RedsZone Malware Attack Discussion

[Mario-Rijo]

All,

As an update, my host finished the malware scan and found one problematic file, which I removed. I also replaced one of the vBulletin files mentioned in this thread with the original. The warning message we're receiving from Google does not magically go away after the malware is (hopefully) removed; instead, you have to submit a request for them to review your site and if it's determined to be clean, they will take down the message. I've requested they review the site and will continue to keep you all posted in this thread. Thanks for your patience...believe me, this is very frustrating from my end, too.

I'll be waiting patiently, err I'll try to wait patiently. Until then I will use IE for RZ alone.

[KittyDuran]

I'll be waiting patiently, err I'll try to wait patiently. Until then I will use IE for RZ alone.

Well it attacked my computer here at work... and my boss is still working on it...

[Boss-Hog]

My host confirmed that it's an attack they've seen before with this version of vBulletin. While it's not the latest and greatest, 3.8.7 that we're running is the latest 3.X version and we have all patches and so forth installed. We'd been reluctant to upgrade to 4.X until we're able to confirm that all our custom code/enhancements is ported over to 4.X. I have followed up with vBulletin to figure out 1). how to address the problem if the steps I've taken above have not already done so after Google reviews the site and 2). what we need to do to prevent this from ever happening again. Thanks again for your patience...in light of Kitty's post above this one, I'd definitely say visit with extreme caution (if you must) until I confirm we're 100% good to go.

[powersackers]

These troans are a terrible fact of web browsing these days. Most are a painful yet quick fix.

1) Have a copy of Rkill.exe (available on the net) and MalwareBytes or HiJackThis installed on your PC or a USB drive
2) As soon as you get the pop ups / scanners / alerts shut down your PC with the start>shutdown or power off button
3) Boot into safe mode, put rkill.exe into C:\Users\your username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs - You have to enable viewing of hidden folders and files to see this location in explorer
4) Reboot into normal windows
5) Run the MalwareBytes or HiJackThis program allowing it to update itself first.
6) Remove Rkill.exe from that folder, keeping it somewhere safe for next time

You'll be back to normal.

[LoganBuck]

Malware attack message no longer showing up for me. I am running Firefox 4

[cinreds21]

Malware attack message no longer showing up for me. I am running Firefox 4

Same here. I'm on Chrome.

[Boss-Hog]

Malware attack message no longer showing up for me. I am running Firefox 4

Good to hear...that MAY mean Google analyzed the site and it's no longer currently a threat. I'll be able to confirm when I get home.

[_Sir_Charles_]

Malware attack message no longer showing up for me. I am running Firefox 4

Same here. Looks good to go Boss.

[Boss-Hog]

From Google:

Status of the latest badware review for this site: A review for this site has finished. The site was found clean. The badware warnings from web search are being removed. Please note that it can take some time for this change to propagate.

Now I have to do my part to ensure something like this never happens again. Unfortunately, I'm 95% sure the problem was not something on our end that is easy to fix, and if I'm right, there's going to be a good amount of work for us to make sure this is the first and only attack of its kind. Thanks again for everyone's patience.

[KittyDuran]

Well it attacked my computer here at work... and my boss is still working on it...

My boss worked as much as he could with it but in the end he just went and purchased a new HD since mine was about 6 years old.

[jojo]

My boss worked as much as he could with it but in the end he just went and purchased a new HD since mine was about 6 years old.

Just as a tip, download malwarebytes (free) and keep it updated. Between it and a good virus program (I use sopphos), you guys should be mostly covered. If you do get a nasty malware program, just go into safe mode and run malwarebytes and it will usually fix your problem in about 5 minutes...

[Boss-Hog]

Just as a tip, download malwarebytes (free) and keep it updated. Between it and a good virus program (I use sopphos), you guys should be mostly covered. If you do get a nasty malware program, just go into safe mode and run malwarebytes and it will usually fix your problem in about 5 minutes...

I second this advice (though I use Avast as my antivirus software).

[MikeThierry]

Does anyone have any idea how this malware attack happened?

[KronoRed]

Does anyone have any idea how this malware attack happened?

Get ready for some paranoid blame to be thrown your way

[Tony Cloninger]

I was at my parents. I was browsing the site and on accident clicked an advertisement......and then it was like a mess. Virus this and that. Computer wiped out all my parents info.

Here I am....a 40 year old man getting yelled at by his parents...."BUT it wasn't porno that I was looking at, Mom!"

I have an Apple and they warn you NOT to go into this site...less you be infected by a Malware Attack.