I use FF and have not seen warning - coincidence, is FF "better" or is it just not picking it up?

my guess would be this isn't an attack against gfy users but more likely a compromised advertiser ( it has happened before several times), this should be a wake up call to admin to stop letting advertise host the ads

Mother fucker...

this laptop is ok but my desktop is trashed, cant start or do anything keep getting the "your infected, run this antivirus" bs... can't start any antivirus software or anything

And yes using FF

Directions to get rid of it are posted here somewhere. But yeah...it's a bitch of a hijacking.

well I got some messages and a fake adware eliminator thingy but I closed it all out and rebooted and so far I think I'm fine. This is a disposable win7 install anyway.

It's probably quickbucks, like what the did with the nats guys on porngraph.

:Oh crap:Oh crap

The 'red window' is a Chrome invention, if I am not mistaken

We love speculation like that.

Windows 7, Chrome... No anti-virus, no anti-malware...

Got the 3D rendering popup, closed it, no malware installed...

This for me also :-\

R

white square i was talking about earlier next to top banner

http://i40.tinypic.com/35b7ev8.png

it got me this morning.

I just deleted it but took me an hour to run the damn AV software to purge it.

DAMN YOU SPYWARE

If it's in a sig, then it's *ALSO* in a sig. Because as I said, it hit me before I was even logged in this morning. It has tried to install several times since, but I have Java disabled now.

AVG (current as of this moment) has YET to warn me of it, and it's been around for months now.

Well I finally got rid of it using Malwarebytes in safe mode and changing the proxy settings thanks to advice from peeps on GFY It took me best part of half the day cause of the amount of programs I have on my pc and the two large hardisks which I have. What a complete waste of a day...

I think waht was happening was when I was talking on GFY it just re-installed itself after I ran malewarebytes the first time in safe mode

Eric could you please let us know if this was indeed from GFY

Thanks Candy I'm working the solution right now... how do I change that port setting on firefox?

NanoBot: page 1 of this thread is setting off your Avast due to Smokey posting the code he found of the exploit, I can not get past that post (not his sig as it appears prior) but the actual post unless I manually type "&page=2" in my address bar.

I also can't quote reply to you or anyone else here for the same reason.

For those of you with Avast reload page 1 of this thread and look where it stops loading the page.

However the real problem IS in fact one or more of the banner ads up top :(

-Loki-

We are definitely being infected while surfing GFY.

Go to tools/options/advanced then click on the network tab and then settings It will let you congifure your proxy settings

avast maybe triggered by text string, but Smokey's copy is just plain text - it's harmless

Thanks for posting that Firefox info. I couldn't find it myself and actually had to change it still.

It fucked my computer ALLLL up :-(

It seems like "iframe injection" to me. Google it to see more info.
Someones box was compromised, gfy server or advertisers server.
They load virus thru injected iframe.
I strongly recommend to have good firewall like comodo firewall and
good antivirus like avira free. Both are free options and are golden to me
for last 3 years ;).

what a fucking disaster, who is responsible for this mess

it just tried to get me again on this machine (with FF)
i have been to no other sites since booting this box up

Yep, just got hit...mother fucker!!!!!!

I am using FF.
all I got was windows security alert...attacked through port#.....

could this be anything to do with it JS:Pdfka-AFK [Expl] Just got it up with avast

Man we need the mods in here to sort this shit out

http://i.imagehost.org/0723/gfy.gif

White banner and the java console popped up.... :disgust

Your welcome and thanks to you and bigtymer and all the other users for helping me to get rid of this

URL causing issues is coinurlredirect.com

No problem man! Glad to help. Its a nasty little problem.

I have forgot to warning you that if you are infected and have
ftp accounts stored somewhere in your computer that high
chances all your sites resides in that ftp accounts are infected
also. So check it out now or your sites will be flagged by google
as spyware source. Good luck lads. It is such pain in the ass.
When that happened to me I was in killing mood for days.

holograph: That might be true BUT all I can say is Avast will NOT load anything past part of that code, It does not load his sig, it just cut's off at the code snippit, IF it was his sig though, why are the prior posts loaded with it?

What post came after Smokey's code snippit? maybe that is what Avast is blocking then?

I'll make and post a shot real quick

-Loki-

What makes you think that?

yup got hit too, had to do a system restore... it wouldn't let me execute anything after it loaded (kept saying "whatever.exe is infected"). i updated acrobat reader, not sure if that will help future attempts...

what a pain in the ass

I had avast running when I got it and it did not give me any warning at all and it still does not even when I view Smokey's Code snippet

I am running a full scan with avast now and so far it has come up with this JS:Pdfka-AFK [Expl] which was in the temp folder in firefox

lol took me 5 tries to get page 1 to actually load again, Avast was blocking the entire page, BUT I finally got it to load up to the stopping point....

http://www.lokiporn.com/gfy2.jpg

-Loki-

some of these adware installations will dump password data from browsers and ftp clients and send them to a host somewhere... i've seen it happen on several machines of mine over the years

i would find a plain text file on my system that had all of my usernames/passwords in it (ie, firefox, cuteftp)

Fuck... I better change all passwords just to be safe.

It wont let me run mallwarebytes. A windows security window pops up preventing me opening mallware...WTF?

Thats weird how your avast is stopping it and mine aint doing shit :Oh crap

halfpint: this is what I have been seeing for the last two hours now:
http://www.lokiporn.com/gfywtf.jpg

Notice the address is this thread, I tab GFY most times, so I had just opened this thread in a new tab and got that warning, and the other screenshot above (stop shot) is as far as I can get without manually coming to the 2nd page

What I'm using:
Avast 5.0.507
Virus Definitions version: 100511-0

All live scans are enabled (or shields)

-Loki-

restart you computer in safemode then run malwarebytes and then change the proxy settings in your browsers

http://www.eset.com/download
http://www.eset.com/download
http://www.eset.com/download
http://www.eset.com/download
http://www.eset.com/download
http://www.eset.com/download