Web Attack

[Knightoe]

The warning I'm getting is directly from Google.ca. If you check the link posted by zander465 above, Google identifies the f18 subforum (voyeur/candid) as the point of entry by some Romanian site which has a history of distributing "malware". It does not say that malware was in fact installed on the Forum. This is perhaps why felix is coming up empty on his virus/malware scans. I scanned my own computer to see if I caught something. My anti-virus and Windows Defender found nothing ~ but I keep getting the nasty warnings.

[felix]

Thanks for the feedback, guys.

So far, it seems like the Candid/Voyeur SubForum was wrongfully listed as a malicious website on Stopbadware.com, a service which browsers and virus scanners are using to identify attacking sites.

To make 100% sure, I will perform some more tests to check for security breaches on the website. Then, I will request a review by Stopbadware.com to get this SubForum unblocked as soon as possible.

Thank you for your patience and stay tuned

[felix]

Here's an update on this issue:

Using Sucuri Malware Scanner, I was able to identify some infected javascript files on the webserver. They have probably been automatically modified by a malware distributor.

The corresponding files were replaced by the clean, original files.

I have not yet found out how the server was breached, so there is a chance of re-infection. However, I have changed all webserver passwords, to reduce the risk of re-infection and will keep a close eye on the server during the next few days.

Additionally, I have submitted this site for review to be unblocked from Google Safe Browsing and Stopbadware.org to stop the warning messages.

It seems that only some browsers or browser version were affected by this attack. (I didn't have any trouble with this, using Windows 7 and the latest version of Firefox, 13.0.1)

For additional protection, please update your browser to the latest version and keep your anti-virus-software up to date.

[dorre]

Malwarebytes suddenly denied me access to your webpage something is not right.....

[felix]

Originally Posted by dorre

Malwarebytes suddenly denied me access to your webpage something is not right.....

Right now the site is clean.

The site is still blacklisted at stopbadware.org and Google Safe Browsing though, because they have not yet re-checked the infection status.

[jeansmöse]

Hello, since i installed Kaspersky IS 2013, the Forum URL is blocked.
Sucury Site Check reports site blacklisted, vBulletin version outdated: Upgrade required

Has anyone else the same problem?