Image Shack

[nellie2]

It has recently come to my attention that ImageShack is serving up malicious advertisements and as such, if you click on an image shack thumbnail then you could find that you are suffering pop ups that won't go away and that your system may be compromised.

Running a hosts file will help to protect you.blog

I've written about the problems in my blog

So I must ask you all not to use Image Shack to post images to the forum, you can upload images using the forum software but you do have an upload limit. To manage your uploads go to My Controls > Manage your attachments. Or use another image hoster. As far as I know at the moment the problem is only with Image Shack.

[Tankus]

ooooeeerrr its my server of choice ...I've not had any problem though ....

eeerrr ...and what about the near 200 clickythumbs that Ive already posted ...?

[djohn]

Don't worry about the ones you've already posted Tankus, I think they will most likely be all right. Its ones taken in the last 10 days or so that seem to have a problem, and not all of them, just some. Nel along with her friends is looking into it right now to see if it can be isolated. We found that full size images posted to the forum were OK, it was the clickies that caused a problem when clicked on. As soon as you are taken to the full size image there is a chance of a pop-up or pop-under that doesn't want to go away no matter which method you choose to close it. :(

I'm sure Nel will soon have it sorted, but if anyone does see this pop-up or feels they may have seen one in the past week or so please run an on-line scan from trend. Trend Micro Scan click on 'Free tools' from the tab at the top of the page, it will start the scan process and take about 40 to 45 minutes, just delete any spyware or scum it finds. :)

[CurlyWhirly]

I've not had any problem though ....

Well I had loads of problems a couple of days ago and it was djohn that brought it to our attention on another forum so his warnings were very welcome.

I ran a Trend scan and it found 2 grayware entries: TSPY-CIMUZ and TSPY-AGENT.TQ

Trend was able to get rid of the CIMUZ entry but couldn't clean the AGENT.TQ entry because I later realised that I hadn't switched System Restore off so it must have been detecting it in there.

Apart from the pop-ups, which were a pig to get rid of, I also had these symptoms:

1. Windows Media Player wouldn't play movies or songs with any sound

2. The Windows taskbar kept disappearing unless I brought Windows Task Manager up and then it would reappear but as soon as I closed it down, the taskbar disappeared again.

3. When I typed text into post on the forum it would come out garbled.

For example:

Every letter that I typed was displayed but it would only get jumbled up on some words, for example:

At the time of the malware incident, if I typed:

"Windows Setup: An error occured while copying setup files"

it would come out like:

"Windos wSetup: n errroA occured whlei copying setup fisle"

See what I mean?

That has never happened to me before and no I wasn't drunk!

Also, I checked in Windows Task Manager and CPU usage was at 100%.

4. Worst of all my McAfee anti-virus wouldn't run a full system scan as what happened was that the memory scan would run okay for the first 30 seconds (aprox) and then when the hard drive scan started, the scanner window just disappeared :0

When I tried to run it again from either the Windows taskbar (via the McAfee Security Center) or my desktop AV icon, it wouldn't run.

I even tried it in Safe Mode so the conclusion that I came to was that my anti-virus was damaged.

After I was clean, I uninstalled McAfee as this was the second time my anti-virus got damaged by malware.

The first time when it loaded, I kept getting a error message saying "Some McAfee components are either missing or damaged. Please reinstall." and I got fed up of this happening again and so I am currently using NOD32 on a 30 day trial and I am very pleased with it so far.

[Alan2273]

I'm glad i use Photobucket.com, I have been with them for about 2 years and had no problems.

[Tankus]

blimey

[Tankus]

Sure it was caused by imageshack ....Curly ..?

[dadyassa]

I have used imageshack for a long while, and like tankus had no problems.

[Craig]

All,

The Gallery is back up and running for all that wish to use it.

Additionally, everyone has upload space for images here at the forum while posting topics, so please use it!

If you find yourself running out of space, as pointed out previously, you can managed your uploads in your control panel.

If storage does become a real problem for you, contact me direct via a PM and I'll see if i can sort something out.

Craig

[dadyassa]

Thanks Craig :)

[P;3]

I have used imageshack for a long while, and like tankus had no problems.

I too have used imageshack; however, this problem has seemingly only recently arrisen and as CW reports above it can really mess up your computer; also, as Djohn states,doing a Trend scan( as i have just done, having just maanged to evade "capture by a possible "nasty" )can sus out and deal with a threat;

I got a green web page appearing UNDER an image I clicked on ;having not asked FOR that web page, I closed IT by the black cross, but have scannned nevererthelss, as , as Djohn has advised me, the malicious code could be even hidden in the black cross that I had used to click on to close the page

others have said elsewhere that you use imageshack at your own risk; but why even USE it if you KNOW that the site or something on it has more likely than not,caused a computer to be infected?

unless of course you are a "computer nasties expert "and wish to quite deliberatly infect your (spare)pc to see how easy or tough it is to clean it?

[-pops-]

Someone must be responsible for the running of Image Shack. Aren't they doing anything about this? :(

[dadyassa]

I have used imageshack for a long while, and like tankus had no problems.

I too have used imageshack; however, this problem has seemingly only recently arrisen and as CW reports above it can really mess up your computer; also, as Djohn states,doing a Trend scan( as i have just done, having just maanged to evade "capture by a possible "nasty" )can sus out and deal with a threat;

I got a green web page appearing UNDER an image I clicked on ;having not asked FOR that web page, I closed IT by the black cross, but have scannned nevererthelss, as , as Djohn has advised me, the malicious code could be even hidden in the black cross that I had used to click on to close the page

others have said elsewhere that you use imageshack at your own risk; but why even USE it if you KNOW that the site or something on it has more likely than not,caused a computer to be infected?

unless of course you are a "computer nasties expert "and wish to quite deliberatly infect your (spare)pc to see how easy or tough it is to clean it?

Jumping the gun a bit aren`t we, assuming that we will continue to use the site.

As it has only just started, and with excellent advice as usual on this site warning about the risks, I dont think I will be using it untill its sorted.

[P;3]

Someone must be responsible for the running of Image Shack. Aren't they doing anything about this? :(

one would hope so; but, as has occurred to me, they have to get their financing from somewhere; so how scrupulous ( or not) are they on who they allow TO advertise on ther web space? I know that this and other forums screan theri members before allowing them to post; BUT , does imageshack screan ITs potiential advertisers etc?

the problems I have encountered with this are very small compared to those of others (Including getting the Trend thing to work properly)

the perhaps annoying thing is that you find a site that does what you wish it to do with hosting immages then discover that it or what is connected with/to it could be the source of an infection;

I for one am staying clear of it any any images until we know 100% for sure that the site IS clean; my pc has very little on it compared with many of you, but even that small amount I seek to protect to the best of my abilities :(

[-pops-]

P;3

The best thing to do is ensure you have a full system backup that you can install if you are unlucky enough to become infected with anything as nasty as this Image Shack infection appears to be.

[Thos]

All,

The Gallery is back up and running for all that wish to use it.

Additionally, everyone has upload space for images here at the forum while posting topics, so please use it!

If you find yourself running out of space, as pointed out previously, you can managed your uploads in your control panel.

If storage does become a real problem for you, contact me direct via a PM and I'll see if i can sort something out.

Craig

Thank you, Craig, for restoring the gallery. I have missed it.

I have posted a few piccies of Alaska taken during my recent visit and they all uploaded OK.

Thos. :)

[andsome]

Never used Image Shack

[joysness]

How do I tell if the clickable image is from Image Shack?

Is there some way to know before clicking to enlarge or show the image?

I rarely click them anyway, but just to be safe does it say anywhere on the image before you click it and if so where?

(Hope this makes sense )

thanks

[CurlyWhirly]

Sure it was caused by imageshack ....Curly ..?

Not 100% but my internet activities are mainly on forums and on those forums that don't support an image host service then I use ImageShack and so I can't think of anywhere else where I would get it from to be honest

I don't bother with P2P networks or visit 'dodgy' websites either.

The best thing to do is ensure you have a full system backup that you can install if you are unlucky enough to become infected with anything as nasty as this Image Shack infection appears to be.

I did restore a DI7 backup that was 10 days old but the malware was still there which means that it must have been on my PC for a number of weeks without me realising it :0

I did notice that sometimes when I uploaded an image to ImageShack or clicked on an ImageShack thumbnail, then I would get a pop-up and even if I clicked the Cancel button, I still got directed to an advert saying that I have errors in the registry, etc.

It went by the name of System Doctor 2006 and offered to fix PC errors in return for a fee.

By the way, the names of the 2 grayware entries were TSPY-CIMUZ and TSPY-AGENT.TQ

Just a thought, perhaps the keyboard oddity where the lettering was all mixed up (when I typed) was some sort of password stealer?

At the time this happened, my CPU usage was at 100% and Firefox felt sluggish as well.

My thoughts on ImageShack are that it is a highly respected website and these spyware problems are probably caused by the owners not being thorough enough with their vetting procedures regarding advertisers?

I am in no way suggesting that ImageShack delibrately set out to infect our PC's.

[djohn]

Hello joysness. :) All our mods will be keeping an eye open for the time being. Easy way to check though is to right click on the image, choose properties and it will tell you where its hosted.

Yep! Almost 100% certain where Curly picked his problem up from. Same place as I did on Sat afternoon July 8. Curly had it from 10 days earlier but did not realise it. He had seen the pop-up - pop-under but thought he had stopped it from downloading when he closed the browser.

He had no way of knowing at the time as all of his security applications gave him the all clear. I clicked on an image on Sat. afternoon to be confronted with the same thing, all normal methods of closing it refused to work so I Crtl/alt/deleted it. Right click on task bar and stop from task manager would do the same and I believe Crtl/F4 also cuts it off.

I thought I had stopped it in its tracks and for about 15 minutes thought no more about it. I have a very fast running machine even though its 4 years old now, very smooth display of graphics on a professional 19" TFT display. I moved the scroll bar slightly down the screen and noticed a slight jerky movement, opened Task manager and saw my CPU was running at 100% when it should have been at 2 to 3%. That is when I ran the scan from Trend, informed Nel and other staff of what had happened then went back to a couple of the images to check again.

I deliberately clicked on two images and was infected again from both of them, one was minor the other was serious. I cleaned my machine again [45 minutes] then went back to the second of the two images and caught the same trojan again. Cleaned off again and a second run through to make absolutely sure my machine was clean.

Most of Sat/Sun Nel and her colleagues were working hard looking into this issue to confirm it was from imageshack then try to work out the best way of preventing it infecting all our members of the forums we visit. Nel is still waiting for a reply from an email to imageshack requesting them to investigate further. Do we think all of imageshack is infested? No, not at all, but there may be a problem with imageshacks advertising sites. Some images from there are. Were they infected before being uploaded to I/M or after? Don't know, but Nel will find out. :)

[nellie2]

I've not heard anything back from ImageShack yet and I don't know if I will... there was a similar problem not so long ago with Dilbert.com They also serve thrid party ads and were unwittingly blasting their visitors with malicious adverts for rogue products like Winantivirus. They quietly cleaned up their act but didn't reply to any communications that were sent to them.

The problem did come from ImageShack thumbnails that were posted to the forum, that I am sure of.

[doug]

I also had a problem, TSPY_ANALOGXPROXY. Think I've cleared it using the Trend Micro link. Will ahve to do a hijack if I see anything further.

[P;3]

do we know if imageshack actually do any kind of vetting process for their advertisers? I am sure they would not wish to "get a bad name" in the computer world would they?

the last time I actually went TO the site I found it had some very intrusive ads on it too, some of which were a bit difficult to negotiate around and one had to be careful one did not click on any of them

surely one would wish to have a site that is "noteworthy" for its reliability and service, and NOT for "nasties" ;)

[joysness]

Thanks djohn for the info.

I'll check all thumbnails before I click them.

And thanks to All you wonderful folk for keeping us safe from these malicious jerks.