Ok, we have shut off all ads served from sources outside our network.  The only ads running are being delivered from MMORPG.com (we also kept the DoubleClick hosted ads since I am 99.9% sure they are not the source being they serve over half of the ads on the Internet)

Please report as much detail of any new findings!

Originally posted by forinboy

Yes I got it here too, AV software caught it.  Using latest firefox. 

Thats strange, I use Firefox and I have not had it happen to me.  Do you have the ad/script blocker plugins enabled?

I would be inclined to think that it is something that is happening on the advertisers side of things as people over Allakhazam (which displays very similar, if not the same game related ads) have been getting the same popup.

Incident occurred for me at right about 1345 my time, ~10 min ago.

Using IE6, Win2k machine.  Popup dialog from XPAntivirus as per other reports.  I decided it was scareware immediately upon observation and delivered Alt-F4 to IE in case a malware trigger was on the faked dialog's "close" button.

I had been browsing Szark's GDC blog entry regarding Stargate at the moment the popup was delivered.

 Seems to be malware, xpantivirus or something it is called if it comes up close your browser completely hitting yes or cancel will more then likely try to install it or put more malware on, get Spybot update and destory ><.  This came up when i choose a recent post from the home page.

I just got this. And I'm using firefox. It started scanning when I pressed cancel so hoping I've not got something, checking now.

Got it, too, and virus scanner showed a trojan

Originally posted by Admin

We will try to find out what is causing this.  I am not getting this but if people could post the following:

1) Your browser

2) Any ads that are on the page when you see this

3) The software giving you the warning (your spyware/virus scanner, etc)

4) The exact warning message

This could never happen on our internal ads since we place the SWF or GIF/JPG directly on the page ourselves - but we do use 2 seperate outside netowrks.  While I would hope they would not do such a thing - if it is coming from an ad (which it may not be) it would be from one of these and we would need to shut it off and report it.

 

1. Firefox 2.0.0.12

2. Add URLs

http://www.mmorpg.com/blogs/Athelan/012008/1013_Welcome-to-the-first-Age-of-Conan-Developer-Blog-at-MMORPGcom
http://mmorpg.com/adServer/clickAd.cfm?goto=10,1847&9449=4274

Flash Adds from Gamer Advocate and Fiesta, I won't click them for the URL at this time.

3. This is the message from a popup Firefox window. My personal antivirus, antispy, did not jump because I did not click the window.

4. "ATTENTION! If your computer is infected, you could suffer data loss, erratic PC behavior, PC freezes, and creaches. (note: yes they spelled it "creaches")

Detect and remove viruses before they damage your computer!
XP antivirus software will perform a quick and 100% FREE scan of your computer for viruses, Spyware, and Adware.

Do you want to install XP antivirus to scan your computer for malware now? (Recommended)"

5. I really like you guys, please fix this since it has me 1.2 seconds from moving back to linux (yep, no mmo dice =).

EDIT: Just to note, this happened at 6:05 EST. I am not sure if that predates your fix.

If you get the virus, look at here:

http://www.bleepingcomputer.com/forums/topic111715.html

---

Originally posted by Unicorns_Pwn
Had the same thing happen to me this morning around 7:30 reading posts before I went to work.

---

It happened to me early this morning. It wanted run some XP Cleaner if I recall. I just closed it out and ran my Ad-Aware.

Happened just now to me for second time today - on two different Mac's - Macbook pro at office and Imac at home - both running Leopard and this was with the Camino browser

Get that same popup redirecting to a site trying to tell me to install antivirus for XP -

Of course nothing happens to the Mac's but the popup and redirection is annoying -

Just though would note to you all this happens on the OS X platform also using Camino so its definitely not confined to only XP/Vista , the popup and redirection that is

---

Originally posted by toadkiller
Happened just now to me for second time today - on two different Mac's - Macbook pro at office and Imac at home - both running Leopard and this was with the Camino browser

Get that same popup redirecting to a site trying to tell me to install antivirus for XP -
Of course nothing happens to the Mac's but the popup and redirection is annoying -
Just though would note to you all this happens on the OS X platform also using Camino so its definitely not confined to only XP/Vista , the popup and redirection that is

---

I you using FireFox 2.0.0.12 on your Mac's? I've not had this problem on my Mac, just the PC.

No , Camino as noted - much more OS X feel built on Firefox engine -

Again it doesn't happen often but once this morning and once just now - was just letting the admins know it's completely browser based and nothing to do with any Windows exploit , the initial pop-up and redirection is possible on any platform apparently -

The payload of course only works on Windows machines though but the spyware attempt can happen across the board it seems - and whatever they did earlier didn't do anything to stop it because this second time just happened about 10-15 mins ago

We are really stumped on this one.  None of us are getting this pop up and I installed Trend Micro Security 2008 and it also has not sniffed anything out.   We shut off our ads for a couple hours and we still had a couple reports - we turned them on a couple hours ago and have still had just a couple (compared to dozens this monring when we first heard about it).

It is definately not affecting most users - only a select few.  Normally if something like this is happening to the majority we get masses of emails/posts per hour, and we are really seeing a small amount of comments on this now.

Because we cannot recreate the pop up it is nearly impossible to troubleshoot...especially because the users that do seem to get it only see it once in a rare while - so it is not like we can test different things

I got it at class this morning the sticker for me at least was it completely redirects the browser, so you cant see what was on the page at the time of the popup.

Making it hard to figure out what the offending add is.

Not sure if it helps or not Admins , but both times I have seen this have been on forum pages , have left the main mmorpg page up for hours and nothing from there -

I just got the pop up while viewing this forum post.  Got while i was reading threw the secong page.  The IE window minimized and then I got Windows window pop-up telling me my anti-virus was out of date, which i had just updated, and the www_xpantivirus add pop-up is in the bottom corner of my screen.  

We will try to find out what is causing this.  I am not getting this but if people could post the following:

1) Your browser  : IE 7

2) Any ads that are on the page when you see this: Same as noted in thread

3) The software giving you the warning (your spyware/virus scanner, etc) Same as noted in thread

4) The exact warning message : Same as noted in thread

This could never happen on our internal ads since we place the SWF or GIF/JPG directly on the page ourselves - but we do use 2 seperate outside netowrks.  While I would hope they would

Just so it be known I got this warning while at work , but our corperate AV didnt flag it , it was a pop up , it happeend both time on the forums section.

Originally posted by Admin

We are really stumped on this one.  None of us are getting this pop up and I installed Trend Micro Security 2008 and it also has not sniffed anything out.   We shut off our ads for a couple hours and we still had a couple reports - we turned them on a couple hours ago and have still had just a couple (compared to dozens this monring when we first heard about it).

It is definately not affecting most users - only a select few.  Normally if something like this is happening to the majority we get masses of emails/posts per hour, and we are really seeing a small amount of comments on this now.

Because we cannot recreate the pop up it is nearly impossible to troubleshoot...especially because the users that do seem to get it only see it once in a rare while - so it is not like we can test different things

Could this possibly be culled from a user importing a graphic/script from a 3rd party site?

Originally posted by dalevi1

Originally posted by Admin

We are really stumped on this one.  None of us are getting this pop up and I installed Trend Micro Security 2008 and it also has not sniffed anything out.   We shut off our ads for a couple hours and we still had a couple reports - we turned them on a couple hours ago and have still had just a couple (compared to dozens this monring when we first heard about it).

It is definately not affecting most users - only a select few.  Normally if something like this is happening to the majority we get masses of emails/posts per hour, and we are really seeing a small amount of comments on this now.

Because we cannot recreate the pop up it is nearly impossible to troubleshoot...especially because the users that do seem to get it only see it once in a rare while - so it is not like we can test different things

Could this possibly be culled from a user importing a graphic/script from a 3rd party site?

I don't think so because it is happening on many pages of the site (that is what we have heard anyways) - so far we have heard the forums, blogs and game list pages.

Originally posted by Admin

Originally posted by dalevi1

Originally posted by Admin

We are really stumped on this one.  None of us are getting this pop up and I installed Trend Micro Security 2008 and it also has not sniffed anything out.   We shut off our ads for a couple hours and we still had a couple reports - we turned them on a couple hours ago and have still had just a couple (compared to dozens this monring when we first heard about it).

It is definately not affecting most users - only a select few.  Normally if something like this is happening to the majority we get masses of emails/posts per hour, and we are really seeing a small amount of comments on this now.

Because we cannot recreate the pop up it is nearly impossible to troubleshoot...especially because the users that do seem to get it only see it once in a rare while - so it is not like we can test different things

Could this possibly be culled from a user importing a graphic/script from a 3rd party site?

I don't think so because it is happening on many pages of the site (that is what we have heard anyways) - so far we have heard the forums, blogs and game list pages.

I JUST got this after reading about it 30minutes prior whilst surfing the MMORPG forums (reading a blog about censorship) when this hit me. I hope this helps!!

i36.photobucket.com/albums/e15/Fadedspirit/MMORPGinfected.jpg

These are known as spyware "Traps". They make you think your infected via some misc scanner checking your PC (impossible, note I'm using Firefox and it doesn't allow such things unless I tell it to specifically, after turning off several warnings lol!) in order to infect your PC with trojans and other such malware.

-Draga