he had a few other cars, told him to join the forum. This is nailhead445. He was able to make one post, but not being familiar with the place, clicked one of the stupid ads up the top of the screen by mistake. I'll let you see what has happened from here on in-

Quote :

Hi Matt: I took your advice and so far so good, but the site has some quirks that are driving me nuts. In the beginning, I bit for some "Download Manager" that it appeared was needed. But it wiped out my home page and added another task bar which now I can't get rid of. Finally deleted the download and got my home page back, but the download button is always looming at the top of whatever page you're on, saying "Click here to start download", and it doesn't even say what the download is. Then it keeps changing it's message..."Download & play" and such. Very annoying, and seemingly unnecessary. Posted an ad for some stuff I have, just to have some reason for navigating around, but it seems very clunky to me and I don't recognize any of the icons or methods of loading and sending pictures. One or maybe two people have responded, but I can't figure out whether to respond with a post or a private message or what. And I'm gettin' kind of tired of wranglin' it for today. Eventually, I think it will be a good thing.
Thanks,
Dave

Seemed like just some new to the forum needs, but I think it's worse:

Quote :

Matt: I'm just getting so frustrated with this thing. Whenever there's a new message, like the one from you that I'm responding to right now, I can't just retrieve it through the forum, because there's nothing there. I have to wait for an Email from AOL notifying me that there is a new message, then copy the link (Because it isn't even a true link) and then paste it to the browser. Then it leads me to the forum. Usually I have to log in all over again each time, just to retrieve the message. Then to respond to it I have to go to your profile just to get a dialog box to respond in. This is just too much trouble. I've got an entire AOL page filled up with notices and links to paste....just to respond to an inquiry! It would be easier just to put my Email address in my profile and tell everyone if they want to contact me just to do it that way.

Quote :

Had to do the link process all over again. The homepage that it set up was called "Ilivid" (Illicit would be more like it)

Quote :

Matt: What a mess this has become. The operators of the BADASS site are doing a serious disservice to their members by allowing that Download button to remain on their site. I started at 6AM this morning and have been working continuously to undo the destructive effects of this iliivid thing. The internet is filled with pleas from people trying to gain information on how to get rid of the thing. In most of the discussion forums it is referred to a a virus. As soon as it gets into your computer, it starts replacing task bars, search windows, peripherals etc. I tried uninstalling them, but there are so many deep files that you don't even know what they're called to get rid of them. I tried using Windows restore, and a message came back saying that it was prevented from using the restore point...probably by the malware. Things that used to take a fraction of a second to accomplish on my computer now take minutes, if they still work at all. I really need this computer for business. I'm not sure how I'm going to get it back to normal operation. Probably another 3 or 4 hundred bucks at the Geek Squad. If you know these people, tell them to get that thing off of there before anyone else gets sucked in.
Dave

Is there any way to remove that crap from the forum so this doesn't happen to anyone, Dave seems like a knowledgeable guy along the lines of Machine-de-Zine and others who have been around full size GMs for decades from his correspondence before joining, so I asked him to join us here, but now I feel terrible that this has happened right as he signed up for Badass. I told him to install Malwarebytes, run some scans, etc., to see if it clears anything up. Any ideas what happened?

He has contacted me. I am looking into the problem. According to Dave, he was prompted to hit a "Start Download" button. I am not sure at which point this would have happend. There is nothing to download. If it happened during registration, or after. I need to know if anyone else is having any similar issues. Was it infact that Dave clicked one of the above ads. I don't know, but still, it should not be installing anything.
I am going to speak with forum support and see if they have any answers.

I am sorry for the problems you are having Dave, I am working to get some sort of answers.

Bill

Thanks Billy-

I did see the buttons Dave speaks of, they appear in the ad area at the top of the page below the BADASS banner, one will say PLAY and the other DOWNLOAD, of course I have not clicked them to see where they went. I think Dave might have clicked them, and been prompted one of the download boxes that Windows uses whenever you download a file from a site (kind of like when you install a new AV program from CNET, etc...) thinking it was a requirement from the forum. I told him they are just ads and not to click anything there!

So
I have turned off the ads for now. I will need to bring them back, but if these are what you were clicking, please don't!

Bill

Just for the record. I never saw whatever he did. I have my computer locked down pretty tight and I'm here posting gibberish all day and ive never gotten a virus from here.

Have him run the big three: HijackThis, AdAware and somethin' I can't remember.

http://forums.fortress-forever.com/showthread.php?t=15104

Wait now I remember, it was SpyBot S&D.

You should never download from any site that you don't trust; except for porn of course, it's a risk acceptance thing.

boojum wrote:

Have him run the big three: HijackThis, AdAware and somethin' I can't remember.

http://forums.fortress-forever.com/showthread.php?t=15104

Wait now I remember, it was SpyBot S&D.

You should never download from any site that you don't trust; except for porn of course, it's a risk acceptance thing.

LOL!

1984twodoor wrote:

boojum wrote:

Have him run the big three: HijackThis, AdAware and somethin' I can't remember.

http://forums.fortress-forever.com/showthread.php?t=15104

Wait now I remember, it was SpyBot S&D.

You should never download from any site that you don't trust; except for porn of course, it's a risk acceptance thing.

LOL!

I don't go to such trashy websites!

























































that often....

Cadet57 wrote:

Just for the record. I never saw whatever he did. I have my computer locked down pretty tight and I'm here posting gibberish all day and ive never gotten a virus from here.

When they were still up, I did see that "ad" in the adspace at the top. It was basically two buttons, one that said "DOWNLOAD" and another that said "PLAY NOW" or something to that effect, it was just the two buttons. I forget when I'd first noticed them, but they'd been there for maybe a week or so at least? I've never gotten a virus from here either but those buttons def. were there. I think the forum "needs" ads to support itself but I wish there were a way to screen them...it's definitely something that shouldn't have been clicked on!

Obviously an blatent sabotage by the big board to drive down the value of the site.

Dont spend those checks yet.....

The Download Now ad is still there if you are not logged in.

I've seen that ad frequently

have him download and run this

www.malwarebytes.org

this will get rid of anything... I use it on nearly all my contract jobs... and it pays me $75/hr to download and run this program to clean them.
Geek Squad charges $300 to do the same thing
http://www.geeksquad.com/services/computers-networking/virus-and-spyware-removal.aspx

I think my rates are pretty reasonable considering my vast years of experience as a network, systems and security engineer

also, install this:
http://adblockplus.org/

I don't get the ad when I've got it enabled

chapel wrote:

I've seen that ad frequently

have him download and run this

www.malwarebytes.org

this will get rid of anything... I use it on nearly all my contract jobs... and it pays me $75/hr to download and run this program to clean them.
Geek Squad charges $300 to do the same thing
http://www.geeksquad.com/services/computers-networking/virus-and-spyware-removal.aspx

I think my rates are pretty reasonable considering my vast years of experience as a network, systems and security engineer

also, install this:
http://adblockplus.org/

I don't get the ad when I've got it enabled

Yep, like I said I told him to run Malwarebytes right away and it should clear it all up. That program is amazing. It's funny, one of my friends I THINK used adblockplus to make Facebook go back to the way it was a few weeks ago before it got all weird. LOL

Why would you click on something that says "download now" when you have no idea what it is or if its even safe in the first place?

Cadet57 wrote:

Why would you click on something that says "download now" when you have no idea what it is or if its even safe in the first place?

Technologically Impaired Duck!

http://knowyourmeme.com/memes/technologically-impaired-duck

Cadet57 wrote:

Why would you click on something that says "download now" when you have no idea what it is or if its even safe in the first place?

https://www.dailymotion.com/video/x557tg_nick-burns-your-company-s-computer-guy_fun

Christ, haven't you guys talked to anyone born before 1970 before? Plenty of people haven't used computers until recently, my dad worked with them until like 1990 and now he has not one clue on how to use a "new" one, that has sucked for me showing him how to use shit. Personally I don't think it's uncanny that the guy came to a random website for the first time and thought that a big banner with just two buttons completely blended into the rest of it was a necessary item to use before the forum kicked in.

Quote :

You know, I never touched a computer 'til I was about 35 or 40 (User friendly stuff and the internet just didn't exist). So I've stayed out or trouble (Up until now) by just doing basic simple stuff. I know if I try to go any further with a fix, I'll just make it worse, so I'll just try to get used to it the way it is. One of the guys who was interested in my parts asked for some pictures. Tried to send them through the forum and got some message about only pictures from a publicly accessed domain are allowed. I told the guy to just give me a regular Email address and I'd send them attached. I may have built an electronic ignition system, and installed it in my 1955 Chrysler 6 volt, dual point, positive ground ignition system in 1962, but I think I'm just too old to fight my way through this stuff.
Dave