Two threats to be aware about.
1) Malware has been detected on the forum main page. I’m downloading the entire site and scanning it offline but so far I can’t see anything so hoping it is another false positive. I’m taking the forum off line until I find out. Report back later.
2) Got an email from a third party via my contact me form asking about the Wilderness Gathering. Seems it is an ideal place to meet up. Well it does appear to be the place to find preppers I agree. I’m now considering not going. My OPSEC is more important.
Update : I’ve scanned the source files and found no malware. However, my virus scanner still detects the site as a threat so I’m leaving it off line until I can work out what is going wrong. I suspect I may have to rebuild the site. 🙁
Update 2 : Can’t find anything wrong with the site. I’m going to try some other AV SW today. Sorry for the downtime but better safe than sorry. If you can see the forum then let me know what AV you are using. Avast is blocking me and displays an error page. I’ve had emails from others with the same.
Update 3 : In work and their system doesn’t have an issue with the site and it does with many of the sites I visit. I scanned the source as well and with no results. I’m assuming that it is a false positive with my AV. I’ve therefore openned the forum back up.
Sad news SD
This is a headache I know you could do without atthe moment.
I hope you’ll be able to reinstate without having to rebuild..
Regards
LS
I can see the Forum page (closed for maintenance) and I use Zone Alarm free anti virus & firewall: their free anti virus is a fairly recent service.
I’ve had major problems with Avast recently, which is why I’m now using ZA. I’d ended up having to do a system recovery which is always a pain, especially the 130 or so Windows Updates to reinstall, but Avast had messed up the PC so badly that nothing else worked.
Hope this may be of help and good luck with the forum.
Avast and AVG both alarmed up on the forum.
“HTML (inf) suspect” was in the given detail.
Had this before on a site I managed.
Turned out to be a bad URL reference to a specific page if that’s any help.
Nothing showing with Malware Bites or AVG ??
can get on this page but forum is blocked, Avast says Malware blocked. hope you can sort it soon SD best wishes bigpaul.
Thanks for your help guys. It may just be a false alarm but I want to play safe. AFter all reducing risk is our nature. The forum is now back up.
Thanks again SD for taking the time and effort to p[rfovide us with an invaluable service, we owe you big time.
i still cant access the forum!
But I can see your name on the bottom of the page saying who is online ???
well, it still isnt letting me onto the forum: google chrome says: the connection to….was interupted. and Avast says Malware blocked..also “infection details”:HTML:script-inf…..if that makes any sense to anyone!
How paranoid are you, rank yourself:
0: It’s probably fine, don’t worry about it.
1: It’s malware, need to find it and eliminate it
2: Your anti-malware software has decided that the forum is not in keeping with the company political views and has decided to add the SUK site to a ‘danger’ list to scare all their users off from the forum.
that (no 2) would not surprise me at all!
and if that is the case then i am screwed, it wont let me back on period.
Like BigPaul I’m not getting onto the forum.
Avast reports:-
http://forum.survivaluk.net/index.php|>{gzip}
Threat: Html:Script-inf
Then it’s a total lock out.
Guys, I have Avast at home and I can’t get in from there myself. I have to goon the forum at work.
As there is nothing wrong with the forum I can’t fix it. The latest update to Avast is what is causing the problem. No other AV seems to have an issue, I’ve used Norton, mcAfee and AVG Free today without any malware found. I also downloaded all the source for the forum and scanned that with no malware found.
Avast will fix it in an update. Until then we are locked out.
i seem to be back on the forum thanks very muchly to NR, we had to remove Avast then i can get back onto the forum, maybe thats what you have to do Paul, it seems Avast dosent like the forum for some reason.
Shows you’re doing something right, Skean.
I’ve just gone into the Avast control centre by Right clicking the icon in the tray. Where it says Web Shield I unticked the Scan Web traffic box. It still detects and stops the ‘malware’ but displays the site.
Done and Done.
zonealarm installed.
AVAST filters webstat among other things.
You can’t turn this off but I’ve put in a job ticket to avast to see if there is a work round.
I’ll print the result when I get it.
Paul
glad to hear that it was just a false positive!
Guys – Using Avast – as SD says just open up the Control Centre , click on real Time Shields then Web shield , Expert settings , Exclsuions then URL’s to exclude and add the forum address into it.
Click OK , then you should be good to go.
…..hope this IS a false positive…….
No need to re-install updates or uninstall avast.
Disregard my last – every other forum page you try and open you still get the alert – just follow SD adice , it should allow access at least.
Avast still blocking forum. It is open if you follow S.D, advice above…
Got reply from Avast,
“Hello,
Your page was infected.
Search for this string:
“script src=”http://www.bitcoinplus.com/js/miner.js” type=”text/javascript”>BitcoinPlusMiner(“4625946″)”
If you’re an administrator, delete this script to heal the webpage.
Miroslav Jenšík
AVAST Software a.s.
“
Bucket,
Thank you. That has identified the issue and I see what the problem is.
1) That is not a threat. It is a BitMiner and I used it a long time ago on the site.
2) I commented it out not long after and although the code specified is still in there it appears as text. Look in the source and search for bitcoin.
3) The page is not ‘infected’
4) The page does not need healing.
5) It is a false positive.
Thanks Avast for not recognising it is a comment and also deciding that something that is a l;egitimate tool is a threat. Some sort of warning would have been much better that a simple site block.
I’ll remove the code when I have time over the weekend even though I don’t need to. A ‘threat detected’ warning will frighten people off. It’s annoying me.
I’ve removed the commented code. I would suggest that anyone who unticked the box to access the site replaces the tick to replace whatever was turned off.
I can confirm that there was no infection, no malware and no threat to any user and there never was. It was a false positive.
Thank you for your support during this period.