Beware of FPSBanana

[Deadly]

http://forums.steampowered.com/forums/showthread.php?t=1347821

Just figured I'd post this here.

Anyone shopping for maps or skins:

I know it's not uncommon for FPSBanana, but I believe the site is currently infected with the 'Black Internet' trojan.

It's embedded in the site itself somehow, which means all you have to do is go there-- you don't have to download anything, and you'll be infected. The thing is that no virus scanner I had running alerted to it; AVG, Ad-Aware and Windows Defender did not alert when I went there and caught it.

If you've been to FPSBanana the last day or less, check your task manager. Look for iexplore.exe running-- or multiple instances of it if you are surfing with internet explorer, of course. You might also be hearing audio advertisements and/or multiple weird noises and mouseclicks.

Apparently this trojan infects the MBR, and I'm not 100% how to fix that, but I think I've cleared my infection by making all folders viewable and none hidden, starting in Safe Mode and going here:

C:\Users\YOURUSERNAME\Appdata\Local\Temp

and deleting these two files:

Loader.exe
Smss.exe

Anyway, just thought I'd share.

So, go exploring to test your virus scanner or doubt my post at your own risk-- i.e., my strong suggestion is: don't do it.

If anyone knows their webmaster's contact info, please share. I'd gladly write them an e-mail to tell them, but I don't feel like looking for it on their site and having to clean my computer again.

--Rhalle

Just a heads up, whether it's true or not.

[Godshelp]

Is this why my thread was deleted, I even thought I was first D;
Anyways, yeah... it is true, few friends have it now and are working on getting rid of it... I hate when people do this >.<

[Deadly]

Oh was it? I just saw two and deleted the one closer to my mouse, sorry. Also mine is prettier

[Godshelp]

Fine, Deadly gets away with this one D:

[FilButch]

I'm pretty glad I don't go there.

[REDSHARK]

hey guys I just uploaded a wicked virus ont-

uh nevermind

[Raydude4115]

oh noes?!

[Stuffinator]

Depends on what security settings you have on your browser. If you allow scripts to be executed automatically then it's your own fault, otherwise there is no way a virus can infect your pc by just visiting a website.

To spread a virus on a pc there has to be a file which is executable (exe, bat, scr,...), files that don't need other programs to be opened. By just downloading such a file nothing can happen to you unless you execute the file. The only reason why this would work is that there is a script installed on the page which automatically executes the file after downloading.

If you are using firefox you are pretty safe, because stuff like ActiveX and so on is not supported.

Also the reason why I use ZoneAlarm is that it tells you whenever an external device tries to connect to your pc and if this device is not listed in your "allowed devices"-list it will automatically block the connection.

Also I just visited FPSBanana and I find it very interesting that when looking through the stuff on the page I'm constantly getting this error "You do not have permission to access this, sorry", which I never got before.

I have to keep an eye on this.

[one of them]

:\
I downloaded a Spy Skin from FPS banana 4-5 days ago.

[killerkid745]

hurrrr i go on fpsbanana once in a blue moon.

[InstantDeath]

I downloaded multiple skins for TF2 two days ago. D:
I checked everything, and I don't seem to have the virus though.

[nerVe]

NOD32 catches this.

[N0sySh00ter]

Last time I went on FPSbanana was last year lmfao.

[Waterboy2go]

Kaspersky blocks an infected script every time I visit the site, that must be it

[N0sySh00ter]

http://i394.photobucket.com/albums/pp27/hacipasalioglu/yourcompisinfected.jpg

I'll let you decide with what's wrong that message.

[YuriTMND]

I don't see anything wrong with wanting to pervent data loss. After all, it is recomended to use special antispyware tools.

[Deadly]

What's wrong with that message? XP.

[N0sySh00ter]

XP is nothing compared to vista.. Vista is a shitty glitch program

Back off-topic: I bet it was some little script kiddie who made that website have a virus.

[Deadly]

lol Vista. 7 is where it's at.

And you're right, XP IS nothing compared to vista

[N0sySh00ter]

I think I said it wrong in that post..

I'm using windows 7 right now :-)

Oops, I mean

http://i298.photobucket.com/albums/mm273/filaz123456/Untitled-22.png

[killerkid745]

lolwut nosy? how did you???

[Stuffinator]

Oh boy how long do we have to bear that?

[Nuttz]

XP is nothing compared to vista.. Vista is a shitty glitch program

Showing your extensive and exclusive computer knowledge huh?

[Raydude4115]

I use Windows 7 =D it's doing great for me, also FPSbanana doesn't seem to be under any virus, the only problem with it for me is that it sometimes doesn't connect so im pissed when i need a new skin or sound >=O

[SRXSniper58]

What's wrong with that message? XP.

HE'S just trying to get in your head!

[N0sySh00ter]

SHE'S just trying to get in your head!


Fix'd fo yah d o double g

[lawlhat]

Damnit I love FPSBanana

[KashMunni]

Good thing I stopped modifying my games so often.

[Jesus123]

Good thing I've been modifying my games often.

[Deadly]

Hax!

1char, damn it

[Zorgy]

http://forums.steampowered.com/forums/showthread.php?t=1489995

I read it's got AIDs again, I'd go and check but I don't want to risk it.

[Stuffinator]

I lol'd and stopped reading when I read
REAL-TIME PROTECTION ANTIVIRUS (KASPERSKY OR MALWAREBYTES PRO)

[Boojangels]

NoScript and Ad Block all day everyday.

[Elite]

Indeed.

[REDSHARK]

jeez banana get your shit together

[Elite]

A lot of mod websites are getting viruses.

First FPSbanana, now TESNexus.

[Easton Dark]

A lot of mod websites are getting viruses.

First FPSbanana, now TESNexus.

TESNexus too?

[lawlhat]

Visiting FPSBanana is like having sex. You don't do it without protection.

Lol, so true