One opened, more to come!Operation Clambake Message Board Forum Index
 OCMB FAQ  FAQFAQ   SearchSearch   RegisterRegister  Last Day PostsLast Hour/Day/Week  Operation Clambake main siteOperation Clambake
 ProfileProfile    Log in to check your private messagesLog in to check your private messages   Log inLog in 

The time now is Fri Jul 30, 2010 5:08 pm
All times are GMT + 2 Hours
Forum index » General Topics » Opinions & Debate
Malware on Operation Clambake?
Post new topic   Reply to topic Page 1 of 2 [26 Posts] View previous topic :: View next topic
Goto page:  1, 2 Next
Author Message
secularpatriot



Joined: 04 Apr 2005
Posts: 296
Location: USA

PostPosted: Tue Jun 16, 2009 2:29 am    Post subject: Malware on Operation Clambake? Reply with quote

I have been getting this message when I visit Operation Clambake:

Warning: Visiting this site may harm your computer

The website you are visiting appears to contain malware. Malware is malicious software that may harm your computer or otherwise operate without your consent. Your computer can be infected just by browsing to a site with malware, without any further action on your part.

For detailed information about problems found on this site, or a portion of this site, visit the Google Safe Browsing diagnostic page for xxxxxxxx.xx.

Anyone know if this is a real problem?

--SP

(Edited to remove possibly dangerous link.)


Last edited by secularpatriot on Tue Jun 16, 2009 5:24 pm; edited 2 times in total
Back to top
View user's profile Send private message
pharbizorg



Joined: 12 Jul 2006
Posts: 482
Location: Glorious Nation of the Peoples' Canada

PostPosted: Tue Jun 16, 2009 4:36 am    Post subject: Reply with quote

I'm interested in what your specs are: (ie Operating System, Antivirus, etc...)

I am currently running Avast Antivirus (link here) and on Windows 7 (the latest out from Microsoft). I get no messages, but I do recall something similar of this nature that someone brought up a year or two ago. If you can provide what OS you use, your antivirus, and the signature that is being triggered so that I might do some more inquiries into the alert.
_________________
"However beautiful the strategy, you should occasionally look at the results"
"He has all the virtues I dislike and none of the vices I admire"

~Sir Winston Churchill - British politician (1874 - 1965)
Back to top
View user's profile Send private message
secularpatriot



Joined: 04 Apr 2005
Posts: 296
Location: USA

PostPosted: Tue Jun 16, 2009 5:12 am    Post subject: Reply with quote

pharbizorg wrote:
If you can provide what OS you use, your antivirus, and the signature that is being triggered so that I might do some more inquiries into the alert.


I'm on a Mac, with OSX 10.5.6.

This is a laptop they gave me to use from work, so I'm not sure what the anti-virus software might be. Any guidance on how to find out? A search of the computer for "anti-virus" or "antivirus" didn't bring up anything.

Not sure what "the signature that is being triggered" means?

Thanks for your help! Just wondered if someone somehow got some malware onto the site.
Back to top
View user's profile Send private message
Another Surfer



Joined: 08 Dec 2007
Posts: 293

PostPosted: Tue Jun 16, 2009 6:55 am    Post subject: Reply with quote

I receive this message, too, when accessing the International Picket Central message board: <removed link, sorry -- obviously didn't think that through!>

I have Windows Live OneCare (yeah, lame in some ways).

It might be due to links posted to this part of the site.

I have not visited it since receiving this message some weeks ago. Bummer, for sure, and I will endeavor to get some better internet condom (ha) so that I can get more info re what the problem is.

Here is what I see (big warning, red background),

Quote:
MALWARE DETECTED: Warning: Visiting this site may harm your computer!
The website at ocmb.xenu.net contains elements from the site gcounter.cn, which appears to host malware – software that can hurt your computer or otherwise operate without your consent. Just visiting a site that contains malware can infect your computer.
For detailed information about the problems with these elements, visit the Google Safe Browsing diagnostic page for gcounter.cn.
Learn more about how to protect yourself from harmful software online.
I understand that visiting this site may harm my computer
.

I can choose to continue, but I don't, due to this warning.

Another Surfer

I can't figure out how to insert the screen capture here. I am using the Google browser at the moment.


Last edited by Another Surfer on Thu Jun 18, 2009 5:31 am; edited 1 time in total
Back to top
View user's profile Send private message
Old Bomber



Joined: 15 Jun 2006
Posts: 58
Location: At the I.P., Inbound.

PostPosted: Tue Jun 16, 2009 11:08 am    Post subject: Reply with quote

I just checked the link you posted with my Mac running the same version with Norton anti virus and firefox, then with my pc running xp, firefox and Avir antivirus. Didn't get any warnings.
_________________
COFFEE...COFFEE...Must.. engage brain.. before keybord!!!
Back to top
View user's profile Send private message Send e-mail
Simonymous



Joined: 26 Feb 2008
Posts: 786

PostPosted: Tue Jun 16, 2009 12:58 pm    Post subject: Reply with quote

The good news is you're on a Mac. Even if there is a virus, you won't catch it! There's almost no Mac viruses, and the ones that do exist are little more than irritating joke programs or only affect really old operating systems.

That doesn't really answer the question, and it doesn't help anyone on a PC... but hopefully it allays a bit of worry.
_________________
Uwe Stuckenbrock was destroyed by Scientology. These harms must never be allowed to continue.
Back to top
View user's profile Send private message
Peter Schilte



Joined: 15 May 2006
Posts: 1746
Location: Vierlingsbeek (Netherlands)

PostPosted: Tue Jun 16, 2009 4:12 pm    Post subject: Reply with quote

Running ESET Smart Security on Windows XP-Pro-SP3 I get no warning whatsoever.
My guess is it is a false positive, generated by an overconcerned safety program.

Peter
_________________
"THE ONLY WAY YOU CAN CONTROL PEOPLE IS TO LIE TO THEM."
- L. Ron Hubbard

http://www.scamofscientology.nl
Back to top
View user's profile Send private message Send e-mail Visit poster's website
Gumbythetruth



Joined: 24 Jul 2007
Posts: 2120
Location: Look over your shoulder!

PostPosted: Tue Jun 16, 2009 4:30 pm    Post subject: Reply with quote

Also on a Mac. Nothing on my end appears as Malware. I have had warnings, when on Google. When i find something of interest and the link is located in some eastern european country. Most of those countries are former soviet bloc entities.

Ah! the wild wild east.
_________________
Master of subterfuge and disinformation!
Back to top
View user's profile Send private message
Sponge



Joined: 10 Apr 2006
Posts: 9580
Location: U.K.

PostPosted: Tue Jun 16, 2009 4:32 pm    Post subject: Reply with quote

Another Surfer wrote:
I receive this message, too, when accessing the International Picket Central message board:
Quote:
LINK REMOVED FROM THIS QUOTED POST


I have Windows Live OneCare (yeah, lame in some ways).

It might be due to links posted to this part of the site.

I have not visited it since receiving this message some weeks ago. Bummer, for sure, and I will endeavor to get some better internet condom (ha) so that I can get more info re what the problem is.

Here is what I see (big warning, red background),

Quote:
MALWARE DETECTED: Warning: Visiting this site may harm your computer!
The website at ocmb.xenu.net contains elements from the site gcounter.cn, which appears to host malware – software that can hurt your computer or otherwise operate without your consent. Just visiting a site that contains malware can infect your computer.
For detailed information about the problems with these elements, visit the Google Safe Browsing diagnostic page for gcounter.cn.
Learn more about how to protect yourself from harmful software online.
I understand that visiting this site may harm my computer
.

I can choose to continue, but I don't, due to this warning.

Another Surfer

I can't figure out how to insert the screen capture here. I am using the Google browser at the moment.


Do not sit on this.

I suggest all of you who have concerns, please PM/Email Andreas and Roan right now and tell of your findings so Andreas can investigate.

In the meantime DO NOT click on that link in the original of the above quoted post.

(A.S., can you edit it out of your post please as there is no point in introducing potential harm to the click-happy who may never have happened upon it otherwise. Thanks).

Index.htm contains JS/Obfuscated and attempts to download readme.pdf which is actually "Exploit.pdf".
The "gcounter.cn" is a site known to be full of malicious shit (google it and it warns you). The exploit starts a hidden IFrame and redirects to that without you being aware. Apparently is is javascript so if you don't have that then it won't run (or if you trap javascript launches in a good software firewall with program access control like zonealarm).
Apparently (not sure) it (or some of it) is injected into the PHP board code of the forum and may be persistent (by that I mean that the more obvious attempts to remove it from the site/forum code may not work perhaps due to a malicious/infected 3rd party phpBB plugin).

Not to cause undue panic or anything but, until admin can get onto it and see what is going on, all technoobs should GTFO off this site and scan your systems. Anyone else who thinks they know what they are doing, continue at your own risk.
_________________
http://forums.whyweprotest.net
www.whyaretheydead.info
Who is David Miscavige?


Last edited by Sponge on Tue Jun 16, 2009 6:30 pm; edited 3 times in total
Back to top
View user's profile Send private message
GreatSunJester



Joined: 23 Aug 2005
Posts: 224

PostPosted: Tue Jun 16, 2009 4:40 pm    Post subject: Reply with quote

Quick testing here. I get the same message. Google Chrome give me that message and prevents the site from loading. Nod32 sees nothing with internet Explorer 7.

Another machine with AVG detects java web exploits from cximnik.cn and xfcg.info
_________________
In Search of... a new sig!
Back to top
View user's profile Send private message
carol



Joined: 11 Dec 2005
Posts: 398

PostPosted: Tue Jun 16, 2009 5:20 pm    Post subject: Reply with quote

I received that message last week a couple of times. I have AVG protection on my non mac computer.
_________________
stillsearching
Back to top
View user's profile Send private message
secularpatriot



Joined: 04 Apr 2005
Posts: 296
Location: USA

PostPosted: Tue Jun 16, 2009 5:26 pm    Post subject: Reply with quote

Sponge wrote:


In the meantime DO NOT click on that link in the original of the above quoted post.


I took the link out of my post.

I'll email Andreas.
Back to top
View user's profile Send private message
SchwimmelPuckel



Joined: 10 Feb 2006
Posts: 2242
Location: Denmark

PostPosted: Tue Jun 16, 2009 8:20 pm    Post subject: Reply with quote

Seems to be a problem with GCounter (A traffic statistic system that is linked to on the page).. The following link is Google's warning about it.

http://google.com/safebrowsing/diagnostic?site=gcounter.cn/

<edit.. > Bleh.. Ididn't notice that Sponge mentioned this already.. /edit>

Hmm.. I did click the link before the warnings.. I trusted my AV software, Mc Afee.. No alerts from that. But the computer started downloading stuff while ignoring any input device.. I yanked the wallplug.

Cool
_________________
Ask not what Scientology can do for you, ask what the F*arck! is going on.
Back to top
View user's profile Send private message Send e-mail Visit poster's website
admin
Site Admin


Joined: 18 Nov 2000
Posts: 1605
Location: Stavanger, Norway

PostPosted: Wed Jun 17, 2009 7:49 am    Post subject: Reply with quote

gcounter[DOT]cn is not a Google site, actually it is a site that Google warn about as being malware. Most likely you have already been infected with malware on your computer if you get this warning. This is a malware trying to send you to their own site.

OCMB is not infected.

You can check this link that OCMB does not have malware:
http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http://ocmb.xenu.net/
_________________
Andreas @ www.xenu.net
- Life is not a test.
Back to top
View user's profile Send private message Send e-mail Visit poster's website
Sponge



Joined: 10 Apr 2006
Posts: 9580
Location: U.K.

PostPosted: Wed Jun 17, 2009 9:22 am    Post subject: Reply with quote

Andreas,
you have a page on this site (see my previous post and the quoted post within it) where "index.htm" is downloading "readme.pdf" which are identified by AVG antivirus as "JS/Obfuscated" and "Exploit.pdf" respectively. This much is real.

First of all just look at the above because several people have now confirmed that as happening.

I don't know if the gcounter.cn thing is related and i speculated that it might be a malware site where the above exploit is invisibly redirecting to (because other people reported that but all I see is what google safe browing report says). The main thing, as far as I can see, is what I said above.
_________________
http://forums.whyweprotest.net
www.whyaretheydead.info
Who is David Miscavige?
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic Page 1 of 2 [26 Posts] Goto page:  1, 2 Next
View previous topic :: View next topic
Forum index » General Topics » Opinions & Debate
Jump to:  

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


Powered by phpBB © 2001, 2005 phpBB Group
[ Time: 0.4180s ][ Queries: 9 (0.0227s) ][ Debug on ]