Just got spyware from Ebaumsworld

[zenchronus]

I run a very tight ship on my comp... don't run any active AV but keep things nice and clean. Was looking at EBW videos when one of them switched to a Crush Calculator page. Hit the close button and two untitled windows popped up, then my PC shut down. Rebooted and had some shitty spyware fake AV program sitting in my taskbar. Have it DCd from the net now and doing cleanup. I've been getting annoyed with the ads, but this is the final straw. A reputable site allowing spyware to be distributed is just about the worst thing that can happen to a community. I hope that you take care of this quickly and pay more attention to the people you allow to advertise on your site. Thanks for infecting my computer.

Oh, and everyone be careful watching videos on EBW. Update your AV definitions. I'll add once the MBAM scan is finished to let you know what spyware it is, though for reference the fake AV program that popped up is called System Guard.

-zenchronus

[zenchronus]

Got it taken care of relatively easily. It turns out that it's a Vundo spyware, and it's coming in through .pdf files using Acrobat Reader. The Crush Calculator ad opened up a pdf which installed the spyware. Do a search for Brastia.exe to get more info on it.

The quickest way to get rid of it is to reboot in safe mode and do a *.* search for any file modified on the current day, then sort by when they were created. Delete the offending files (hundreds of them) and reboot. Make sure you're searching for hidden files and folders and searching everywhere.

I'm hoping I cleaned it out entirely... time will tell. I'm really pissed at EBW right now. The best way to avoid getting this spyware is to either uninstall Acrobat or not watch EBW videos. I'll be doing both.

-zenchronus

[zenchronus]

A quick followup... the adware popped back in after I cleaned it out. Had some files hiding in obscure places and some registry entries allowing it to download itself again. I did the same thing, reboot in safe mode, search for files, and delete, but then followed it up with a full scan from MBAM. Seems to have done the trick, I'm a few hours without the crap.

Thanks, EBW.

-zenchronus

[sonalex00]

Hello everyone. Nice to meet you all.


pret personnel (http://simulationpretpersonnel.com)

[Pepper Peanut]

A quick followup... the adware popped back in after I cleaned it out. Had some files hiding in obscure places and some registry entries allowing it to download itself again. I did the same thing, reboot in safe mode, search for files, and delete, but then followed it up with a full scan from MBAM. Seems to have done the trick, I'm a few hours without the crap.

Thanks, EBW.

-zenchronus

Thanks, Zenchronus! I've reported this to our dev department.

[jonnykill]

I got antivirus 2008-2009 from the main page.

[Saf]

Did you know you can Limewire Limewire Pro from Limewire for free? YEAH REALLY MAN

[Haldolar]

I have it set up where nothing happens on my comp without an aknowledgement from me, so acrobat won't open without admin permission. I have had this site try to open adobe files several times on me lately and so far this failsafe has prevented anything from running .exe files on my comp, which is what I know it's trying to do. I suggest you set it up like that if you want anothing preventative measure in place, but I am asking the same thing of ebaums, WTF guys?