Bad Ad

[inculus]

Look into the IE-SpyAd list for ZonedOut. It places adservers in the Restricted Sites zone for IE, severely locking down what they can do without blocking them entirely. It's pretty easy to use. Unzip both into the same directory (for ease of finding the list), start ZonedOut, click Menu and go to Import -> Import from File, then select the IE-Ads.txt file. Once it finishes loading, you're done.

 

Thank you for the great advice. I don't know why but I've been using the nexus sites for my mods for years but only today I've started getting these trojan warnings from my anti-virus. Literally 6 warnings in the last hour. I've never had a warning before. I'm getting both the "Scan your HD" pop-up c**p and the "Abort Connection" screen from my avast warning me about trojans. Whether this is a recent development to the Tesnexus site or somehow related to the old mods I'm viewing I don't know but its worrying all the same. Running Malwarebytes now and getting a mate to get me a linux boot CD today. If I get more warnings I'll try to SS the page or at least write down the site I get re-directed to.

[TheOutlander]

Got the message again, had enough of a chance to see what happened this time. The ad stays white and the window changes to the text message crap about having a virus on the computer (so no ad that can be print screened unfortunately). What I did note down was what was listed on the taskbar in reference to that particular IE window:

92.213.157.56

 

Thought it was kind of weird that it would be an IP address (which I'm pretty sure isn't mine, as mine should start with 94). Don't know if that is any help at all.

 

@ evilneko: Thanks for the tips only just now got round to reading them.

[buddah]

Got the message again, had enough of a chance to see what happened this time. The ad stays white and the window changes to the text message crap about having a virus on the computer (so no ad that can be print screened unfortunately). What I did note down was what was listed on the taskbar in reference to that particular IE window:

92.213.157.56

 

Thought it was kind of weird that it would be an IP address (which I'm pretty sure isn't mine, as mine should start with 94). Don't know if that is any help at all.

 

@ evilneko: Thanks for the tips only just now got round to reading them.

That IP address can be checked here:

 

http://www.ip2location.com/?rid=586

 

It will populate yours when you go there, just copy and paste that IP in the box and hit enter and it will tell you this:

 

IP Address Country Region City

92.213.157.56 GERMANY NORDRHEIN-WESTFALEN KOELN

Latitude/Longitude Time Zone

50.933 6.95 - +01:00

 

That particular bug, can be picked up anywhere and is triggered by an event in java script........once triggered it appears to be coming from this site. This site relies heavily on java and this issue pops up every couple of weeks. Use the information above to get rid of it.

[evilneko]

If you want to make absolutely sure you're clean, the links and people here can help: http://www.dslreports.com/forum/cleanup

 

You could use FastStone Capture to cap screens. Just set the printscreen button as the hotkey for capture full screen, and it'll grab whatever's on the screen.

[Darziak]

Nasty thing only exncountered when I use IE when viewing Nexus.

 

I got a screeny of what my anti-virus says about it

http://img193.imageshack.us/img193/5549/screenshot004ub.png

[pnyw]

This just popped up on me too with a similar IP : 92.213.157.60

[Belanos]

I figured I chime in and mention that I got that bogus ad today as well. Fortunately it appears that I closed the window quick enough to prevent any infection as my AVG scan just came out clean.

 

PS:, I just thought I'd add that I've now installed an ad blocker to my browser, so hopefully I won't have to worry about getting Trojans from this site. Having gone through a very similar incident a few years back, and having to completely redo my system, I intend on avoiding a repeat of that happening at any cost. Even if that means relying on some other site for my mods should the ad blocker prove ineffective.

[Vindekarr]

same here, this same exact IP, same exact thing, my security system took care if it, infact this is the very same Ip I posted about here a week or so ago, glad to know it wasnt just me being paranoid

[Dark0ne]

I have 9 advertising publishers at this time and it is very, very hard to work out which one is compromised. What I'm going to do is systematically remove some advertisers and wait to hear back from you all as to whether the ad stops showing or not; starting from now.

 

Please understand that while I'm doing this the site is bleeding money so please try to report back as soon as possible on whether the ad is still showing or not.

[Darziak]

I've looked over 50 mods, done 7 searches and downloaded 2 mods and I havn't encountered any attack since your post Dark0ne.