Avira Alert For Amiga.org

[Managarm]

Hi All,

On my Windows XP machine my AV, Avira Anti-Virus 10.0.0.567 has just started complaining when I visit this site. Is this a false positive? (I'm assuming it is.) The infected file details are very vague and I can't find a proper description online of the type of infection.

Any ideas anyone? I've attached a couple of sreenshots.

Thanks,
Robin.

[x56h34]

Same here with Avira and Win 7.

[matt020]

I also receved this warning from Avira.

[som99]

Just chill, it's nothing to be worried about

[Plaz]

My site scanner isn't complaining. (not running Win7 though)

Plaz

[AmigaHeretic]

Just chill, it's nothing to be worried about

I'm not so sure.  Amiga.org had been infected with the "brutal dildo" thing for an unknown period of time.  They just fixed that a day or two ago.

Maybe this is related?

[AmigaHeretic]

I'm not so sure.  Amiga.org had been infected with the "brutal dildo" thing for an unknown period of time.  They just fixed that a day or two ago.

Maybe this is related?

Quick look through the source code and no "brutal dildo" stuff.

This however is the first line of the html code:

http://stolenvessels.com/images/7rt8/index.php

??

[Drummerboy]

Hi All,

On my Windows XP machine my AV, Avira Anti-Virus 10.0.0.567 has just started complaining when I visit this site. Is this a false positive? (I'm assuming it is.) The infected file details are very vague and I can't find a proper description online of the type of infection.

Any ideas anyone? I've attached a couple of sreenshots.

Thanks,
Robin.

If you Browse with Amiga.. No Virus Problem!!.. :afro:

[issarad]

Yeah, got it on my Win7 and avira combo, too.  I'm guessing it's more than likely just a false positive.

[halvliter'n]

Quick look through the source code and no "brutal dildo" stuff.

Haha.. There was something about Iphone mobile porn and ex girlfriends too.

Has no virus warning here then.

[ChaosLord]

Hi All,

On my Windows XP machine my AV, Avira Anti-Virus 10.0.0.567 has just started complaining when I visit this site. Is this a false positive? (I'm assuming it is.) The infected file details are very vague and I can't find a proper description online of the type of infection.

Any ideas anyone? I've attached a couple of sreenshots.

Thanks,
Robin.

 I am getting the same warning!  This is scary!  @Karlos Please fix.

[Mark]

Yes, there is an unpatched vBulletin exploit that has hit a number of forums so far.  There is a thread about it at Moo Bunny:
http://moobunny.dreamhosters.com/cgi/mbmessage.pl/amiga/174104.shtml

If anyone can reach Pyromania or the other mods quickly then please do so. I don't see any of them online at the moment.

[mpiva]

I just got same warning. Running AVIRA on WinXP.

[Piru]

http://www.amiga.org/forums/project.php?issueid=65#note255

[Karlos]

Until this problem is fixed, feel free to use the old browser proxy:

http://aoproxy.extropia.co.uk

I've added a snippet of code to eliminate the iframe from the page and removed the automatic redirect to the main site for modern browsers. You can see the effect in the page source:

Code: [Select]


<!-- http://amiga.org/forums/search.php?do=getdaily : retrieved in 0.593s -->
<!--
HeadIFrameEliminator:Bytes in: 17244, out: 17174, took 0.000 s
DegradeXHTMLRewriter:Bytes in: 17174, out: 17105, took 0.001 s
LinkRewriter:Bytes in: 17105, out: 17245, took 0.005 s
MainNavigationRewriter:Bytes in: 17245, out: 17245, took 0.000 s
CommonBlockRewriter:Bytes in: 17245, out: 17300, took 0.000 s
CSSRewriter:Bytes in: 17300, out: 4300, took 0.001 s
JavascriptRewriter:Bytes in: 4300, out: 3989, took 0.000 s
 -->


Unfortunately the iframe output breaks the page with respect to header based redirects, so you'll still see the "redirect" page when you click on "new posts" and the like, but I have confirmed the iframe is not present in any content that is passed through the proxy code.