[Updated] Nexus Trojan/Virus alert

[Dark0ne]

Over the past 18 hours or so the Nexus sites have been sporadically serving a trojan file through the ads on the site. Thanks to the logs of a few astute members on the forums I was able to identify the source of the trojan attack and have hopefully now nullified it. The Nexus sites should, touch wood, no longer be serving these compromised ads any more.

 

Such attacks have become natural on the internet and the fix is often reactive to an attack rather than preemptive. Indeed the patch to fix this issue was only released after several big name players in the internet community had been infected by the attack. It's simply wicked people, normally from Eastern Europe and Asia, preying on individuals who aren't up-to-date with their internet security.

 

Please insure you take the necessary steps to properly protect yourself from such attacks. Get a good reactive anti-virus (I used AVG and have had no trace of infection despite being warned about the threat) and firewall and switch any settings you might not need to an "ask me" state.

 

My apologies for the breach of security on these sites.

 

Update: Google is reporting the site as malicious right now. This is a report from before the fix and despite the problem being fixed there is some lag on getting delisted from Googles filters. Their webmaster tools report the site is completely clear of Malware so this should just be a waiting game.

 

Update #2: It's now Sunday morning here in the UK and Google are still yet to unblock TESNexus from their blacklist. Fallout 3 Nexus was on their blacklist for around 8 hours and was removed early yesterday. The irony is Fallout 3 Nexus and TESNexus use the same adserver and ergo had the same issues, so if Fallout 3 Nexus is clean, so is TESNexus. Their Webmaster Tools system continues to tell me the site has been inspected and confirmed clear of issues. Please be patient while we wait for Google to pull their thumbs out.

 

In the mean-time if you are confident in your system's security then HugePinball has written out how to remove the false malware warning when browsing TESNexus.

[Povuholo]

I'm getting a 'this is a reported attack site' message when visiting certain files on the TESNexus area. If the issue is solved, will this disappear after a while?

[lanthirion]

I got the "this is a reported attack site" message also. For all those who might need an antivirus program, I use Avast! antivirus. The home edition is free for private use with registration. You should be able to find it by doing a search for Avast! on yahoo. Worked like a charm for me, blocked the bad ads with no problems.

[gaebrial]

I'm getting the 'attack site' message as well. As far as I am aware, Dark0ne will have to contact StopBadware and get them to remove the Nexus sites from their list.

 

Dark0ne, in case you don't know, go to http://www.stopbadware.org/home/reviewinfo for more information.

[HanPL]

Same thing I can enter site but when I click on anything ""this is a reported attack site"" shows up :wallbash:

[micalov]

Got it aswell. Was midway through Uploading/editing a mod and keep spamming it, is there anyway to stop it? because it keeps screwing up atemps to edit :/

[Dark0ne]

Are people getting the virus warning still or are they just getting the "reported attack site" message. I need to be sure the trojan has actually been removed before I can get the site delisted.

 

From my inspections I can't find a trace of the trojan site being called.

[Raye]

I just posted this in the other thread before seeing the redirect here, so sorry for the redundancy, but yeah, the site is now listed as 'badware' you can not get to the site from a Google search without clicking away a bunch of warnings that it could harm your computer....

[Zaldir]

I am not getting any "Reported Site" page, nor have I received a Virus.

 

I use AVG, and it always gives me a warning and instantly cleans the Virus on my Say-So, so if anyone needs a AV, and are uncertain what to choose, I recommend AVG. :)

Edited September 24, 2010 by Zaldiir

[micalov]

Just getting reported bad site to, its part of Firefox Redirect it seems.