TES Nexus Infected? : IV

» Sun Nov 14, 2010 8:43 pm

My anti-virus (Kaspersky), database updated today (Sept. 24th), says that TES Nexus is infected with a virus. However, that seems to depend on how you get there. If I go directly to the download page for my Abandoned Mountain Shack, I get the message. However, if I go to TESNexus.com, then my shack site, I don't get a message. So, I'm not sure what's going on. Has anyone else got a virus or anti-virus warning from TES Nexus within the last 24 hours?

EDIT: There is now a message on the TES Nexus site saying that, in fact, the site was infected through one of the ads, but that they believe it's now been fixed.

» Sun Nov 14, 2010 9:47 pm

My anti-virus (Kaspersky), database updated today (Sept. 24th), says that TES Nexus is infected with a virus. However, that seems to depend on how you get there. If I go directly to the download page for my Abandoned Mountain Shack, I get the message. However, if I go to TESNexus.com, then my shack site, I don't get a message. So, I'm not sure what's going on. Has anyone else got a virus or anti-virus warning from TES Nexus within the last 24 hours?

Read the site news, why come here for info - it's not as if Dark0ne isn't quick about letting users know what happens.

» Sun Nov 14, 2010 11:17 pm

Same here, I found http://www.tesnexus.com/news/index.php?id=789. Although I didn't get an anti-virus message, rather Firefox/Google reported it as an 'attack-site'.

» Sun Nov 14, 2010 10:34 pm

I've just been on, got no message.
I go through on my favourites list.

» Mon Nov 15, 2010 1:19 am

This is the latest posting from the admins on the TESNexus news page:

Over the past 18 hours or so the Nexus sites have been sporadically serving a trojan file through the ads on the site. Thanks to the logs of a few astute members on the forums I was able to identify the source of the trojan attack and have hopefully now nullified it. The Nexus sites should, touch wood, no longer be serving these compromised ads any more.

Such attacks have become natural on the internet and the fix is often reactive to an attack rather than preemptive. Indeed the patch to fix this issue was only released after several big name players in the internet community had been infected by the attack. It's simply wicked people, normally from Eastern Europe and Asia, preying on individuals who aren't up-to-date with their internet security.

Please insure you take the necessary steps to properly protect yourself from such attacks. Get a good reactive anti-virus (I used AVG and have had no trace of infection despite being warned about the threat) and firewall and switch any settings you might not need to an "ask me" state.

My apologies for the breach of security on these sites.

Edit: Ninja'd :ninja:

» Mon Nov 15, 2010 4:58 am

Same here, I found http://www.tesnexus.com/news/index.php?id=789. Although I didn't get an anti-virus message, rather Firefox/Google reported it as an 'attack-site'.

Thanks for posting. I actually didn't know about that news URL, and whenever I went to the site this morning I'd get the "attack site" warning from Firefox. If the link was not posted I would likely not have know.

Those adds are frequently annoying, and now apparently dangerous too!

» Sun Nov 14, 2010 10:25 pm

Read the site news, why come here for info - it's not as if Dark0ne isn't quick about letting users know what happens.

Because his AV is warning him not to go there to read anything?

» Mon Nov 15, 2010 12:32 pm

But why don't you install the adblock plugin for firefox and chrome? I don't even see any more adds on most sites, and if I see them I can permanently block them.

» Mon Nov 15, 2010 3:11 am

The issue is now with Google and we have to wait for them to update their blacklist and remove the site. Their webmaster tools say all the sites are clean so I'm guessing there's just a delay between their systems.

Slightly bemusing that premium members, who don't see the ads, aren't able to access parts of the site because google is blocking them!

Similarly the malicious report only affects the /downloads/ folder. So visiting any file pages, searching, etc. will throw up the report, but visiting tesnexus.com won't. Classy, Google.

» Mon Nov 15, 2010 12:59 am

I use Firefox with both Adblock and NoScript, and I'm still getting that "Attack Site" message right now. It isn't fixed, and considering those addons I have, I don't think it was just an add doing it.
-Edit- Hadn't read DarkOne's post above.

» Mon Nov 15, 2010 11:34 am

It isn't fixed, and considering those addons I have, I don't think it was just an add doing it.

It was, you just don't understand what's going on

» Sun Nov 14, 2010 11:02 pm

It was, you just don't understand what's going on

I'm not exactly sure why, but that sounded insulting. I do understand; I was still writing my post while you had put yours up. And apparently I was right.

» Mon Nov 15, 2010 2:34 am

When I was downloading some mods over at TESNexus my Panda (2010-GP) antivrus actually scan these files just before it finished.

I don't receive any message about TES Nexus is attacked by virus.

» Mon Nov 15, 2010 2:50 am

ok as of now it's not fixed, i try googling mods and then clicking on the nexus link it still comes up as malware detected and google blocks me from going to the site, however i can type the site address in and go directly from there...

» Mon Nov 15, 2010 5:32 am

My suggestion for Users

Block Flash
Block Java
Block Ads

» Mon Nov 15, 2010 8:05 am

Jesus, what a completely redundant thread. People, Dark0ne has given all the explanation needed, I don't see the point of 'oh, it's still not working here' posts, we've just got to wait till the browser information stuff gets updated. There is no longer any real issue, and it's just the warnings that need to be taken down now.

The original issue was with a virus in the ads on the site, and the warning is a general cross-browser thing that doesn't give a monkeys if you're using AdBlock or not, so that's why people using that still get the error. Dark0ne's also said that it's the Downloads page and file entries that have the warning mainly, the home page doesn't, so there's no reason not to read the site news.

I hope this has clarified things for everyone who can't seem to understand what's going on, or read the site news. No point talking about it further, IMHO.

» Mon Nov 15, 2010 4:11 pm

Right the Google Webmaster Tools has finally admitted that they are reporting the site has Malware on it so I've finally been able to submit the site for review.

Just to clarify the site has been clear of malware for many hours now, Google is just lagging behind.

» Mon Nov 15, 2010 10:35 am

So why post it here? No reason to post it just keep your av up to date and nothing to worry about.

» Mon Nov 15, 2010 1:39 pm

So why post it here? No reason to post it just keep your av up to date and nothing to worry about.

because i don't remember when the last time nexus had a problem like this and people like to talk about things...whats the point of posting things like "why post it here?"??

» Mon Nov 15, 2010 6:10 am

So why post it here? No reason to post it just keep your av up to date and nothing to worry about.

The reason is simple. As DarkOne said, he's working on getting the "Attack Site" warning removed soon. Until it is removed, this is an alternate site where people who have been blocked can find out what's going on.

» Mon Nov 15, 2010 10:31 am

I remember the chaos and panic when Nexus was down for a while(updating, IIRC), and people had no clue as to what had happened, even though the update was mentioned before the site went down(had it's own news blurb).
These threads are useful, because a good portion of Nexus users don't check the news on site. Sure, they're almost always because of panic, but they help once Dark0ne calms the masses.

» Mon Nov 15, 2010 7:23 am

*kicks google, then hugs it again* HURRY UP

^.^ google and firefox are awesome for saving me about 30min to 2 hours of work of having to remove any sneaky malware that may have gotten onto my pc, but Hurry up Google, if the site is good unblacklist it, if it is bad, tell the webmaster more info.

» Mon Nov 15, 2010 2:32 am

Actually if I had not seen this thread I would have blindly gone on Nexus as usual. At least I have warning to ensure I am sufficiently protected and to take extra precaution before going there. So this thread is very useful.

» Mon Nov 15, 2010 9:54 am

This thread is very useful. I was pretty woried when an 'attack site' page popped up and blocked TesNexus. At first I thought it might be a virus on my computer or something because I'd never seen the page before and it didn't look anything like my security software's UI. Thankfully I found this which answered everything. However, I'm not going back on TesNexus untill the warning is removed, I want to be sure, so I'll trust Google or whoever to check it carefully.

» Mon Nov 15, 2010 1:59 am

well I was going to post this on Nexus but as all threads about the virus issues are now being locked... no comment. The virus is still there. I've been hit twice in the last ten minutes after trusting DarkOne's word to the contrary and telling my browser Nexus is safe.

So. wont be doing that again for a bit until they're actually SURE it's safe. :foodndrink: Thank goodness for AVG.