Skip to main content

160 replies

attention! urgent! virus on auctiva.com; Trojan-Clicker.HTML.IFrame.kr

Q qq-jackMember
UPDATE! virus Trojan-Clicker.HTML.IFrame.kr SEEMS BE FIXED! THANKS Smile
BUT SOME BROWSER SUCH AS FIREFOX, SHOWING SOME STUPID MESSAGE, AND GOOGLE BROWNSER JUST DO NOT OPEN THE AUCTIVA.COM WEBSITE, ONL IE WORKS NOW Confused strange!

"Reported Attack Site! This web site at checkout.auctiva.com has been reported as an attack site and has been blocked based on your security preferences.
Attack sites try to install programs that steal private information, use your computer to attack others, or damage your system.
Some attack sites intentionally distribute harmful software, but many are compromised without the knowledge or permission of their owners."
Last edited {1}
Original Post

Replies sorted oldest to newest

G gortuskMember
A message from Google Chrome when i try to make a listing.

"Warning: Visiting this site may harm your computer!
The website at www.auctiva.com contains elements from the site me9x.cn, which appears to host malware – software that can hurt your computer or otherwise operate without your consent. Just visiting a site that contains malware can infect your computer.
For detailed information about the problems with these elements, visit the Google Safe Browsing diagnostic page for me9x.cn.
Learn more about how to protect yourself from harmful software online."
H highlandMember
Wanted to sign up for Auctiva for our new Ebay store when, lo and behold, Chrome pops up a security warning. I dug into this and found some very interesting stuff.

It looks like Auctiva has a security hole someone is actively driving their truck through it. The problem is in http://www.auctiva.com/js/windows.js
If you point your browser there (it's safe, it will read as text) and scroll down the bottom you should see a document.write statement. If you don't see it wait a few minutes and refresh. It looks like someone is trying to fix the file but something else is putting the attack back in which is why it might not be there when you look.

See how the URL looks like gibberish? It's ASCII code for me9x.cn, a Chinese site blacklisted by Google. The code in question writes a GIF file into the page. This is why you're getting it blocked in browsers like Firefox or Chrome, which pull the Google blacklist and enforce it. If your antivirus picked it up, good for you. The GIF file is likely reading your cookies (or worse if you're using IE). Whatever the case, that file is up to no good and if you can see this image Gortusk describes you may already have problems on your computer that you can't see.

I would highly suggest the following
1. Do not log into auctiva.com for now. The forums are clean (they appear to be on a different server) but the main site is clearly compromised.
2. Switch to Firefox or Google Chrome as your browser. Both browsers blocked the attack.
3. Run some anti-malware software, especially if your antivirus didn't catch this attack (not all antivirus has anti-malware). A good place to start is Adaware (http://www.lavasoftusa.com). There are many others out there as well (AVG seems to be catching this already).

Here's hoping for a quick fix. Was hoping to add some tools to my store today.
W womandiMember
I NEVER get viruses, yet as of this a.m I've spent my entire day trying to figure out why I had one when I booted up this a.m. (Auctiva was the last site visited yesterday). I have a big red warning from Norton (this pop-up window won't go away!) it says:

HIGH RISK

trojan.malscript!html

So now I can't work - now what? Is every Auctiva user infected? HOW did this happen?
K kagexMember
quote:
Originally posted by womandi:
I NEVER get viruses, yet as of this a.m I've spent my entire day trying to figure out why I had one when I booted up this a.m. (Auctiva was the last site visited yesterday). I have a big red warning from Norton (this pop-up window won't go away!) it says:

HIGH RISK

trojan.malscript!html

So now I can't work - now what? Is every Auctiva user infected? HOW did this happen?


calm down, I'm pretty sure a lot others have been infected also. I'm using maxthon which tags on to IE's engine. I still can login, get a bunch of alerts and Auctiva is still functioning as it is.

What I suggest, is if you need to do something urgent, just get infected like me and finish up what need to be done on auctiva, close your browser clear your cache and temp files, run a full antivirus AND antispyware scan(spybot, windows defender,etc) and clean up the system.

If not, check for update here until an admin pops up telling us the problem have been fix. I'm sure the support team is fully aware of the situation and working on it asap. Smile
A auctivamikedAuctiva Customer Support Manager
Hi Community,

Thanks for helping to bring this issue to our attention. We are receiving reports of this nature from several customers and our engineering team is currently looking into why these warnings have started coming up. I'm not sure what is causing this at the moment, but I'll post again to this thread as soon as additional information becomes available.

-Mike
C cybertymMember
I am also getting this virus threat message. I note that Auctiva are aware of that problem and trying to fix it.
I also listed 5 new items yesterday afternoon but although they said they were being posted, none of them made it through to EBay. They are sitting in my saved listings. I tried to post one of them again and got the same response.
Has anyone else had this problem or know whether it is associated with the virus threat?
Susan
H hippophile1Member
Ditto. McAfee says there's a virus in my c/windows/gameeeeee file. McAfee warns me of this location every page on Auctiva - both my firefox and explorer. Told HELP but was told it was my settings. When I say to McAfee to delete the virus it pops up again on the next page I open in Auctiva. Rebooting doesn't matter. The one listing I made to eBay today showed up there totally cockeyed. Took me 35 minutes to straighten it out on ebay. This is devestating.
glitzglitzMember
I am on a MAC. I am getting the google warning whenever I try to log onto Auctiva today. Even when I tried accessing this group, Google was blocking it! I switched to AOL and got through to post this.
A few of my customers paid last night and this morning. Multiple auctions that were combined and paid are now showing as uncombined and not marked paid on eBay.
Everyone should check Paypal for what is paid since last night.
M morcoveloMember
When a customer clicks on a picture link it will take them to the page that states it is a reported attack site. Big red box, very intimidating like I am trying to attack their computer myself.

Thanks Auctiva for scaring away any of the few customers left on eBay.

Having the site down and slow is one thing since it is free but actually having this problem is just ridiculous and beyond any normal decency. You are directly affecting my ability to make a living. But hey it's free right?
glitzglitzMember
Still getting this on Firefox:

Reported Attack Site!

This web site at www.auctiva.com has been reported as an attack site and has been blocked based on your security preferences.

Attack sites try to install programs that steal private information, use your computer to attack others, or damage your system.

Some attack sites intentionally distribute harmful software, but many are compromised without the knowledge or permission of their owners.
I icemanMember
Here is exactly what GOOGLE is reporting at about noon MST:

What is the current listing status for auctiva.com?

Site is listed as suspicious - visiting this web site may harm your computer.

Part of this site was listed for suspicious activity 2 time(s) over the past 90 days.

What happened when Google visited this site?

Of the 45 pages we tested on the site over the past 90 days, 5 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-02-21, and the last time suspicious content was found on this site was on 2009-02-21.

Malicious software includes 6 scripting exploit(s), 6 trojan(s). Successful infection resulted in an average of 10 new processes on the target machine.

Malicious software is hosted on 2 domain(s), including luckffxi.com/, auctlva.com/.

1 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including me9x.cn/.

This site was hosted on 3 network(s) including AS16509 (AMAZON), AS174 (COGENT), AS14744 (INTERNAP).

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, auctiva.com did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.

A FIX NOW WOULD CERTAINLY BE NOT ONLY HELPFUL BUT APPROPRIATE!!!
M musicnoterMember
The bigger issue here, is that some of us that are on the bad servers, have auctions going. While these auctions and their pictures are still viewable. Having a customer click to enlarge a picture, and getting A TROJAN ATTACK notice, makes for NON-Sales. I would rather you pull all the servers, then leave them up with the problem. At least my customers will more than likely come back, instead of thinking I'm a hacker.
R rustylt2Member
mmmm..something odd going on here. When I visit the Auctiva home page I no longer get the AVG virus warning and I am logged out yet I don't remember doing so.

Also, there is a flashing ALERT message button at the top of the page. When I mouse over it there are no details appearing in the taskbar at the bottom of my screen but details appear when I mouse over all other buttons.

Is this an genuine alert from Auctiva? I'm afraid to click on it!
glitzglitzMember
When I go to ebay and one of my auctions, if I click on the link on the moving gallery that says "Click here to browse all my ebay items" I get the Site attack message. This is because it is taking you to the Auctiva ebay listing store. The regular pictures of my auctions are not affected.
If this is fixed now, Auctiva has to clear this with Google!
E easystreetdiscountMember
Yea I had posted the news allert link up on twitter and got an email fomr them

Uh oh! We found a bad apple in your Twitter feed.

We detected a link in your account pointing to a phishing site or other harmful material that we identified as malware. Here's the troublesome post:

"Antivirus Warnings on Auctiva Website (2/20/09) [ your unsafe link was here ]"
February 20, 2009 20:48

We removed this update from Twitter. Please be mindful of others in the Twitter community, and post only safe links on Twitter.com.

Thanks! Twitter Support
S selling4aliving42272Member
quote:
Originally posted by Sabatur Pro Audio:
I don't know about any listing posted yesterday, but I can tell you that it is affecting ALL 250 of my listings active on ebay right now with the pics being hosted by Auctiva. People are emailing me and such... I am just waiting for it to get back to Ebay and then they pull my listings!

And yet... still no update!! Is anyone from Auctiva there?


I just deleted all of the listings that were done from last night to today. And I think it was right up there with your amount. I didn't list them yet. So, clean up isn't bad. Just a bunch of time wasted. I am sure auctiva is not at fault - just super frustrating!
S sandbagsragsnrichesMember
Hi everyone - just logged on after abandoning Auctiva lately - fed up with messages about viruses everytime I logged on - to see that the problem has been fixed & closed. Not so sure Auctiva - just got the following from AVG - WARNING (TROJAN) & INFECTION re EXPLOIT.FLASH 21/02/09 21:43
Thankfully they are in my virus vault.

Also checked some photos on a listing to find the following that I didn't put in there:
countercredit.gif & deadflashcounter.jpg

Suggest people check their image downloads on auctiva hosting and delete asap.

Hope this is useful.
Last edited by sandbagsragsnriches
J jik444Member
A few of our auctiva.com web servers have been pulled out to do some emergency repairs. This means we are running on fewer servers than normal and the site will be running slower than normal. Friday 7:30pm update: We are faster than earlier today, but are continuing to rotate servers in and out and are still not at full capacity. Planning to be back to full capacity Saturday afternoon.

Riiiiiiiiiiiiiight.

Still waiting to hear from a legal speaking agent for Auctiva regarding whether or not our personal information has been compromised.


Vendio, here I come!!
S sabaturproaudioMember
I agree.. Ebay's fees are bad enough without adding more expenses and less profit.

Obviously, I am a little upset right now because of what's going on but I have to say, I will still stick Auctiva (unless another great item comes along). I have been using them for over a year now and this is the FIRST real issue I have seen. Although to me, this is big!

I guess I would just feel a lot better (and more secure) if SOMEONE from Auctiva would just keep us posted. This is what is making me lose confidence. The idea that these posts have been going on all day and not one respnse. A little pathetic actually.
E e-earlybirdMember
They HAVE been posting updates in this thread

Posted February 21, 2009 03:05 PM
Hi Community,

Update - If you are using the Firefox browser and are unable to use your account because you are receiving a warning stating the Auctiva is an "attack site", you should be able to workaround it by selecting "Options" from the "Tools" menu and disabling the "tell me if the site I’m visiting is a suspected attack site" setting under the "Security" tab.

We have removed what was causing that warning to be displayed from our systems but that warning is still showing up because we need to be rescanned by Google, which we are going to do as soon as we finish up the work we're doing.

If you have any questions, please feel free to contact our customer support team using the web form on the following page of our site: http://www.auctiva.com/help/requesthelp.aspx. I'll post further updates to this thread as additional information becomes available.

-Mike
suzysuzyMember
my sister is a mere 5 miles away from me & still gets the warnings.
she uses firefox like i do but when changing the security as i did she still can't access AUCTIVA
the change in securtiy settings DID help me

she is on a mac i'm not

is there anything she can do to get on

she is going nutz & won't stop harassing me with annoying help me phone calls!

so pleeeeeeeez help us both!!! LMAO
S selling4aliving42272Member
quote:
Originally posted by Sabatur Pro Audio:
Yes.. IE seems to be working now. But Firefox is still an issue no matter what they are saying


Yea, I am able to use IE, but not Firefox. I did a scan and found a TROJAN. I really am at a loss at what to do. I am not a techie. So, I don't know how this virus and the Mcafee works. After the scan, I didn't see anything stating it was gone or for me to delete it. It is on the old 'kids' computer. If anyone knows if Mcafee automatically removed it, please let me know.
glitzglitzMember
quote:
my sister is a mere 5 miles away from me & still gets the warnings.
she uses firefox like i do but when changing the security as i did she still can't access AUCTIVA
the change in securtiy settings DID help me

she is on a mac i'm not

is there anything she can do to get on

she is going nutz & won't stop harassing me with annoying help me phone calls!

so pleeeeeeeez help us both!!! LMAO

I am on a MAC too. Tell her to use Safari and to click the ignore warning button when the page loads. She will get the auctive start page to log in.
D dannoMember
Hi Folks,

If you are getting repeated warnings from your Antivirus and/or system messages, like "Data Exception Protection", it's probable that your system is infected with a Trojan that's persistent and keeps attempting to infect from that China site. From Google's analysis, it's apparent that there are muliple possible trojans and downloaded viruses involved. Some may be very diffcult or nearly impossible to clean 100%. After recognizing that possibility, here's what I did with one XP system that did get infected and needed a restore.

1. I removed/unplugged the system from the network, i.e. the persistent route of infection is from the China site. That at least breaks the connection for added infection and/or theft of personal info.

2. I rebooted the system to Safe Mode (press and hold F8 key during boot for menu).

3. I used System Restore to restore to a point prior to the infection, as follows:

3a. From Desktop, select Start -> All Programs -> Accessories -> System Tools -> System Restore

3b. From the Welcome to System Restore window, select "Restore my computer to an earler time" (default) and "Next>" button.

3c. From the Select a Restore Point window, you'll see a Calendar where the bolded dates indicate the system has available restore points. Select an available date prior to the probable infection. February 18th or earlier should be Safe, given the reports started on the 20th. Select "Next>" button and continue.

3d. The restore should commence with a final reboot when complete.

4. On reboot, goto System Properties, Remote Tab, and unSelect "Remote Assistance" and "Remote Desktop" features (precautions).

4a. (UPDATE: added 2/24) Follow steps posted on this thread by Auctiva Mike to clear your browser cache. Note, I did do this step and forgot to add it to my original post. Thanks to the person who started this thread for the warning on route of infection.

https://community.auctiva.com/e...?r=92410481#92410481

5. Run checks including Microsoft's Malicious Software Removal Tool to verify or their One Care Safety Scanner. Reconnect to the net to get the tools.

http://www.microsoft.com/secur...eremove/default.mspx

Any new programs or updates installed post the recovery will require reinstall.

Any data, eMail, etc. should be retained post restore without a problem.

Hope this helps those with badly infected XP or Vista systems.

(UPDATE: added 2/24) Please follow advise posted my Mike and Kevin at Auctiva. I'm offering this procedure as another alternative, not an officially sanctioned method by Auctiva.

Danno
Last edited by danno
W womandiMember
Thanks DAnno. I would do all that but for some strange reason the calendar in my system restore will only let me choose Feb 20/21/22 (those are the only bold dates) and that's when this whole virus started. So now what to do? I can't even restore. Frown

My Norton has been showing Virus alerts for 3 days. One medium risk = atlsystem _____ (with numbers after it) "is attempting to connect to a DNS server". One HIGH RISK = Virus Name "Downloader" (the past two days the high risk virus name was "trojanmalscript!html" Apparently NOrton can't get rid of it (unable to repair this file). I even went to malbytes? - something like that, the other day and scanned it it can't get rid of it either.

This thing is really huge, huh? I have no idea. I'm lost here! I just know I gotta work or there's no money for bills.
I icemanMember
And Jeff is telling everybody there the exact opposite of what we get here. We are to disable are warning systems in our browser, according to them, and he is tell everybody in the press to make sure thery are up to date and turned on. HELLO!!!

As an aside, I am sure tonight that telling buyers to turn off their virus warnings and and forward me money through their Paypal account is going to work just fine. YEA RIGHT!
I icemanMember
I have looked at both inkFrog and Vendio and have not come up with a viable alternative. InkFrog to small and cumbersome, Vendio to expensive but Auctiva's track record over the last 2 months has got me looking for the first time in about 4 years. I can't afford this every weekend and the support here has been slightly less than acceptable recently, relying on understatement ther to make the point.
D dannoMember
Hi,

If my posted steps help, please feel free to repost. I did the restore Friday and that system is still working fine today and rescans clean.

I wrote-down what I did from memory not thinking this might be a killer problem, so if anyone wants to add info, suggestions, or make corrections...please do.

I'm am staying off the Auctiva site until it gets a complete rescan by Google.

If you have a commercial Firewall product that can block specific addresses or URLs, a block list posted might help. Google suggests that

me9x.cn [121.14.137.36] and luckffxi.com [67.229.127.42]

are noted candidates to block.

Danno
D dannoMember
Hi Folks,

I just got news from a Seller friend that attempting to use System Restore was blocked by the malware. In their case, they waited too long and the malware had corrupted the system to the point that they had to work with Norton over the phone to get the malware removed. Their Norton AV had been giving alerts for two days.

(Note: I shut my system down within minutes of detecting the infection and got it off the net before it got to that condition.)

Norton told them they are "swamped" with cases, and it sounds like it may be more than just Auctiva under attack.

Danno

Edit: It looks like Google rescanned the site in the last hour. Their Safe Browsing page shows this update.

Of the 49 pages we tested on the site over the past 90 days, 5 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-02-22, and the last time suspicious content was found on this site was on 2009-02-21.
B bethofvtWhiz
I have been able to list right along. Listed 5 aucitons last night and several this morning. I normally use firefox, but used IE to list yesterday and today.

I do admit to being paranoid aobut it. I ran my virus scan twice yesterday, before and after listing on aucitva. And I ran Microsoft Malicious Software Removal tool today. No issues were found on my computer by McAfee or Microsoft. And a check of McAfee shows that their scan of the Aucitva site today found it free of viruses, malware and spyware.
A ashermanMember
quote:
Originally posted by Mikebiker:
I am going to list through auctiva for tonight. SCREW IT I can find no viable alternative. If it works I can make enough money to replace a damaged computer or buy a new windows copy. I am just plain sick. This is the best site I have ever found and now this. Are auctions posting?


Well, I have been listing since 7 pm Eastern time last night. I got 59 up last night and a few more today. I don't have the virus and the only error or problem I am having is the enlarging picture warning others are talking about. I don't know if I am "lucky" as far as what servers I am working from or whether it is the fact that I did not list anything Friday or early Saturday.

Anyway, I will continue to list. I will also continue to virus scan. My AVG antivirus did warn me of the site early Saturday and I didn't go on-just went back later and listed, so it's not a matter of just not finding it.
S sandbagsragsnrichesMember
I've swapped to Internet Explorer - working fine for listings and sending to ebay ok. Checked ebay in Firefox and listings ok. Just don't select supersize image for now and your customers won't get the red warnings and you might be able to carry on using Auctiva whilst the problem is sorted.
Do check your image folder for unwanted photos -I had 2 that weren't added by me, so deleted immediately - countercredit.gif & deadflashcounter.jpg so beware and check your image folder.
My AVG picked up the trojan on Saturday.
Perhaps I'm just lucky to list at the moment??
S sabaturproaudioMember
Well I can tell you that I have lost NUMEROUS sales this weekend over this. People emailing and people complaining. This has been the worst so far.

I take back my earlier post of staying with Auctiva... I would much rather pay and feel secure than have a weekend like this. Especially since people are getting their Income Tax and finally spending!

This is absolutley ridiculous.
W wingedwolfpsionMember
It's a bit naive to think that just because you pay, the site is going to be more secure. That hasn't proven true of any software in history. This could have happened to any site, pay or no pay. They can catch most of the stuff most of time, but no one can catch everything all of the time. In the 2 years I've been using Auctiva, this hasn't happened until yesterday. But I remember Ebay being attacked, at least once. BIG services can be compromised--little services can be compromised. For-pay and free services can be compromised. Never for a moment think that anything you use over the net is completely safe.

Yes, it's terrible, and probably MOST of us have lost potential customers due to this attack, but there's absolutely no reason to consider it anything other than one of the unavoidable risks of working over the internet. If you had a physical store, it would be at risk of falling prey to theft, vandalism, natural disaster, people crashing their cars into the building, and other various problems. These things can happen, and every once in a while, they do.
I icemanMember
WingedWolfPsion is correct. There is nothing on the net that is 100% safe just as there is nothing in life that is 100% safe no matter how many safeguards you take.

I have been extremely frustrated and perturbed today but I can also remember sometime in January when it took the US Postal Service 4 days to bring their site and Click-N-Ship back on line after it failed on a Sunday evening.

If you look in the News area, Mike from support posted something about 2 hours ago. Once I cleared all the private data and stuff on my machines, Firefox has no problem getting into Auctiva without the "Red Death" warning.

Back to attempting to get one more thing ready to list before calling it a day
S shouldthisbeyoursMember
I listed 3 items today on auctiva.

I had two people check one of my listings.

One person checked through IE and it shows no warnings.

BUT the other person checked a listing through Google Chrome, and got this warning as soon as he scrolled down to look at my photos...

Warning: Visiting this site may harm your computer!The website at cgi.ebay.com contains elements from the site backupinfo.auctiva.com, which appears to host malware – software that can hurt your computer or otherwise operate without your consent. Just visiting a site that contains malware can infect your computer.For detailed information about the problems with these elements, visit the Google Safe Browsing diagnostic page for backupinfo.auctiva.com.Learn more about how to protect yourself from harmful software online

I am pulling my auctions!
E e-earlybirdMember
The malware is GONE, folks.

People are getting the warning from Google and Firefox because they (Google & FF) haven't updated their scans yet.

I've been working on my Auctiva listings most of the day without problem. Don't know whether I happen to be on a good server or what, but other than some slowness which has improved throughout the day, I haven't had any problems.

If you want to work on your listings there's nothing to stop you now.
S selling4aliving42272Member
quote:
Originally posted by Mikebiker:
I am going to list through auctiva for tonight. SCREW IT I can find no viable alternative. If it works I can make enough money to replace a damaged computer or buy a new windows copy. I am just plain sick. This is the best site I have ever found and now this. Are auctions posting?


I am on the old computer. And I can't take anymore time off. I did a bunch of listings yesterday. But, deleted them because this. But, I have certain bills that need to be paid on certain days. I know appoximately how many listings to get the $$ I need. This week - my mortgage - which I am still a mont behind because I had to pay for part of my son's surgery in December. So, I may not be getting any sleep tonight. But, my lender probably would not accept "I can't pay because I had a computer virus.
E e-earlybirdMember
If you're able to access and work on your listings here, I don't see why you wouldn't go ahead and list them. I wouldn't list 1 or 3 day auctions but 7 or 10 day listings should be fine. In other words, Google is going to update their scan eventually, and probably sooner than later.

Once again, the malware is gone. Any warnings you or your customers are getting are false alarms caused by Google's lag in updating its information. Nobody's getting infected from your listings.
F foremostfashionsMember
rubberduckproductions: i saw your post over on the powerseller board. i too thought it was funny how something actually helpful being posted is avoided in favor of high drama. lol.

wingedwolfpsion: right on.

...on my own system.. i haven't gotten a single virus warning through any of this. i use ie and i also use customized auctiva templates....auctiva templates that i have customized to insert larger images imbedded right into the body of my description rather than the sized/super sizeable images that auctiva offers. ....i am wondering if this is why i haven't gotten any virus warnings?? ....what is disturbing is how low sales were tonight. ..guess that means that my potential customers ARE seeing the warnings when they click in to my auctions ..even if i haven't seen any of the warnings on my own system.. ??

...i sure do hope the auctiva team gets this resolved soon. i feel for them. don't you just know they are all about ready to pack it in? ...i say we show them a little support. i wouldn't want to be in their shoes right now.
O over40artistMember
I have had lots of buyers contacting me about the "attack site" warning they are getting when trying to utilize the Auctiva check out function. The following is the email that I have been sending back to them. Feel free to borrow any of this language to help calm down any customers who might be upset with you:

"I am sorry to hear about your issues. Just about everyone that regularly uses Auctiva checkout has had the same problem tonight. I can assure you that the malware (virus) that infected Auctiva's servers has been eradicated. The virus came from China and it took Auctiva most of the weekend to clean it out of their 200 servers. So they are clean, but Google and Firefox both have to "rescan" the Auctiva site to clear up the "attack site" warning that you are getting. This might take a day or two, or it might take a week.

Even after Google and Firefox re-certify Auctiva as a trusted site, Auctiva may yet have issues with certain aspects of their business, including the check out function. If you prefer using Auctiva's check out function, I am not sure how to advise you to work around these issues. The Auctiva message board is rampant with eBay sellers who are furious about this messing up their business.

As for old ComixJoint here, there's not much I can do. I have over 1,400 auctions pre-built in Auctiva, with hundreds more to be built in the future. To maintain the weekly schedule I have planned in the coming months, it is impossible for me NOT to use Auctiva. Auctiva made it possible for me to build the type of auctions that I prefer buying from, and I'm sure most of my regular buyers enjoy the way I present my underground comics.

So, at least on a temporary basis, it may be necessary to find alternative ways to pay for your auction wins. One way is to use eBay's check out function. I always send eBay invoices to those who don't pay the first night after the auctions end. You may not be used to it, and it may not offer you the same options as Auctiva, but at least it gets the job done. Another alternative is to take your combined invoice total, add the shipping option fee that you prefer, and pay me directly through PayPal. You can send any PayPal payment to me directly through your PayPal account with my email address: mfoxartist@gmail.com

I will know by the amount that you send me which shipping option you want. You can also include a note with your PayPal payment that indicates your preferred shipping option. And since you control the amount you are sending me, feel free to take a couple bucks off the grand total for your unusable PayPal discount coupons, extra aggravation or whatever. I want my buyers to be happy, not feeling frustrated or cheated.

If you prefer, you can also send me a check or money order for the grand total to my mailing address:
Mark Fox
c/o Accredo
1670 Century Center Parkway
Memphis, TN 38134

Again, I am sorry for any inconvenience or frustration you may have experienced with your attempt to check out with Auctiva. I'm sure within a week or two, things will be back to normal and all this will eventually fade from our memories. Thank you for emailing me and, as always, thank you for your business. You are one of the loyal buyers that make selling my collection on eBay worthwhile.

Mark (ComixJoint)"
C coinedMember
I wondered where this friggin thing was coming from! Those saying it is gone should click the following auctiva link:

http://www.auctiva.com/help/pa...ettings/Overview.htm

This is saved on my AOL browser under "favorites" as a link to auctiva's insurance policies. It will take you there and it will attempt to upload a virus to your computer. AVAST will catch it every time. My current listings are unaffected because I do not use the supersize feature. However, I can't list any new listings through Auctiva until it's fixed. I believe the virus is embedded in the spaces, which are filled by %'s. Confused

Get this fixed bros, I like this website!!!! So much easier than ebay's picture uploader (Can't tell you how frustrating that thing can be). Mad

Ed
B bigmuzMember
Hi Jeff,

A webserver I manage has been the victim of the same attack you have experienced, and I have not yet been able to identify the cause. I would really appreciate it if you could contact me with any information you have on the method they used.

My compromised webserver is a Windows 2003 server/IIS 6.

quote:
Originally posted by Auctiva Jeff:

Most importantly we found what we believe was the method they were able to put the malware files on our server and have removed that.



Many thanks.
M musicnoterMember
TOO LATE! You guys told us it was SAFE and that you were just SLOW! I spent hours online trying to find out if the trojan and malware were IN FACT real, or a safety feature. Instead of trusting my gut, I trusted you and went ahead even through googles warnings. Today I write from my son's computer as mine was infected with malware and a friggin TROJAN zipped through my hard drive. I have NOTHING left. All because of FREE AUCTIVA.
Not so free, when I'm OUT a $1,200 computer.
Yikes
V vrMember
Since Saturday, all I have been hearing from Auctiva is: "We have a problem", "We are working to solve the problem", "We solved the problem", "We still have a problem", "We are working on the problem," "We solved the problem", "We still have the problem", ...blah... blah... blah... Why don't the idiots hire a real expert to fix the problem. Now every time I go into my listings, and try to supersize a picture, I get a server error. So I assume anyone else who might be interested in my items will get the same error, and get discouraged, or just plain scared. Unfortunately since Auctiva claims to be a free service, we cannot claim a refund for lost sales. Come on, Auctiva, get your act together!
M mikebikerMember
Yes there has been a problem. I lost a laptop to it. BUT can anyone recommend a better service then Auctiva? If you have not noticed these guys have been working non stop to get this fixed. I say we give them a hand for all they have done. If you did not notice all through this your listings stayed up. My items got plenty of bids and finished with great prices on Sunday evening. They did and are doing all they can. Give them some time.
S selling4aliving42272Member
I agree that it is very frustrating reading "It is fixed. Not fixed'. I honestly believe they are working to fix this problem. They are doing their best to get this fix. This will cause them to lose revenue as well. In the meantime, find an alternate. Frustrating, I know. I use the same description for like products. Just change the name and picture. But, not listing is not an option.
C coinedMember
I don't understand how anyones computer could be "destroyed" by this virus. Unless you have no anti-virus (or an extremely bad one) and no firewall whatsoever. I visited auctiva several times and avast caught it upon entry every time. I continued to use auctiva not knowing the virus was coming from auctiva and still came out just fine. Avast is free at www.avast.com, and so is AVG last I knew (I don't know their website). BTW my computer is a 4 year old emachines from walmart running on dial up with AOL.
M mikebikerMember
I am not entirely certain my problem originated from Auctiva. I had a problem a week or two earlier and it wiped out my PC. I wiped the hard drive and reinstalled windows and it is back to OK. My laptop is having the same thing done now. The first virus I picked up a couple of weeks ago got past Norton. I NEVER got a warning other the the red screen of death from Firefox. I have run Auctiva all day Sunday and Monday and Scanned with Norton about once every 30 minutes and NO problems.
wwwwindmilltradingcomwwwwindmilltradingcomMember
THANKS FOR FIXING THE PROBLEM, AUCTIVA GUYS! (and gals)

I know this was a huge problem.

To all other posters WHINING that it took Auctiva a few days and WHINING that their computers got infected:

DEAL WITH IT. This is a risk you run accessing the internet and not running the appropriately updated AV software on your OWN computer. Don't go blaming Auctiva. It's not their fault. Take responsibility for your OWN actions. Or lack thereof. Do you blame the bus company when you're late for a job interview because the bus got caught in a traffic jam? No. If you did things right, you had an alternate plan (left earlier, knowing you COULD get caught in a jam).

And don't complain that you "lost a $1,200 computer". Get real. Rebuild. Use your backed up data (which you had, right?) And move on. Get back to business. Stuff happens. Deal with it.

My only complaint to Auctiva in all this is that they probably should have been forthcoming in the beginning and shut down the website earlier, instead of trying to "fix the airplane while it was still flying".
Once again, great job Auctiva. Thanks. [B]
Smile
M musicnoterMember
I'll tell you why I'M whining, and HOW my computer was impacted.
I went to the site, got the google warning and it stopped me dead in my tracks. SO, I backdoored my way into the community forum to find out what the problem was. This was Saturday and the notice said they had "found the problem" and it would be fixed by Saturday afternoon. I cleared my cache, etc., assuming that I was probably getting an old warning. Mind you, I've NEVER had a warning from GOOGLE regarding the trust issues of ANY site, so I really thought auctiva had it under control and google was just splashing up a screen due to server loss of auctiva.
I still got the warning. Later that evening, I went back to the forum, and found that tech support had again said they were aware of the problem, that it was a few servers down, and the issue was in the MIDDLE of being fixed.
There was absolutely NO mention of a virus on their news thread. There WAS mention of it by some users, but I assumed the users were getting the same thing I was getting. There was my first problem: Assuming that auctiva REALLY DID have it under control, and google was over-reacting with some new "add-on" page. Trusting Auctiva, I continued through ALL the virus pages from google (bottom right- trust this site and ignore warning- or something to that effect). I ended up IN auctiva's site where I could view pics and see the little red box at the top of my screen. I was a little scared that I was warned so many times as I went into the site. So, I checked the red box at the top of Auctiva again. Still the same thing-server down, we're working to fix it-.
OK-so this virus thing is bogus, and it's just a server thing. I HAVE to get things listed...ALL my pictures are up on auctiva, etc. You know, the same old thing: I have to pay my bills, so I will hustle through all this BS.
NOT! BTW, I DO have the AVAST 4.8 home edition that is consistently updated. AVAST never detected anything until I was OFF the website.
My screen went BLACK and blinked off and on, and my hard drive was making a loud grinding noise.
HAD AUCTIVA TOLD US, EVEN HINTED TO US, THAT THEIR SITE REALLY WAS COMPROMISED by HACKING and their LOYAL CUSTOMERS SHOULD STAY AWAY UNTIL THEY EMAILED US THAT it was TOTALLY Fixed!!!!
I think I have every reason to add my story to the forum on how auctiva SCREWED up. Every single time they have a problem, they take the eBay way out, of "cut and paste: We know there is a problem, things are slow, we are working to fix it, we will be back up at so-and-so time". Shut down the site, give us real answers and YOU deal with the repercussions, Auctiva...NOT us. Confused
wwwwindmilltradingcomwwwwindmilltradingcomMember
Yep, I have bills to pay too.
but... think about it for a moment....
Do you REALLY want to depend on a FREE solution to make sure you make money to pay your bills? That's just not very good business sense.

I'm sorry about all the people who got hit by this virus/malware and did not have an adequate AV solution and/or a backup of their data. Those are the top 2 things you need to have if you use a computer to make your living.

Make sure you have alternate ways to list your stuff and make money. What are you going to do if Auctiva folds tomorrow? Yes, I'll be inconvenienced, but I won't be out of business like it sounds you guys would be without Auctiva.

Don't get me wrong, I LOVE Auctiva, used them for 4 years now, but there's no way I'll have my entire business and livelihood depend on them. That, IMHO, would be just dumb.

My $0.02
T thefozshopMember
As someone who looks after about a dozen PC's and Laptops for friends and family i have come across a wide range of Anti Virus Software and how effective they are.

One of the common threads i see here has been repeated on pc's and laptops that i had to fix and sort out when i was first brought them to look at.

The common denominators? 1. All infested with Virus' and Trojans... 2. Each machine was running Norton!

In my experience, not only is Norton one of the least user friendly pieces of Security Software i've come across but it also regularly fails to detect virus's until long after they have installed themselves,compromised security and let in others so that the system is well and truly infested. I believe part of this is down to it being overly complicated and not very user friendly. This can lead to users inadvertantly letting the bad stuff in without realising. I wont even get started on the cost of it! Save to say that i refused a free Norton package when i bought my latest Windows Vista Business Laptop and went on to persuade the salesperson to ditch it from their own PC!

Uninstalling can also be a nightmare too.

I always recommend AVG Free Anti Virus and Zone Alarm free firewall, along with Spybot Search & destroy, also free. 3 of the best pieces of security software u will ever find and all user friendly.

to those using Norton and whose pcs were infested and had to wipe it all and start again, - the chances are that you were already infested but only became aware of it because you were suddenly aware of the problem with Auctiva.

This is a good time for everyone to review your security practices, and also avoid most of the file sharing sites too which are infested. keep your eye on things, review security and employ the best defence and u should get earlier warnings and be able to take action to stop anything ending up on your PC.
J jik444Member
First of all, a terms of service violation has occurred. PERIOD. Second of all, this affected MILLIONS of dollars of ALL of our income, not just one or two of us. And as long as the time keeps going by, where we haven't heard from a legal speaking agent from Auctiva, as to whether our personal information has been compromised, THAT issue is something an Attorney General's office may have to "get over".
M mikebikerMember
I would have LOST a couple of thousand if my auctions had gone down. I commend them for keeping the auctions and pictures up and running.

Being as honest as possible this is a no win situation for everyone. It is now in the past. Tomorrow is not yet here. Either keep worrying about what was or start looking forwards to what can and will be. I myself am going full speed ahead. My new laptop is in the box downstairs. As soon as all is totally normal again it will be up and running.

I listed and started 50 auctions on Sunday as a result of Auctiva being up and running. I actually signed up and tried Inkfrog. It was so complicated I canceled and came back. I know I need a backup but I have found nothing to compare to Auctiva.
S selling4aliving42272Member
I agree. And it is not Auctiva's fault all this happened. I was able to about 20 listings Sunday and have been working all day to try to get caught up on what I need to do.

I also signed up for inkfrog. And within an hour - cancelled. I think I will look for a backup - just to pull out when needed. I have an ebay account that I use when I need 'fast' cash. I went to it today and listed 500 items. So, that will help me out.

I am on our new computer. But, I have 3 other programs that someone suggested running. On the old computer, my virus program had expired for about a month. This whole mess motivated me to renew it! It did get a virus. But, was easy to remove.
S selling4aliving42272Member
I did get an answer to my help request:

Hello,

Thanks for contacting us regarding this matter, and I'm sorry to hear about your trouble with this. Auctiva website is running very slow at the moment as a result of which you may not be ale to access it as usual there may be some intermittent problems while accessing the Auctiva website. Our technical team is aware of the issue and they are working hard to resolve it as soon as possible. I do not have any ETA as to when this issue will be resolved but hopefully it will not take much time to get the things back to normal.

We apologize for any inconveniences this issue is causing. In the mean time, if there is anything further I can do to assist you, please don't hesitate to ask!

Sincerely,
Auctiva Support.

But, I am still able to get in and do some listings, which will start tomorrow.

<holding my breathe - crossing my fingers - praying this is over finally>
T thefozshopMember
Charity1974: If you use the 3 pieces of security software i recommended then you won't need Kaspersky. if you did use them all with it then AVG and ZoneAlarm would conflict with Kaspersky because they do similar jobs and would cause no end of problems for you.

It would be the same if you ran Windows Firewall with any other firewall.

Only have one firewall and one anti virus running. you can have multiple Ad and Spyware programs running such as Spybot, Adaware and Windows defender but trying it with firewalls and Anti Virus software will cause more trouble than you need.

AVG Free

Zone Alarm Free

spybot

When you download AVG and ZoneAlarm, make sure you choose the free options, don't go for trialpay or the 15 day full version trials. The basic free versions are good enough.

Also, make sure you uncheck the toolbar add in options. whilst they are good, you don't need them and they just clutter up your toolbar.

If anyone needs any help/advice, just shout.

Ebay - TheFozShop
T thefozshopMember
Hi Laura

Took me ages to find this message. I'd forgotten where i'd posted! lol

yup, FozzyBear is me, and that description is me all over! I was on a site called Feesch for many years (chat forum site) and many on there would say that description of me was perfect! Especially the bad jokes!

As for Downloading the Anti Virus and other security software, they are from safe sources so you shouldn't need to scan them with your current anti virus. Though it has been known for Anti Virus software to flag rivals as potentially harmful in the past!

You will need to uninstall your existing security software. This can either be done by going to Start/Programs then the name of your software and using the softwares own uninstaller or by going to Start/Control Panel/Add-remove software and clicking the uninstall button on the relevant software.

ZoneAlarm will tell you it can not detect any anti Virus software when you have AVG installed, kind of a case like that, but its only their way of trying to scare you into paying for their full product which has anti Virus. No need to when both free versions work so well together. AVG also has its own firewall on the paid version.

An Anti virus programme is only as strong as its weakest link - the pc user - same with firewalls and anti spy/adware. Its quite easy to bypass their protection and infect yourself. Most common way is via infected software cd's and USB storage devices. If you don't scan them first, they get in easily. Zipped/Compressed files can also hide some virus's so its wise to download only from known safe sources. Or use a secondary hard drive as a test bed for opening the files. at least then u dont lose your operating sysem should one pop up.

I don't use p2p file sharing networks as they are the worst spreaders of virus's and other problems. Kazaa and Limewire are among the worst ive come across for this by experience of sorting out others pc's. Official ones like BBC's iPlayer are safe (so far).

Using 3 Anti Virus programs as someone said is no guarantee of safer security, in fact, it could compromise security by causing conflicts with the programs and so ending up not scanning properly. Even worse is having more than one firewall on the same pc. It can stop some programs from running, cause others to crash and once you have fiddled around with the various settings to try and allow programs to access the internet through all the firewalls, u run the risk of opening holes in your security so you may as well have none running.

Its possible you may be infected so get the software running asap. also, in the news section there is a list of what to do and how to do it from the tech guys on Auctiva. they recommend Avast Anti virus because it picks up something the others didn't - that was about a week ago now - so AVG should be up to date. Always set your Anti virus to update at least one a day anyway. It may be worth as a precaution downloading Avast, running the scan, deal with any infection, then uninstall and install AVG. run a full scan again. Though as i say, its highly likely AVG will be up to date with whatever Avast was picking up.

I will be sending out your purchase on Monday too, ty for buying :). Ive just listed some St Patricks Day and St Georges Day stock and will shortly be doing some Easter too, not that im advertising or touting for business. lol

Anyway, i hope this helps. if you need any advice just fozzybear@ymail.com click here to email me.

Good luck and hopefully u will be virus free Smile
F funundgames79Member
quote:
Originally posted by www.WindmillTrading.com:
THANKS FOR FIXING THE PROBLEM, AUCTIVA GUYS! (and gals)

I know this was a huge problem.

To all other posters WHINING that it took Auctiva a few days and WHINING that their computers got infected:

DEAL WITH IT. This is a risk you run accessing the internet and not running the appropriately updated AV software on your OWN computer. Don't go blaming Auctiva. It's not their fault. Take responsibility for your OWN actions. Or lack thereof. Do you blame the bus company when you're late for a job interview because the bus got caught in a traffic jam? No. If you did things right, you had an alternate plan (left earlier, knowing you COULD get caught in a jam).

And don't complain that you "lost a $1,200 computer". Get real. Rebuild. Use your backed up data (which you had, right?) And move on. Get back to business. Stuff happens. Deal with it.

My only complaint to Auctiva in all this is that they probably should have been forthcoming in the beginning and shut down the website earlier, instead of trying to "fix the airplane while it was still flying".
Once again, great job Auctiva. Thanks. [B]
Smile

and auctiva shouldn't have been protected to prevent this from happening? People come here trusting the site to be safe. You tell then to just deal with it? Your analogy is ridiculous. People had the right to be upset
S selling4aliving42272Member
It is done and over with. People need to move on. I believe that Auctiva does it's best to prevent something like this. And, while, I don't know much about computers and viruses, nothing is 100%. Even the "Unsinkable" Titantic went down.

Things happen. It wasn't related to the virus. But, my brand new computer, 3 weeks out of the box, had a problem with it. 5 hours on the phone with tech support, I ended up doing a system restore.

So, let's just get back to the business of building our businesses.

Add Reply

Post
Copyright © 1999-2018 Auctiva.com. All rights reserved.

Membership Required

We're sorry. You must be signed in to continue. Sign In or Register
×
Are you sure you want to remove from your Block List?
×
Loading...
×
When you block a person, they can no longer invite you to a private message or post to your profile wall. Replies and comments they make will be collapsed/hidden by default. Finally, you'll never receive email notifications about content they create or likes they designate for your content.
Note: if you proceed, you will no longer be following .
×
Advanced Search
Advanced Search
Link copied to your clipboard.
×