Argonath RPG Police Department

General => General Discussion => Topic started by: Leonardo on July 26, 2012, 00:46:50 am

Title: Argonath Forums containing malware?
Post by: Leonardo on July 26, 2012, 00:46:50 am

I've tried to access the forums a while ago but it gave me a message that the site may be trying to share malicious content, so i wonder... what's going on? Anybody else has seen that also?

A message of the error:

(http://i.imgur.com/Giyu4.png) (taken from Reece)

If this has a plausible explanation or the forums come back, just trash this topic.

Title: Re: Argonath Forums containing malware?
Post by: Cyril on July 26, 2012, 00:49:20 am

Same. I'm trying to contact Murt or Pancher, but they are afk. I would suggest you to not proceed to the forum until something has been cleared up

According to this : https://www.virustotal.com/url/5ab31fd9da781c223aed570d2b7144d61f494873bbffa1cfbda65c8d4c74a579/analysis/

Google Safebrowsing is the only one detecting a malware..

Title: Re: Argonath Forums containing malware?
Post by: Dolfa on July 26, 2012, 01:59:42 am

Same, are you all using Firefox, because it works properly in Chrome

Title: Re: Argonath Forums containing malware?
Post by: Jcstodds on July 26, 2012, 02:09:45 am

Getting same on Chrome

Title: Re: Argonath Forums containing malware?
Post by: Lionel Valdes on July 26, 2012, 02:23:42 am

Having no prob, I can.

Title: Re: Argonath Forums containing malware?
Post by: XSniper on July 26, 2012, 02:26:05 am

Quote from: Jcstodds on July 26, 2012, 02:09:45 am

Getting same on Chrome

Title: Re: Argonath Forums containing malware?
Post by: Leroy Kolta on July 26, 2012, 02:44:47 am

Quote from: Jcstodds on July 26, 2012, 02:09:45 am

Getting same on Chrome

Title: Re: Argonath Forums containing malware?
Post by: Woka on July 26, 2012, 02:51:33 am

Quote from: Jcstodds on July 26, 2012, 02:09:45 am

Getting same on Chrome

Title: Re: Argonath Forums containing malware?
Post by: Dolfa on July 26, 2012, 02:52:37 am

Okay, I got it too after refreshing a couple of times, I suppose it's forum related and not browser related then  :)

Title: Re: Argonath Forums containing malware?
Post by: Padres_Rosso on July 26, 2012, 03:26:33 am

Same here^^
My Safebrowsing shows the following malware elements
http://www.argonathrpg.eu/forum/Themes/core/css/webkit.css
http://www.argonathrpg.eu/forum/Themes/default/scripts/script.js?rc5
http://www.argonathrpg.eu/forum/Themes/core/scripts/theme.js?rc5
http://www.argonathrpg.eu/forum/Themes/default/scripts/sha1.js
Dafuq is that?

Title: Re: Argonath Forums containing malware?
Post by: Jcstodds on July 26, 2012, 03:58:57 am

  Since there was attacks on the server today, I would recommend not logging in until we know more about it.

Title: Re: Argonath Forums containing malware?
Post by: Teddy on July 26, 2012, 04:22:11 am

Quote from: Jcstodds on July 26, 2012, 03:58:57 am

  Since there was attacks on the server today, I would recommend not logging in until we know more about it.

This is the best advice possible.

Title: Re: Argonath Forums containing malware?
Post by: [WS]Mike on July 26, 2012, 05:41:20 am

If you change the ".EU" to ".COM" you no longer get the Malware alert.

Title: Re: Argonath Forums containing malware?
Post by: Padres_Rosso on July 26, 2012, 05:42:57 am

Quote from: [WS]Mike on July 26, 2012, 05:41:20 am

If you change the ".EU" to ".COM" you no longer get the Malware alert.

I do, Better don't try to get access..When its really a Attack, Your pc is infected

Title: Re: Argonath Forums containing malware?
Post by: [WS]Mike on July 26, 2012, 05:47:40 am

Quote from: [WS]Mike on July 26, 2012, 05:41:20 am

If you change the ".EU" to ".COM" you no longer get the Malware alert.

I take this back, it worked on my first tries then I continually got the alert.

Title: Re: Argonath Forums containing malware?
Post by: JDC on July 26, 2012, 05:55:03 am

The FBI Forums have been disabled as well for security reasons. For those who are directed here from the security announcement, it is advised to read the rest of the topic as well for more information.

(http://i280.photobucket.com/albums/kk188/Schitter_95/warning1.png)

ADDITIONAL INFORMATION (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=http://www.argonathrpg.eu/forum/index.php?PHPSESSID=ta185vilq8diuce7qhaam4s9a2&board=22.0)

Advice for ALL users: DO NOT log in to the main forums until any official announcement from the command staff or the Argonath Administration that it is safe to do so.

JDC
FBI Director (VC-LU)
ARPD Webmaster Team

Title: Re: Argonath Forums containing malware?
Post by: JayL on July 26, 2012, 07:46:41 am

I remember that sometime yesterday I got a prompt asking me to install an Adobe update. Past year or so there was a similar issue in which the main forums got infected and there was an application asking you to update Java or something. Maybe that is the source of the malware?

Title: Re: Argonath Forums containing malware?
Post by: [Rstar]Paul on July 26, 2012, 08:09:33 am

I'll check the FTPs since i have access to the main machine.

Title: Re: Argonath Forums containing malware?
Post by: Stormeus on July 26, 2012, 08:26:57 am

I think this may be a bit of an overreaction since, so far, there have been no confirmed reports of an actual attempt to install malware on visitors' computers. The only remotely malicious code that could be found is on the main page (found by SugarD), at the bottom, where, if you're (un)lucky enough, an ad will appear with an invisible, 1px by 1px frame that points to a page with absolutely no content whatsoever -- not a single Java applet, Javascript payload, or even anything like a redirect to another page.

Additionally, Google is the only service reporting infection, and a scan on the page on VirusTotal (https://www.virustotal.com/url/8576ff8221e55e61e73a9891b7a3e8b8ac9c8e9ec829e7b48580e4cd6a3f667a/analysis/1343283924/) confirms this (another scan (https://www.virustotal.com/url/091b657b3d60086a133e782285e43cdf2e4c5bcaa25fcbadde1be66302cd283a/analysis/1343283951/) on the .com domain reports it as completely clean), made worse by the fact that Google's SafeBrowsing technology is and has been notoriously hyperactive (http://www.pcworld.com/businesscenter/article/192808/google_safe_browsing_makes_the_innocent_look_guilty.html).

Is this entirely confirmed? No, we need a webmaster or owner to confirm once and for all that it is safe. Make of the situation what you will. However, I've continued browsing the main site and forum as usual and will continue to do so, and in the past few hours that this has been reported, not once has my antivirus raised any warnings whatsoever, nor do I see any signs of a virus.

EDIT: The "backlinks" ad is there all the time. The iframe is only raised at random. However, even after 17 hard (Ctrl+F5) refreshes and counting, I cannot reproduce it.

Title: Re: Argonath Forums containing malware?
Post by: [Rstar]Paul on July 26, 2012, 09:35:15 am

I've had a deep sweep in the main FTP.

There appears to be nothing suspicious, so will have to wait for Ronnel probably a domain related issue.

Title: Re: Argonath Forums containing malware?
Post by: Cyril on July 26, 2012, 10:00:11 am

Paul, yesterday I got this :

Code: [Select]

"Warning: A problem was detected on this page.

Website at www.argonathrpg.eu contains elements from sites that seem to host malware. These can harm your computer or otherwise operate without your knowledge. Simply visiting a site hosting this type of software can infect your computer.

The following list describes the unsafe elements on the page. Click on the link "Diagnostics" for more information about a particular item.

Malware http://www.argonathrpg.eu/forum/Themes/core/css/webkit.css
Malware http://www.argonathrpg.eu/forum/Themes/default/scripts/script.js?rc5
Malware http://www.argonathrpg.eu/forum/Themes/core/scripts/theme.js?rc5
Malware http://www.argonathrpg.eu/forum/Themes/default/scripts/topic.js

Learn more about how to protect yourself from harmful software online
  I understand that visiting this site may harm my computer. ""
Maybe it can help you.

Title: Re: Argonath Forums containing malware?
Post by: PulseEffect on July 26, 2012, 11:11:30 am

What the?
I try to access the ARFD Forums

and....

(http://img822.imageshack.us/img822/3373/whatisthisx.png)

---

The Argonath Wiki is also showing this.  :conf:

Title: Re: Argonath Forums containing malware?
Post by: Huntsman on July 26, 2012, 11:13:54 am

Same here

Title: Re: Argonath Forums containing malware?
Post by: FlameMan on July 26, 2012, 11:21:15 am

CMB subdomain works cool :D

Title: Re: Argonath Forums containing malware?
Post by: Francisco Martinez on July 26, 2012, 11:58:18 am

Quote from: FlameMan on July 26, 2012, 11:21:15 am

CMB subdomain works cool :D

I see a suspect...

Title: Re: Argonath Forums containing malware?
Post by: Reece on July 26, 2012, 12:01:30 pm

(http://i.imgur.com/9r7lM.png)

Title: Re: Argonath Forums containing malware?
Post by: David Gonzalez on July 26, 2012, 12:59:44 pm

The problem might not be with Google, On the forums only 1 found a Infection (google) but i i scanned the website (argonathrpg.eu) and that URL got 2 Positive for infection.
Link to the scan! (https://www.virustotal.com/url/8576ff8221e55e61e73a9891b7a3e8b8ac9c8e9ec829e7b48580e4cd6a3f667a/analysis/1343300314/)

Title: Re: Argonath Forums containing malware?
Post by: [Rstar]Paul on July 26, 2012, 13:21:41 pm

There is no malware or virus..

There is just a iframe code injection from a unsecured site which was edited on 25/7/12 placed somewhere which makes google detect that there is a malware.
I'm still trying to find the file in the FTP. But there is nothing which is known as a virus or malware.

Title: Re: Argonath Forums containing malware?
Post by: Orel on July 26, 2012, 13:42:14 pm

I thought haters again coming 1 day b4 argo birthday, after I login in the main forums i saw this warning and my mouse moved without me touching him :o

Title: Re: Argonath Forums containing malware?
Post by: Mihail Junkovich on July 26, 2012, 13:48:26 pm

so.. is it safe for us, the users.. or not? :P

I logged in yesterday and today without any problems.. just by clicking "ignore"  :lol:

Title: Re: Argonath Forums containing malware?
Post by: Wake on July 26, 2012, 14:04:05 pm

There is no security risk with logging in, unless there appeared a 'mystic' program update while browsing the forums which you installed.

Title: Re: Argonath Forums containing malware?
Post by: ~Legend~ on July 26, 2012, 14:11:19 pm

I think yesterday something just triggered warnings from Google (search engine) and related software.

It has affected the main Argonath RPG area(s) and some of the linked sub-domains.

Hopefully, like Paul and others have said, we will get confirmations soon.

Title: Re: Argonath Forums containing malware?
Post by: Julio. on July 26, 2012, 22:11:51 pm

Check the adverts.

Couple of years ago two of my PCs were infected, and I traced the location of where I'd obtained it to the argonathrpg.eu link.

Manifested itself as an fake Antivirus under the .exe file 'av.exe'

It blocked Antivirus programs which were installed on my PC, however, I was due a cleanup, so I copied all the files which I considered important individually to an external storage device, and rebuilt the Windows OS.

Title: Re: Argonath Forums containing malware?
Post by: Lionel Valdes on July 26, 2012, 22:15:05 pm

Bottom line, safe or not?

Title: Re: Argonath Forums containing malware?
Post by: Julio. on July 26, 2012, 22:18:19 pm

As safe as anywhere else on the internet.

Title: Re: Argonath Forums containing malware?
Post by: Lionel Valdes on July 26, 2012, 22:20:05 pm

What about in-game, is it safe?

Title: Re: Argonath Forums containing malware?
Post by: Julio. on July 26, 2012, 22:26:29 pm

As safe as anywhere else on the internet.

Title: Re: Argonath Forums containing malware?
Post by: Travis Colt on July 26, 2012, 23:26:14 pm

If google displays a warning that it contains malware, it probably won't have malware.
When you click a 'safe' site, you might be infected, google logic ftw.

Anyhow, the files on Argonath are safe and do not contain malware. Sometimes it happens that google detects certain files as potentionally dangerous. The same happened once to the White Shadows forum, which I can acknowledge is entirely clean. The warning has also been cleared as it was settled down.

Don't be afraid, Sauron did not upload a virus to 'watch' us always.  ;)

Title: Re: Argonath Forums containing malware?
Post by: [Rstar]Paul on July 26, 2012, 23:38:35 pm

Should be fixed since I've no issues or if not wait until Google has fixed it, as Gandalf mentioned, nothing has been infected.

Locked.