Site has malware?

[Omgwtfbbqkitten]

Re: Site has malware?

First, that damn warcraft icon that's popped up over the past few days.

However, more specifically, think back a few weeks to when there was that little spam for whatever that online money was. There were two or three threads about it under new posts, all starting with 'someone' asking about the 360 version of FFXI. All three initial posts in the threads were dated 2007. Two of the threads had responses by the time I saw them and those posts were dated correctly in 2009 to be new posts, but there was a thread with just the initial post that was dated 2007 even though it was on the latest 7 posts.

It looked like the first posts had been planted with an old date to look legitimate while still being a place to post the actual followup spam.

It could be nothing, but it just looked very odd to me.

Those "webmoney" posts did look suspicious to me, which was why I called attention to them when they came up. Some dude just bumped old threads spamming about where webmoney could be sold.

Webmoney isn't a common term to throw around here. It might be if you were on a Japanese site, but this isn't a japanese site. Talking about webmoney here is about as casual as some guy knocking on your door and telling you "I just happened to be reading The Watchtower." Meaning, there's nothing casual about it.

This might be worth looking into.

[Mhurron]

Re: Site has malware?

It was right on the Final Fantasy XI :: Dreams in Vana'diel :: Community - Powered by vBulletin page when I saw it, not any specific thread.

[PiNG]

Re: Site has malware?

wondering, anyone can tell me on which thread/s did that icon come up on?

[PiNG]

Re: Site has malware?

I'm looking into this matter right now, i see the picture that Mahurron linked , i'm gonna go ahead and do a site wide scan make sure there was no breach of security during last few days and check for any thing that's suspecious. Site will be down during the time.

[Taskmage]

Re: Site has malware?

I can't see the image in that post. I had to go to edit it and pull the url from there. I've never seen that but that is indeed disturbing.

[Mhurron]

Re: Site has malware?

Wow, good eye. What warcraft icon though?

http://www.ffxionline.com/forums/comments-suggestions/74572-looking-input-site-changes-3.html#post827959

That was yesterday at around 9:30 am EST. I saw it about the same time the day before that as well.

[Taskmage]

Re: Site has malware?

However, more specifically, think back a few weeks to when there was that little spam for whatever that online money was. There were two or three threads about it under new posts, all starting with 'someone' asking about the 360 version of FFXI. All three initial posts in the threads were dated 2007. Two of the threads had responses by the time I saw them and those posts were dated correctly in 2009 to be new posts, but there was a thread with just the initial post that was dated 2007 even though it was on the latest 7 posts.

It looked like the first posts had been planted with an old date to look legitimate while still being a place to post the actual followup spam.

Wow, good eye. What warcraft icon though?

[Mhurron]

Re: Site has malware?

So it's safe to say whatever malware that was on here(apparently trojans) is gone now?

Technically, since so far nothing has really been confirmed or denied, the fact that it may or may not be gone can also neither be confirmed or denied.

[Neomage]

Re: Site has malware?

So it's safe to say whatever malware that was on here(apparently trojans) is gone now?

[ShepardG]

Re: Site has malware?

I just ignored it, I hear that works. If you ignore someone who is attempting to mug you at gun/knife point, it's impossible to get shot/stabbed. That's fact.

[Mhurron]

Re: Site has malware?

What are you thinking of specifically?

First, that damn warcraft icon that's popped up over the past few days.

However, more specifically, think back a few weeks to when there was that little spam for whatever that online money was. There were two or three threads about it under new posts, all starting with 'someone' asking about the 360 version of FFXI. All three initial posts in the threads were dated 2007. Two of the threads had responses by the time I saw them and those posts were dated correctly in 2009 to be new posts, but there was a thread with just the initial post that was dated 2007 even though it was on the latest 7 posts.

It looked like the first posts had been planted with an old date to look legitimate while still being a place to post the actual followup spam.

It could be nothing, but it just looked very odd to me.

[Taskmage]

Re: Site has malware?

This is what google says about us:

Safe Browsing
Diagnostic page for ffxionline.com

What is the current listing status for ffxionline.com?

Site is listed as suspicious - visiting this web site may harm your computer.

Part of this site was listed for suspicious activity 2 time(s) over the past 90 days.

What happened when Google visited this site?

Of the 17 pages we tested on the site over the past 90 days, 7 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-02-21, and the last time suspicious content was found on this site was on 2009-02-20.

Malicious software includes 8 trojan(s). Successful infection resulted in an average of 15 new processes on the target machine.

Malicious software is hosted on 2 domain(s), including gaoqiong.com/, fuck-hack.com/.

This site was hosted on 1 network(s) including AS26347 (DREAMHOST).

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, ffxionline.com did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.

How did this happen?

In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

FFXIAH was listed as clean, so it's not that script: Google Safe Browsing diagnostic page for www.ffxiah.com

Again, I haven't been able to replicate the occurrence of any unexpected scripts, so it's probably safe but exercise caution as always. I've sent an email to PiNG and AKo so hopefully they'll be along with a more thorough investigation and get Google to re-review the site before long.

[Telera]

Re: Site has malware?

Yeaaaah, kinda agitating. Though the warning report as to why it's blocked says that in the past malware has infected people twice from this site. Hosted from other places, apparently. One of the listed hosts looked Chinese to me, the other I forget offhand.

So... yah?

Edit: This is what it says

What happened when Google visited this site?

Of the 17 pages we tested on the site over the past 90 days, 7 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-02-21, and the last time suspicious content was found on this site was on 2009-02-20.Malicious software includes 8 trojan(s). Successful infection resulted in an average of 15 new processes on the target machine.
Malicious software is hosted on 2 domain(s), including gaoqiong.com/, fuck-hack.com/.
This site was hosted on 1 network(s) including AS26347 (DREAMHOST).

[LyonheartLakshmi]

Re: Site has malware?

If you're in FireFox, under Options in the Security tab you can uncheck "Tell me if I'm visiting a suspected attack site" and it will stop bothering you here, but naturally that's probably not a setting you want to leave off full time.

You can also add sites that are an exception to this rule.

I tried posting a thread about this earlier (before this thread popped up), but couldn't with that warning that kept coming up every single page load from this domain. If I click the choice for "ignore warning", I expect the browser to remember that instead of asking me the same thing with every single change in URL while I'm browsing the site.

I may indeed leave that option turned off full time. It isn't just warning me. It's flat out blocking my ability to use a site. I have Adblock and Noscript bolted on and working for a reason. I really don't need this warning-that's-far-more-aggressive-than-just-a-warning feature.

[Taskmage]

Re: Site has malware?

It would explain a few things.

What are you thinking of specifically?