Go Back   Flash Flash Revolution > General Discussion > Chit Chat
Register FAQ Community Calendar Today's Posts Search

Reply
 
Thread Tools Display Modes
Old 07-21-2007, 06:27 PM   #1
LythincaMan
FFR Player
 
LythincaMan's Avatar
 
Join Date: Aug 2006
Location: Ontario, Canada
Age: 33
Posts: 661
Default I'd like to bring this to your attention.

Guys, do NOT click the ad thats for "Internet Gamebox". Seriously. Theyre all over FFR. You'll see it. It will say "More then 1500 games!" and have pictures of game characters.

Do NOT click it or install the "Internet gamebox".

Internet Gamebox is owned by GAD Network, which is a known spyware supplier. Their setup package, which is needed to play their free online games, reportedly installs a hard to remove rootkit. Uninstallation of their software is only possible through a form (bottom of this page). This also makes me wonder about the proper licensing of all the gaming characters they use (Sonic, Mario, Pacman, Donkey Kong, ...).

Feel free to read what gamedev has to say about this.

http://www.gamedev.net/community/for...age=1&#2922665
----
One post says that:

I see the Internet Gamebox ads are still running...

I duplicated one of my Virtual Server images and ran the Internet Gamebox installation on it. I had Filemon running on the background logging newly created files and modifications. The installation created a file named 'noffmmtudd.exe' in the windows\system32 directory and executed it. This file didn't show up in Explorer with 'show hidden/system files' turned on. A registry search didn't find a mention of this file either.

Then I turned off the virtual machine and added the disk as a second (non-booting) disk to a clean virtual machine. The file named 'noffmmtudd.exe' was suddenly visible with Explorer in the windows\system32 directory, along with some data files also starting with 'noffmmtudd'.

After rebooting the infected virtual machine the mentioned files were still not visible in Explorer or the registry. I ran the uninstaller which said it had removed all components of Internet Gamebox.
Loading the disk in the clean virtual machine again showed that the files were still there. I then renamed the exe file.

After rebooting the infected virtual machine the renamed exe and data files finally showed up in Explorer. A registry search came up with 'noffmmtudd.exe' being called on startup.

I hope this proves that Internet Gamebox does indeed install a rootkit. I don't know how to check what the rootkit actually does but it can't be good when it tries to hide itself.

----

Really guys. These ads should be taken off. The companys a spyware producer,and the program reportedly installs a rootkit and such.

The reason ads are put on the site. is that they are meant to be clicked. Well, I'd stay away from clicking this one.
__________________
LythincaMan is offline   Reply With Quote
Old 07-21-2007, 06:29 PM   #2
Magic_V2
RobMagic
FFR Veteran
 
Magic_V2's Avatar
 
Join Date: Jun 2006
Location: Las Vegas
Age: 36
Posts: 638
Send a message via MSN to Magic_V2
Default Re: I'd like to bring this to your attention.

Used to have that sort of problem on RuneScape
Spyware is teh sux but you should always research things before installing.
__________________

Magic_V2 is offline   Reply With Quote
Old 07-21-2007, 06:37 PM   #3
Branman123
FFR Player
FFR Veteran
 
Branman123's Avatar
 
Join Date: Nov 2006
Location: California
Age: 34
Posts: 138
Default Re: I'd like to bring this to your attention.

Quote:
Originally Posted by Magic_V2 View Post
Used to have that sort of problem on RuneScape
Spyware is teh sux but you should always research things before installing.
Good thing I usually don't click on any ads, period.

Another percussion is your temp internet files. This is probably the fastest way for a Virus to communicate to your computer and they can do this through image exploits, etc...
__________________
Branman123 is offline   Reply With Quote
Old 07-21-2007, 06:46 PM   #4
shade11
FFR Player
 
shade11's Avatar
 
Join Date: Aug 2004
Posts: 373
Default Re: I'd like to bring this to your attention.

It might actually be considered legal to do this if you agreed to their "License" or "Terms of Agreement."
shade11 is offline   Reply With Quote
Old 07-21-2007, 07:16 PM   #5
Dragon_Master2557
FFR Player
 
Dragon_Master2557's Avatar
 
Join Date: Jul 2004
Location: on Avenue Q
Age: 34
Posts: 164
Send a message via AIM to Dragon_Master2557 Send a message via Yahoo to Dragon_Master2557
Default Re: I'd like to bring this to your attention.

You shouldn't click on any ads period, let alone this specific one.
__________________


<-----Support
Dragon_Master2557 is offline   Reply With Quote
Old 07-21-2007, 07:29 PM   #6
shade11
FFR Player
 
shade11's Avatar
 
Join Date: Aug 2004
Posts: 373
Default Re: I'd like to bring this to your attention.

Quote:
Originally Posted by Dragon_Master2557 View Post
You shouldn't click on any ads period, let alone this specific one.
Many ads are pretty innocent. Just businesses/organizations trying to get the word out on whatever their product or service is.
shade11 is offline   Reply With Quote
Old 07-21-2007, 09:25 PM   #7
andili
FFR Veteran
FFR Veteran
 
andili's Avatar
 
Join Date: Dec 2006
Location: Cornfields
Age: 32
Posts: 228
Default Re: I'd like to bring this to your attention.

uhhmm and who exactly click on the ads? Lol

kk that was kinda harsh -_-. But like dragon_master2557 said...don't click on ANY ads
andili is offline   Reply With Quote
Old 07-22-2007, 09:20 PM   #8
LythincaMan
FFR Player
 
LythincaMan's Avatar
 
Join Date: Aug 2006
Location: Ontario, Canada
Age: 33
Posts: 661
Default Re: I'd like to bring this to your attention.

It was just a warning.
__________________
LythincaMan is offline   Reply With Quote
Old 07-22-2007, 09:45 PM   #9
MixMasterLar
Beach Bum Extraordinaire
FFR Simfile Author
 
MixMasterLar's Avatar
 
Join Date: Aug 2006
Location: The Emerald Coast
Posts: 5,221
Send a message via AIM to MixMasterLar Send a message via Skype™ to MixMasterLar
Default Re: I'd like to bring this to your attention.

and good warning, too. There are alot of people who simply dont know/ didnt think/ are 6 years old and click the ad. This is why I owe iPatch and 8Shade8 so much: I forgot the site had ads
__________________

Facebook / Youtube / Twitter

.
MixMasterLar is offline   Reply With Quote
Reply


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump



All times are GMT -5. The time now is 10:46 AM.


Powered by vBulletin® Version 3.8.1
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.
Copyright FlashFlashRevolution