next weeks ads (5/10/09 US)

I seem to be having a virus issue (cleaned it up but now windows explorer keeps crashing so I cannot access the hard drives). Luckily I got a lot of it uploaded last night before the problem.

Here is whats not scanned

CVS
maxell 50 pack cdr or 30 pack music cdr 9.99$

TARGET
memorex 50 pack cdr or 25 pack dvd 8.99$

WALGREENS
sony 50 pack dvd 14.99$, 3 pack sony mini dvd-r 5.99$

FRYS Sunday ad
10 pack 8x kypermedia dvd in jewel cases 1.49$ (5831863, 5831843)

Bestbut, office depot and staples are scanned.

There is no media at kmart or sears.

I didn't get office max (I didn't get one last week either but there was an ad so there may be one this week).

so here is the rest, enjoy.

http://club.cdfreaks.com/sales/

much thanks for doing this always. hope things are going well for ya. take care and good luck !

Thanks .Good luck with your bug.

Mahalo ripit! Hope you get that bug out of your system.

Thanks ripit!

Thanks ripit,
budzos

Thanks ripit,

NBK

Thanks ripit!

Thanks ripit.

Thankyou ripit. Good stuff this week.

Anyone else getting this type of warning??
I've clicked on tons of these ad links from ripit, but wondering why this now? Changed any way in how these are linked now?

EDIT: Oh I see now on your first post ripit... it might be possible that the virus is trying to migrate to others' PCs....

^^^ Yeah, I got a warning as well about a 1/2 hour ago.

Damn. I might not have done the ads If I would have know it could pass a virus. That's similar to what I was getting. In the past I had been led to believe that windows virus's wouldn't effect cdfreaks servers as they are unix based but I hadn't thought about passing it to other computers. The only thing that that I upload are jpeg images and a simple text file (the rest of the html files have been the same and have been on the cdfreaks servers unchanged for a while).

Fyi, spybot got rid if it in one try after updating. I should also mention, I am not certain that the virus or whatever caused any of the problems on my computer. I am using a hybrid mother board that uses ddr1 or ddr2. I no longer have any ddr1 and apparently it is incompatible with most ddr2 memory (pos ecs board). I have sticks that test as bad that I know are not (actually one stick at a time is fine but not two), and other sticks only show half their capacity (and I haven't really tested for errors yet). The corruption on my computer very well may be related to that. I plan on getting a new motherboard very soon.
If I did pass it along, sorry. I almost wonder if it is just going around though as I cleaned my system (successfully I think) before I uploaded anything.

No probs ripit.....Avast caught it for me and then I used Trendmicro's free online scanner...I didn't get the virus.

Avira also intercepted it on my end... and as for whether it just happens to be going around, I can verify it is 'only' when I click on your link.
I think that this malware/virus may have piggybacked on one of the files uploaded??... not sure if that's the case, but what I am sure of is that it is only from that link originally posted in the first post.

Anyways, I truly do appreciate your 99.999% virus-free Ad previews.... LOL .... it really is a great thing that you do for everyone here...
Cheers.

Thank you ripit

Ripit, what is wollace.com? There's some flash content on your page that I have blocked with NoScript which is connected with that domain. Is that something you're aware of, or is it related to the virus?

thanks ripit

@MBK and negritude, the ads are hosted on cdfreaks servers (unix based servers if I understand right). A while back, I was given limited privileges to access their servers (I only have access to a single directory). I prepare the files and upload them. I dont host them, cdfreaks does. I don't know jack about writing html. Zevia quite graciously wrote it for me. The original intent was for me to process them through a window program (excell I think), but I couldn't get it to work. So he wrote something more generic.
The html files have been just sitting on the cd freaks server forever. There are two simple text based files that I modify each week (Only one is nesasary but I dont know which so I change them both). Theyare simple text files, and beyond that I upload jpegs?

I really want to know what happened because that's really uncool to upload a virus (in fact I'm an ass hole if I did, but I promise it wasn't on purpose). All I do is upload jpeg images and 2 modified text files each week. So how did I cause this (so I can avoid it next time)?

I'm going to stop doing the ads till I figure it out (with any luck, i'll have a new MB and clean install by next weekend), but in reality, I'll do a repair install and will get the new MB within weeks....
I cannot in good conscience do the ads If I'm pasing a virus....

Hi ripit,

The best explanation is that the virus rewrote all kinds of files on your hard disk. And once you uploaded them, it became available on the internet. You might want to check other files on your computer to see if it contains something like this:



This code was found by Sean and converts to



(Don't follow the link, hence the added stars!)

---

Last edited by Seán; 13-05-2009 at 11:25. Reason: Changed quotes to images to prevent false detection of this post as a virus

Hi ripit,

As mentioned there is a malicious script in the file index.htm which is probably due to virus.

Please open "index.htm" in your PC with Notepad, delete this part in the beginning of the html:
< script --- all the way to --- </script>

Then upload the edited index.htm. Please PM if you need more info.

Thats really strange. The index file on my computer did contain that line. Perhaps spybot cleaned it after I uploaded it, or it got attached during the upload process. Reguardless, I copied the file from the server, removed the script line, uploaded it again, and then copied it back to my computer to check it. I'm also scanning the images on my computer with trend micro and spybot to see if they are clean.

I went ahead and copied all the files (including images) from the server to my computer and scanned them with trend micro and spybot. They seem to be clean now.
If anyone has any issues, spybot is what managed to clean it for me when it first happened.
Thanks zevia and DoMiN8ToR for the help.

By the way, the problems accessing my hard drives seem to be gone. I still suspect it might be a memory/motherboard problem rather than from the virus.

Strange, wollance.com is still there on your page. I emptied my browser cache just to make sure, and yep, it's there.

Registrant:
n/a
1823 E Fairmount Ave
Baltimore, MD 21231
US

Domain name: WOLLANCE.COM

Administrative Contact:
Kinney, Abel kinneyabel8@gmail.com
1823 E Fairmount Ave
Baltimore, MD 21231
US
+1.4432242391 Fax:

Technical Contact:
Kinney, Abel kinneyabel8@gmail.com
1823 E Fairmount Ave
Baltimore, MD 21231
US
+1.4432242391 Fax:

Registrar of Record: MISK.COM
Record last updated on 2009-May-12.
Record expires on 2010-May-01.
Record created on 2009-May-01.

Domain servers in listed order:
NS1.WOLLANCE.COM
NS2.WOLLANCE.COM

If you make the mistake of clicking the link in the OP, and your AV software is not up to the task, you will end up with the System Protect 2009 Trojan. You will know when some BS windows start popping up "scanning" your computer.

Don't panic:

CTRL-ALT-DEL, open the Task Manager and End the SYSGUARD(N).EXE Process. This may or may not have the (N)

Start - Run - Regedit and remove these keys:
HKEY_CURRENT_USER\Software\AvScan
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "sysguard(n)"

Run a scan with your AV software or Spybot Search & Destroy to make sure you have deleted everything.