Be careful when downloading skins/maps/or ... on Fpbsbanana!

[shadow52]

Anyone shopping for maps or skins:

I know it's not uncommon for FPSBanana, but I believe the site is currently infected with the 'Black Internet' trojan.

It's embedded in the site itself somehow, which means all you have to do is go there-- you don't have to download anything, and you'll be infected. The thing is that no virus scanner I had running alerted to it; AVG, Ad-Aware and Windows Defender did not alert when I went there and caught it.

If you've been to FPSBanana the last day or less, check your task manager. Look for iexplore.exe running-- or multiple instances of it if you are surfing with internet explorer, of course. You might also be hearing audio advertisements and/or multiple weird noises and mouseclicks.

Apparently this trojan infects the MBR, and I'm not 100% how to fix that, but I think I've cleared my infection by making all folders viewable and none hidden, starting in Safe Mode and going here:

C:\Users\YOURUSERNAME\Appdata\Local\Temp

and deleting these two files:

Loader.exe
Smss.exe

[Habe es grade auf nem anderen Forum gelesen desen Namen ich hier leider nicht nennen kann/darf.]
[Kann dieses Verseuchung aber bestätigen habe grade die Seite mit einer Virtuellen maschine besucht [und die ist nun auch infected.]

[KentuckyFC]

"Look for iexplore.exe running-- or multiple instances of it if you are surfing with internet explorer, of course. "
iexplore.exe ist der internet explorer prozess also ist schonmal klar das man den prozess hat wenn man mit internet explorer surft

2. and deleting these two files:

Loader.exe
Smss.exe

Ich besaß nur die Loader.exe habe sie mit Bit defender gescannt und sie wurde gelöscht von bit defender. so ich ging dannach auf fpsbanana.com und?
Nichts keine loader.exe oder sonstiges. nach dem löschen der Loader.exe und nach dem ich auf fpsbanana.com war siehe spoiler (Virenscan von Bit defender)

 Spoiler

<?xml version="1.0" encoding="utf-8"?>
<?xml-stylesheet type="text/xsl" href="file:///C:/Program Files/BitDefender/BitDefender 2010/uiscan_log.xsl"?>
<ScanSession creator="BitDefender Total Security 2010" version="BitDefender Antivirus Scanner" creationDate="13.07.2010 01:53:09" installPath="C:/Program Files/BitDefender/BitDefender 2010" originalPath="C:\Users\Razerlikes\AppData\Roaming\ BitDefender\Desktop\Profiles\Logs\contextual\12789 78789_1_00.xml" scanClient="C:\Windows\Explorer.EXE" taskName="Kontext Prüfung">
<ScanOptions>
<ScanPaths>
<path id="0000">C:\Users\Razerlikes\AppData\Local\Temp\d ivEE25.tmp</path>
<path id="0001">C:\Users\Razerlikes\AppData\Local\Temp\d ivF1AE.tmp</path>
<path id="0002">C:\Users\Razerlikes\AppData\Local\Temp\f lashgot.zgrphluf.default</path>
<path id="0003">C:\Users\Razerlikes\AppData\Local\Temp\h sperfdata_Razerlikes</path>
<path id="0004">C:\Users\Razerlikes\AppData\Local\Temp\L ow</path>
<path id="0005">C:\Users\Razerlikes\AppData\Local\Temp\M essengerCache</path>
<path id="0006">C:\Users\Razerlikes\AppData\Local\Temp\n ro.tmp</path>
<path id="0007">C:\Users\Razerlikes\AppData\Local\Temp\p ft5C57~tmp</path>
<path id="0008">C:\Users\Razerlikes\AppData\Local\Temp\p ft6B9F~tmp</path>
<path id="0009">C:\Users\Razerlikes\AppData\Local\Temp\p ft15A4~tmp</path>
<path id="0010">C:\Users\Razerlikes\AppData\Local\Temp\s coped_dir1882</path>
<path id="0011">C:\Users\Razerlikes\AppData\Local\Temp\s coped_dir2983</path>
<path id="0012">C:\Users\Razerlikes\AppData\Local\Temp\s coped_dir3375</path>
<path id="0013">C:\Users\Razerlikes\AppData\Local\Temp\s coped_dir9640</path>
<path id="0014">C:\Users\Razerlikes\AppData\Local\Temp\s coped_dir11450</path>
<path id="0015">C:\Users\Razerlikes\AppData\Local\Temp\s coped_dir18410</path>
<path id="0016">C:\Users\Razerlikes\AppData\Local\Temp\s coped_dir23209</path>
<path id="0017">C:\Users\Razerlikes\AppData\Local\Temp\s coped_dir23213</path>
<path id="0018">C:\Users\Razerlikes\AppData\Local\Temp\V SD9E4A.tmp</path>
<path id="0019">C:\Users\Razerlikes\AppData\Local\Temp\W PDNSE</path>
<path id="0020">C:\Users\Razerlikes\AppData\Local\Temp\A dobeARM.log</path>
<path id="0021">C:\Users\Razerlikes\AppData\Local\Temp\a h_download.log</path>
<path id="0022">C:\Users\Razerlikes\AppData\Local\Temp\a h_install.log</path>
<path id="0023">C:\Users\Razerlikes\AppData\Local\Temp\a h_installui.log</path>
<path id="0024">C:\Users\Razerlikes\AppData\Local\Temp\a h_setup.log</path>
<path id="0025">C:\Users\Razerlikes\AppData\Local\Temp\a h_setupwatcher1.log</path>
<path id="0026">C:\Users\Razerlikes\AppData\Local\Temp\a lm.log</path>
<path id="0027">C:\Users\Razerlikes\AppData\Local\Temp\a mt.log</path>
<path id="0028">C:\Users\Razerlikes\AppData\Local\Temp\a mt3.log</path>
<path id="0029">C:\Users\Razerlikes\AppData\Local\Temp\A rmUI.ini</path>
<path id="0030">C:\Users\Razerlikes\AppData\Local\Temp\A SKSUTBLOG</path>
<path id="0031">C:\Users\Razerlikes\AppData\Local\Temp\a u-descriptor-1.6.0_20-b76.xml</path>
<path id="0032">C:\Users\Razerlikes\AppData\Local\Temp\b rowserview-4a54ff0.htm</path>
<path id="0033">C:\Users\Razerlikes\AppData\Local\Temp\b rowserview-4e4a170.htm</path>
<path id="0034">C:\Users\Razerlikes\AppData\Local\Temp\b rowserview-46f2888.htm</path>
<path id="0035">C:\Users\Razerlikes\AppData\Local\Temp\b rowserview-47d56b0.htm</path>
<path id="0036">C:\Users\Razerlikes\AppData\Local\Temp\b rowserview-267ff58.htm</path>
<path id="0037">C:\Users\Razerlikes\AppData\Local\Temp\b rowserview-460c4c0.htm</path>
<path id="0038">C:\Users\Razerlikes\AppData\Local\Temp\b rowserview-496ff40.htm</path>
<path id="0039">C:\Users\Razerlikes\AppData\Local\Temp\b rowserview-4862a38.htm</path>
<path id="0040">C:\Users\Razerlikes\AppData\Local\Temp\c acheload.txt</path>
<path id="0041">C:\Users\Razerlikes\AppData\Local\Temp\c opyrights_page(ASCII).xml</path>
<path id="0042">C:\Users\Razerlikes\AppData\Local\Temp\C reatureState_Script.lua</path>
<path id="0043">C:\Users\Razerlikes\AppData\Local\Temp\c sxs-DRWV.log</path>
<path id="0044">C:\Users\Razerlikes\AppData\Local\Temp\c sxs-PHXS.log</path>
<path id="0045">C:\Users\Razerlikes\AppData\Local\Temp\D efaultEffect.fx</path>
<path id="0046">C:\Users\Razerlikes\AppData\Local\Temp\D ivXSetup.exe</path>
<path id="0047">C:\Users\Razerlikes\AppData\Local\Temp\F X_Script.lua</path>
<path id="0048">C:\Users\Razerlikes\AppData\Local\Temp\F XSAPIDebugLogFile.txt</path>
<path id="0049">C:\Users\Razerlikes\AppData\Local\Temp\i con_3667816286</path>
<path id="0050">C:\Users\Razerlikes\AppData\Local\Temp\i con_3871939076</path>
<path id="0051">C:\Users\Razerlikes\AppData\Local\Temp\i nstall_log.log</path>
<path id="0052">C:\Users\Razerlikes\AppData\Local\Temp\j ava_install_reg.log</path>
<path id="0053">C:\Users\Razerlikes\AppData\Local\Temp\j usched.log</path>
<path id="0054">C:\Users\Razerlikes\AppData\Local\Temp\l ocaleinfo(ASCII).ini</path>
<path id="0055">C:\Users\Razerlikes\AppData\Local\Temp\L ocation_Script.lua</path>
<path id="0056">C:\Users\Razerlikes\AppData\Local\Temp\n p4A56.tmp</path>
<path id="0057">C:\Users\Razerlikes\AppData\Local\Temp\n p4A67.tmp</path>
<path id="0058">C:\Users\Razerlikes\AppData\Local\Temp\P DApp.log</path>
<path id="0059">C:\Users\Razerlikes\AppData\Local\Temp\R A.dmp</path>
<path id="0060">C:\Users\Razerlikes\AppData\Local\Temp\R A.xml</path>
<path id="0061">C:\Users\Razerlikes\AppData\Local\Temp\R A4B9A.tmp</path>
<path id="0062">C:\Users\Razerlikes\AppData\Local\Temp\R A17A1.tmp</path>
<path id="0063">C:\Users\Razerlikes\AppData\Local\Temp\R ABD8D.tmp</path>
<path id="0064">C:\Users\Razerlikes\AppData\Local\Temp\R AC133.tmp</path>
<path id="0065">C:\Users\Razerlikes\AppData\Local\Temp\r eport.dat</path>
<path id="0066">C:\Users\Razerlikes\AppData\Local\Temp\s etup.exe</path>
<path id="0067">C:\Users\Razerlikes\AppData\Local\Temp\s wtag.log</path>
<path id="0068">C:\Users\Razerlikes\AppData\Local\Temp\t uj2B7C.tmp</path>
<path id="0069">C:\Users\Razerlikes\AppData\Local\Temp\T WAIN.LOG</path>
<path id="0070">C:\Users\Razerlikes\AppData\Local\Temp\T wain001.Mtx</path>
<path id="0071">C:\Users\Razerlikes\AppData\Local\Temp\T wunk001.MTX</path>
<path id="0072">C:\Users\Razerlikes\AppData\Local\Temp\T wunk002.MTX</path>
<path id="0073">C:\Users\Razerlikes\AppData\Local\Temp\U IWindows_addon_script.lua</path>
<path id="0074">C:\Users\Razerlikes\AppData\Local\Temp\w eather_script.lua</path>
<path id="0075">C:\Users\Razerlikes\AppData\Local\Temp\W ER869C.tmp.WERInternalMetadata.xml</path>
<path id="0076">C:\Users\Razerlikes\AppData\Local\Temp\A skSearch</path>
<path id="0077">C:\Users\Razerlikes\AppData\Local\Temp\C urse</path>
<path id="0078">C:\Users\Razerlikes\AppData\Local\Temp\d ata</path>
<path id="0079">C:\Users\Razerlikes\AppData\Local\Temp\D eployment</path>
<path id="0080">C:\Users\Razerlikes\AppData\Local\Temp\d iv26B2.tmp</path>
<path id="0081">C:\Users\Razerlikes\AppData\Local\Temp\d iv68EF.tmp</path>
<path id="0082">C:\Users\Razerlikes\AppData\Local\Temp\d iv76B5.tmp</path>
<path id="0083">C:\Users\Razerlikes\AppData\Local\Temp\d ivC3CB.tmp</path>
<path id="0084">C:\Users\Razerlikes\AppData\Local\Temp\d ivD307.tmp</path>
<path id="0085">C:\Users\Razerlikes\AppData\Local\Temp\d ivE2B0.tmp</path>
</ScanPaths>
<ScanObjects
scanViruses="1"
scanAddware="1"
scanSpyware="1"
scanApplications="1"
scanDialers="1"
scanRootkits="0"
scanKeyloggers="1"
/>
<TargetSelection
heuristicScan="1"
scanArchives="1"
scanRegistryKeys="0"
scanRegistry="0"
scanCookies="0"
memoryProcesses="0"
scanBootSectors="0"
scanEmail="1"
scanAllFiles="1"
scanPackedFiles="1"
scanSubfolders="1"
includeExtensions=""
excludeExtensions=""
/>
<TargetProcessing
infectedFirstAction="3"
infectedSecondAction="1"
suspectFirstAction="1"
suspectSecondAction="1"
hiddenAction="0"
infectedEncrFirstAction="3"
infectedEncrSecondAction="1"
suspectEncrFirstAction="1"
suspectEncrSecondAction="1"
passProtAction="21"
/>
</ScanOptions>
<EngineSummary
archivePlugins="44"
mailPlugins="6"
scanPlugins="14"
totalSignatures="6496643"
systemPlugins="5"
unpackPlugins="10"
/>
<ScanSummary
scannedItems="305"
smartScanItems="40"
passProtItems="0"
archiveBombs="0"
infectedItems="0"
suspiciousItems="0"
hiddenItems="0"
resolvedItems="0"
unresolvedItems="0"
scannedArchives="5"
bootSectorCount="0"
scannedDirectories="40"
inputOutputErrors="0"
virusesNumber="0"
scanTime="00:00:07"
filesPerSecond="43"
>
<FileSummary
scanned="265"
archives="5"
packed="10"
infected="0"
suspicious="0"
resolved="0"
deleted="0"
moved="0"
copied="0"
/>
<RegistryKeySummary
scanned="0"
infected="0"
suspicious="0"
/>
<CookieSummary
scanned="0"
infected="0"
suspicious="0"
/>
<ProcessSummary
scanned="0"
infected="0"
suspicious="0"
/>
<MailSummary
scanned="0"
infected="0"
suspicious="0"
/>
</ScanSummary>
<ScanDetails>
<UnresolvedDetails count="0">
</UnresolvedDetails>
<IgnoredDetails count="0">
</IgnoredDetails>
<ResolvedDetails count="0">
</ResolvedDetails>
<NotScannedDetails count="0">
</NotScannedDetails>
</ScanDetails>
</ScanSession>

Aber wenn ihr euch nicht sicher seit löscht alles was sich hier befindet bei dem schönen smiley^^
C:\Users\YOURUSERNAME\Appdata\Local\Temp\*.*
Keine Angst die dateien und ordner in dem ordner Temp sind unwichtig tuneup würde diese auch löschen.


Mein Fazit Fpsbanana ist nicht infiziert
Das ist nur wieder so eine Angst mache Fpsbanana nicht zu benutzen weil FPS banana dann ihr geld verliert und somit fpsbanana down gehen würde

Wenn ich euch geholfen habe ein thanks

[shadow52]

Also bei mir war es noch so mit dem download der 2 .exe dateien.
Seht aus als ob das Fpsbanana Team den iframe der auf der/den Seiten war entfernt hatt.