Note: LucasForums Archive Project
The content here was reconstructed by scraping the Wayback Machine in an effort to restore some of what was lost when LF went down. The LucasForums Archive Project claims no ownership over the content or assets that were archived on archive.org.

This project is meant for research purposes only.

Virus in the popups?

Page: 1 of 1
 Lundquist
04-11-2004, 11:41 AM
#1
I want to ask if anyone else has encountered a trojan when entering these boards? I've visited here twice where my antivirus caught the trojan "Trj/Revop.F" and it happen right at the time the popups occured.
I'd like to know if it is from these popups or if it's something I got from elsewhere?
 EnforcerSG
04-11-2004, 2:13 PM
#2
Its spy ware (might be a virus too). The file bdl84126.exe is installed in your c:/windows directory where it does what spy ware does. It also may be installing pup.exe in the same directory which is harder to get out (it is a virus). The second one is hard to get rid of, because if you just delete it, it ruins Windows Media Player. I am not sure if the second file is coming from this site, but the first I am almost sure it is.
 Fracman
04-11-2004, 2:15 PM
#3
Well, two things to know:

1) the content of the popups is not in our hands, sorry, so there may be some bad things happening... luckily your AV warned you.

2) sometime even antivirus have errors.
Check your AV manufature homepage for updates and for faulty error messages.

We will have popups as long as we don't have the money for an own website with unlimitted traffic and webspace for all files... thats how internet works...
 EnforcerSG
04-11-2004, 2:38 PM
#4
I understand that you need popups, nor do I say you should get rid of them. But should we not come here until we know they are safe? Maybe go to the regular Dark Forces forum for now?

I am reinstalling Windows Media Player now...
 Lundquist
04-11-2004, 3:59 PM
#5
Yes it is indeed in the file bdl84126.exe that the trojan is found.

I also know that you need the popups, I just wanted to make people aware that they might get a trojan. Even though it isn't the most horrible one out there, it "simply" installs adware such as Searchcentrix and NetTurbo.
 SlicerDude
04-11-2004, 4:45 PM
#6
You shouldn't be getting any viruses or Trojan horses from just seeing the popups. Perhaps it has a window asking if you want to install something, but if you click "No," nothing happens. (This is assuming you have IE and have the security settings at a reasonable level.) When your anti-virus pops up, it's most likely being smart and catching it before it's installed. I know some AV software can do that.
 EnforcerSG
04-11-2004, 5:07 PM
#7
No, this program does NOT ask you if you wish to install it, which is a violation of privacy. And you cannot remove it without screwing up Windows Media Player. If you have Ad Aware, version 6 with the newest spy ware definitions, it should find and remove it. And if you go to microsoft.com, you can download the newest version of Windows Media player and reinstall it (which you will have to do every time you visit the forum until this is resolved).

I am not blaming the ppl of the Dark Forces mod. It is just annoying to have something like this.
 Fracman
04-11-2004, 5:47 PM
#8
I know, and all i can actually do is to apologize for any harmful popup and recommend also what has been said up here: keep your AV actual and regularily check your system with antispy software :rolleyes:
 SlicerDude
04-11-2004, 6:11 PM
#9
These programs don't ask to be installed, but IE will stop it or let you choose if you have it set up right. Look under Tools, Internet Options, the Security tab, the Custom Level button (perhaps setting it to the default level would be fine), and look under ActiveX Controls and Plug-ins. On my computer, "Download signed ActiveX Controls" is set at prompt, and I think this is the relevant setting for this issue. If you're not using IE, you can probably find similar settings, just look for ActiveX or general security stuff.

I wonder about the legality of such evil software. If it is somehow legal, well, it shouldn't be.

Edit: For spyware/adware removal, you can also use Spybot-Search & Destroy. Good luck with the popups.
 Rad Blackrose
04-13-2004, 7:10 AM
#10
Funny enough, The One ended up bringing this up over in Yoda's Swamp.

There are some spyware programs that attempt to auto-load without the consent of the end user. Normally these aren't the worst of the bunch, but they're still a headache. More often than naught these are browser hijacks.

I'd worry if ezula somehow snuck into my CPU from LucasForums. Now THAT is one piece of spyware that's a pain in the butt to clean.

As far as the legality, right now it can only be installed with compliance from the end user. It is illegal to perform an auto-download-and-load.
 The_One
04-13-2004, 9:59 AM
#11
Yeah, sorry about this - it is a problem that is affecting pretty much every LucasForums user. One of the administrators is going to get on the phone to UGO (the people who supply the adverts) to find out what exactly is going on.

I know, it's not nice to have to deal with trojans just to browse a forum, but you should always be prepared. Make sure your firewalls are up, and updated - likewise your virus protection software.

I've found a useful program for getting rid of these type of trojans to be "CWShredder" - type it in Google.com, it's a small download and should remove any threats. Also, get over to Windows update and make sure you are up-to-date with security patches and what not.

The trojan that is infecting LucasForums users won't do that much harm - so don't panic if you get it. Just follow what I've said and you should be fine :)

In the mean time, we'll have to wait for an explanation from UGO as to what they think they're playing at!
 EnforcerSG
04-13-2004, 2:23 PM
#12
SlicerDude, you are right.

I still don't like it though. I still have to remove it for the last time and reinstall WMP 9 again.
 Ackehallgren
04-15-2004, 8:27 AM
#13
Where can I get a good antivirus program for free?`
All i can find is TrueWatch... <is that good?
 Maktaka
04-16-2004, 11:16 PM
#14
I thought this topic might be worth finally using my account for. The reason so many people have problems is because of Internet Explorer. By default, Internet Explorer will install anything it is asked to install by ActiveX controls. This is a HUGE security flaw. Basically, anyone can put just about anything they want on your computer through ActiveX installers. You have two options
1) Turn off ActiveX controls as desrcribed earlier in this topic.
2) Stop using IE. IE sucks. Besides the security flaws, it lacks tons of features that are essential to browsing the web, most importantly a popup blocker and 3rd party addons. If you'd like to try something a little different, check out Mozilla Firefox. It's got built a built-in popup blocker, no Active X installer, and more optional addons than you can shake a stick at. It will even automatically import your IE favorites. Using Firefox. Using Firefox, not only does the Trojan never get installed on my system through, I never even see the popup.
Of course, you could just wait until Microsoft releases Windows XP Service Pack 2, which will address these security and popup concerns (although perhaps only for WinXP), but that's not coming out until the summer.
If you're looking for a free virus-scanner, try AVG Anti-Virus. It's not as feature rich as McAfee or Norton, but what do you expect for free? It'll still keep your system safe.

Hope this helps some of you.
 Mercenary
04-17-2004, 7:15 PM
#15
As mentioned earlier, CWShredder is a great program designed to deal with the CoolWebSearch brand of hijackers and all the variations they come up with.

http://www.spywareinfo.com/~merijn/cwschronicles.html)

This forum is not the only place where popups have been infecting users. Occasionally I'd get one from the download page of pcgamemods.
 Kurgan
05-08-2004, 2:37 AM
#16
Two free programs I use to keep an eye on this stuff are Lavasoft's AdAware (spywar remover) and AVG 6.0 (virus scanner).

Both of these are updated often (free web updates).

The trojans and spyware in popups/banners is really annoying and problem we've had for some time now.

It's being discussed by the staff and we think it has something to do with some of the ad companies poorly managing their scripts and content. So hopefully we'll get it straightened out soon.

In the meantime apologies all around and may I suggest you try the programs I suggested and scan your computer daily with the latest updates just to be on the safe side.
 Ackehallgren
06-09-2004, 12:57 PM
#17
the popups just got heavier u guys... I know get a popup everytime I close an explorer browser thanks to the forum ads :( Crap!
 HapSlash
06-10-2004, 11:34 AM
#18
The sad thing is that out of all the Lucasforums boards I've been to, this is the only one I've ever had any trouble with.

It's gotten to the point where I'm seriously considering never coming back here,... and I'm on the team!
 Lundquist
06-10-2004, 2:21 PM
#19
I've decided to switch browser to Mozilla Firefox - thank god I don't have to deal with popups anymore.
 Ackehallgren
06-10-2004, 4:27 PM
#20
Is there seriously no way to fix this? cause I have to reinstall my computor! This sucks... But I love this forum! I can't take that there comes up like 5 popups everytime i close my browser... at least tell us when it will be safe to come back!!!
 DarkDefeater
06-10-2004, 5:28 PM
#21
I know how you feel. I had to re-install my computer as well. :/

It got to the point where I had 10 pop-up ads everytime I closed my browser.
 The_One
06-10-2004, 7:17 PM
#22
Ok, ok, I'll speak to the admins again. Hopefully we can sort something out!
 Ackehallgren
06-11-2004, 8:19 AM
#23
Thanks dude... appreciate it

(Dont want to leave)
 lassev
06-24-2004, 8:36 AM
#24
It's getting worse, not better, good Dark Forces modders. This time your pop-ups offered me two trojans (or whatever they were). The other one, called "rico.exe" even tried to install itself straight into my Windows folder.

Now, you must realise that this starts to remind people of those unofficial sites offering questionable content.

Since I'm eagerly awaiting your mod (and the demo), I would like to check these forums every now and then, just like those other people who have expressed their concern here. I have a good virus scanner, but this is simply dismaying, because this is not supposed to be some pr0n site, after all...

I mean no disrespect what-so-ever. I respect and honour your work greatly.
 J_Bond
06-24-2004, 12:39 PM
#25
May I suggest something? If you are worried about security lacks than use another browser instead the Internet Explorer. I use Mozilla Firefox, but you can use Mozilla as well. Both of them have an integrated popup filter, better cookie handling and they don't have the security problems with ActiveX. If you don't want to use another Browser than IE, then you could install an add on as well, such like Avant Browser. It also has a popup filter integreated, and more options that the IE. I can only say that I never saw any popups since I'm using Mozilla Firefox.
 HapSlash
06-26-2004, 7:27 AM
#26
I'm also starting to get these invasive pop-ups when I run the forum search,...

Maybe it's time I replaced my web-browser.
 Ackehallgren
06-30-2004, 1:51 PM
#27
I actually don't want to be forced to exchange my browser cause of a forum I really like!
 LightNinja
07-02-2004, 7:46 AM
#28
download the google bar, it stops all the pop ups
 TK-8252
07-03-2004, 11:58 PM
#29
Originally posted by LightNinja
download the google bar, it stops all the pop ups

I already have the Google Toolbar, and it does nothing to stop them. They're just as bad and infectious as ever.
 The_One
07-04-2004, 11:38 AM
#30
Sorry, I've just spent the last few weeks doing exams and whatnot. Today I finished shcool forever :D - so I'll look into this and pester the admins once more after I'm done drinking ridiculous amounts of alcohol in a few day's time ;)
 Ackehallgren
07-06-2004, 9:11 AM
#31
Thanks the one! Really appreciate it!
Page: 1 of 1