MTG Salvation

I constantly have a problem where I cannot access these forums because Performance Systems International will not allow access to them when a Firewall is up blocking them from stealing information.

I just want to find out if any of the mods know if this company has legally installed a creeper on this site or not. This company is involved in very illegal data mining and they are doing so on this website.

Can someone please tell me how to stop this? This may be a problem with the entire site, or it may just be my problem, however after some research I believe that it is a problem with the host.


This is a repost from the Tech forums. It has been about a week and no one answered there so I moved it here....

I've never had a problem with it, though the company does sound quite fishy.

Just out of curiosity, how do you access the forums without disabling your firewall (when they try and gank your information)?

I disable the firewall to access these forums!!!

Do you use PeerGuardian as your firewall?

Can any Moderators comment on whether or not MTG Salvation allows this company on their page?

I don't recommend doing that. Obviously they're trying to steal your information, and if you disable your firewall, it'll just be that much easier for them.

Try Zone Alarm instead.

That's what I use, and I've never had a problem accessing anything.

I definitely recommend you scan your computer for viruses, spyware, adware, anything evil, on a regular basis.

I'd have to ask Hannes or one of the admins if we've blocked their IP range (38.*.*.*), but from what I can see about their spidering and datamining activities, having them blocked is a very, very good thing. Are you running a firewall or some other software that they may have written part of? I'm honestly unsure how they could block your access to the forums unless you're using a firewall or hosts file or something from them.

We're not blocking anything 38.*

We send the usual vBulletin cookies like any other vBulletin site.

Can you try to access www.vbulletin.com/forum/?

Thank you everyone for the responses.

I can get on www.vbulletin.com/forum/? with no problem while the firewall is active.

When I get blocked from sites it is beacuse they are tryign to access my computer in some way. With the local train website for example, I cannot log in beacuse the Transit Authority is trying to access my computer and PeerGuardian blocks it. I do not know how to check to see if PSI is on my computer through another program, but I do not beleive this to be the case.
I will try Zone Alarm, but then I will still get accessed my PSI. I am surprised that no one uses PeerGuardian, it is an amazing program.... I beleive that if someone tried this program out that they would have the same problems accessing these forums.

I can assure you we are not trying to access your computer in any way.

We run the same software as vbulletin.com does so why you are having problems here, I really don't know.

Quote from drakescree

Thank you everyone for the responses.

I can get on www.vbulletin.com/forum/? with no problem while the firewall is active.

When I get blocked from sites it is beacuse they are tryign to access my computer in some way. With the local train website for example, I cannot log in beacuse the Transit Authority is trying to access my computer and PeerGuardian blocks it. I do not know how to check to see if PSI is on my computer through another program, but I do not beleive this to be the case.
I will try Zone Alarm, but then I will still get accessed my PSI. I am surprised that no one uses PeerGuardian, it is an amazing program.... I beleive that if someone tried this program out that they would have the same problems accessing these forums.

If it's so amazing that it's blocking your access to certain websites, I don't think it's doing its job at all.

The best solution I can think of is to just switch to a different firewall. I really don't know what else to tell you.

Let me digress back to the original point of illegal access. Changing firewalls and blocking IP ranges does not solve any problem. Also they use a 3rd party server so the IP range does belong to some valid companies.

PSI is a company that installs creepers into peoples websites. The host or owner is never suppose to find out that the creeper is in their page.

Please allow me to use some references and quotes from outside sources here to attempt to validate my argument.
"The same one also left me wondering for a long time until I made further research. With the following IPs
38.98.120.83
38.100.41.112
This started to happen after I tried to contract some one supposedly from India to work on my site who mentioned an affiliate company in the US. Interestingly enough the person who signed on to my site also belonged to the same strings of IPs which is 38.98.120..83. I fired the group and kicked them out from from my site. After further investigation to my files, I found out a suspicious program called CERBERUS installed on my site. I confronted the person who pretentiously claimed to be working on my site. He dodged the questions.
Does any one have any advice for me where to check for site integrity and security vulnerability and how to take care of it?
Thank you for the info.
http://www.my-whiteboard.com/business/performance-systems-international-inc-is-stealing-your-data-doing-nothing-good.html
---

http://www.bleepingcomputer.com/forums/topic74030-15.html
This link has a post from the above guy along with some other relevant information about a person who found PSI hiding in the program WeatherBug. Whereas this link addresses client side problems, the first link addresses server side problems.
---

http://www.webmasterworld.com/forum11/1861.htm
Do not know how relevant his last link is.. just figured I would throw it in.
---

This is my last post on this thread, as it seams I am upsetting the wrong people with talk of this creeper. But please someone take this seriously, because just baning the IPs or changing firewalls is not a solution, it is a diversion.

I honestly have no idea what you are trying to tell me.

We are not hacked, we don't send spam and we certainly don't try to access your computer or install anything on it.

Are you sure you didn't pick up spyware from somewhere else?

I've had various firewall programs running while accessing this site from different computers and I have never been able to establish any pattern of anything other than the typical IPs for the ad banners.

i personally use Trend Micro Internet Security and i (recently) have had outside accesses to my computer such as something opening when i didn't click it and i just upped my secure settings. to high. and it's not happened sense.. but i do reccomend Zone Alarm, Trend Micro and Eaccelleration as really nice firewall programs.. you can find then are Housecall.com (for Trend Micro) and Stopsign.com (for Eacelleration) and Zonealarm (respectively).. I also have a few buddies who reccomend those three firewalls. as they have been hackers in thier past and i tested thier skills with my PC and they were blocked as long as i had 2 of the three online and running.. 3 of 3 is perfect and blocks any and all threats. at least to my testing purposes.

Quote from Hannes

I honestly have no idea what you are trying to tell me.

We are not hacked, we don't send spam and we certainly don't try to access your computer or install anything on it.

I agree with Hannes on this one.

Obviously, I'm not an admin or mod or anything of the sort, but I like to try and help people.

And I've been trying to help you, drakescree, but I'm not sure what you want. The possibility exists that your problem has absolutely nothing to do with MTGS. Just because it blocks your login doesn't mean Salvation is the problem.

I'm sorry, but...none of us can help you until we know what you want.

It's frankly pretty bold of you to claim that only your (somewhat random) firewall is stopping these supposed connections, while no other, more established firewall is apparently able to detect them (since no one else is having this problem.)

So you think that PSI installs "creepers" on web servers which try to steal visitors' data?

My understanding from (quickly) reading the links you gave is that PSI runs spiders which suck data off of web servers, and that they typically run these spiders from IP addresses that start with 38.*. Many webhosts have blocked browsers from those addresses because of the spiders' abuses.

I don't see anything about software being hosted on web servers to spy on users. Where are you getting this from??! (I guess we will perhaps never know, since you have made your "last post" in this thread. :()

It is entirely possible that the spyware program is a domain crawler or similar that downloads itself based on you accessing certain vB forums within certain IP ranges. As has been said from above, using good Firewall/Anti-Spyware programs shouldn't be an issue.

Without going into all the technical mumbo-jumbo, ultimately this wouldn't have anything to do with MTGS unless they searched their forum code for any hacks within the software, and would probably have more to do with accessing the site through a URL identification routine, or from the Server.

Not very clear, but hope that helps