Troubles with the News Archive?

Important announcements and related feedback. If you want something added, altered, or removed from GB, post about it here.
User avatar
Gartar
Posts: 68
Joined: Wed Mar 10, 2010 6:27 pm
Location: The Forsaken Islands
Contact:
Troubles with the News Archive?

Postby Gartar » Thu Dec 02, 2010 6:32 pm

Virus on the front page?

Greetings(don't know if this is the right place to post this), when I try to click on a news story on the front page it gives me a ''reported attack page!'' warning it says
Reported Attack Page!

This web page at webarh.com has been reported as an attack page and has been blocked based on your security preferences.

Attack pages try to install programs that steal private information, use your computer to attack others, or damage your system.

Some attack pages intentionally distribute harmful software, but many are compromised without the knowledge or permission of their owners.
and avast also gives me a warning about that webarh place.

Just wondering if it is safe to read the news post or if i should wait until this gets sorted out?
"I much prefer the sharpest criticism of a single intelligent man to the thoughtless approval of the masses.''-Johannes Kepler.

User avatar
Crenshinibon
Posts: 2665
Joined: Wed Mar 22, 2006 5:35 pm
Contact:

Postby Crenshinibon » Thu Dec 02, 2010 6:35 pm

Is anyone having trouble viewing individual bits in the News Archive? Whenever I try to open up ANY piece of news, I get taken to a "Reported Attack Page" message, however, out of caution, I have not ignored this warning.

Can anyone confirm this?
[font="Times New Roman"]“The world breaks every one and afterward many are strong at the broken places. But those that will not break it kills. It kills the very good and the very gentle and the very brave impartially.”[/font]

User avatar
Bluestorm
Posts: 307
Joined: Thu Mar 29, 2001 11:00 pm
Location: Kitchener, Ontario, Canada
Contact:

Postby Bluestorm » Thu Dec 02, 2010 6:54 pm

just to let you know i'm getting it too
It's not what you are---it's who you are

User avatar
Crenshinibon
Posts: 2665
Joined: Wed Mar 22, 2006 5:35 pm
Contact:

Postby Crenshinibon » Thu Dec 02, 2010 6:59 pm

Alright, thanks for the confirmation.

I wonder if something is really wrong or if someone just reported the section.
[font="Times New Roman"]“The world breaks every one and afterward many are strong at the broken places. But those that will not break it kills. It kills the very good and the very gentle and the very brave impartially.”[/font]

User avatar
BuckGB
Posts: 1576
Joined: Mon Oct 09, 2000 10:00 pm
Contact:

Postby BuckGB » Thu Dec 02, 2010 7:09 pm

Yep, something is very, very wrong. It appears that we're one of the lucky websites to have been infected with some sort of "webarh" redirect hack (more on it here). I'm working with our hosting provider to see what can be done to remove the infection, but it's possible that a full reinstallation of the operating system and all of our scripts could be necessary. For now, I recommend sticking to the forums as it seems to only be affecting the main content areas of the website.

As soon as it's cleared up, I'll let everyone know.

User avatar
Gartar
Posts: 68
Joined: Wed Mar 10, 2010 6:27 pm
Location: The Forsaken Islands
Contact:

Postby Gartar » Thu Dec 02, 2010 7:19 pm

Ok, thanks for the update, hope everything will get cleared up smoothly.
"I much prefer the sharpest criticism of a single intelligent man to the thoughtless approval of the masses.''-Johannes Kepler.

User avatar
Crenshinibon
Posts: 2665
Joined: Wed Mar 22, 2006 5:35 pm
Contact:

Postby Crenshinibon » Thu Dec 02, 2010 7:36 pm

Thanks for the confirmation Buck. I hope you're able to sort this out without too much trouble.

Reinstalling the OS should have too much impact on the overall setup, since I assume that you have everything backed up, right? It would probably just be a time-consuming process due to the length of the installation and the reconfiguring of the OS.

Thanks again Buck.
[font="Times New Roman"]“The world breaks every one and afterward many are strong at the broken places. But those that will not break it kills. It kills the very good and the very gentle and the very brave impartially.”[/font]

User avatar
BuckGB
Posts: 1576
Joined: Mon Oct 09, 2000 10:00 pm
Contact:

Postby BuckGB » Fri Dec 03, 2010 1:43 am

I've just posted a response here, for any of you curious about what exactly took place tonight.

Crenshinibon wrote:Reinstalling the OS should have too much impact on the overall setup, since I assume that you have everything backed up, right?


I have all of our content backed up, but recovering from a full operating system reinstallation would still be very time-consuming. Luckily, it wasn't required in this instance, but the thought of having to go through all of that was enough to make me nauseous anyway. I may even end up going with our hosting provider's on-site backup service from here on out, but it's quite expensive (as much as $200/month, depending on which options you select). That's a decision to be made after I get some sleep, though...

User avatar
galraen
Posts: 3727
Joined: Sat Nov 25, 2006 3:03 am
Location: Kernow (Cornwall), UK
Contact:

Postby galraen » Fri Dec 03, 2010 5:36 am

I had the same problem just now when using the forums, but the actua villain seems to be Firwfox, although I can't log in with Chrome still to check, when I open GB on chrome I don't have the 'Attack' message.

Disabling 'Block reported attack sites' in Tools\options has allowed me to get here.

I said it was McAfee on FB, I was wrong, it is just Firefox. When I ran a test through McAfee it gave GB a clean bill of health, as did Google.

I'm still having problems with that log in error I mentioned a few weeks ago though Buck, even on computers in another part of the country!
[QUOTE=Darth Gavinius;1096098]Distrbution of games, is becoming a little like Democracy (all about money and control) - in the end choice is an illusion and you have to choose your lesser evil.

And everything is hidden in the fine print.[/QUOTE]

User avatar
BuckGB
Posts: 1576
Joined: Mon Oct 09, 2000 10:00 pm
Contact:

Postby BuckGB » Fri Dec 03, 2010 8:32 am

Firefox checks Google's list of "attack websites" every time you visit a site, and unfortunately GameBanshee was added to that list as of about 5:30pm CST yesterday when the redirects starting taking effect. Other browsers that I've checked load the site just fine.

After dealing with this nightmare all last night, I've submitted a request this morning for a review by Google in order to get off the list. Hopefully this happens sooner rather than later, as I'm sure it's driving a lot of visitors away.

As for the login issue, I have yet to figure out the cause. I've never received similar feedback from any other users, though, so I'm not sure how widespread the problem is. I'm going to be starting a semi-large project on the site soon, and I'll do my best to get a closer look at it then.

User avatar
galraen
Posts: 3727
Joined: Sat Nov 25, 2006 3:03 am
Location: Kernow (Cornwall), UK
Contact:

Postby galraen » Fri Dec 03, 2010 8:44 am

The strange thing was, that when I clicked on the 'What does this mean' (or whatever it said) I was told that Google had found no problems with the site, and that was this morning at about 11.30am GMT.
[QUOTE=Darth Gavinius;1096098]Distrbution of games, is becoming a little like Democracy (all about money and control) - in the end choice is an illusion and you have to choose your lesser evil.

And everything is hidden in the fine print.[/QUOTE]

User avatar
Stworca
Posts: 1223
Joined: Tue Aug 11, 2009 8:20 am
Location: D, NL & PL
Contact:

Postby Stworca » Fri Dec 03, 2010 11:23 am

Someone finaly did it, and made me use internet explorer again.. Even if only for a short while ;)
[url="http://www.gamebanshee.com/forums/baldurs-gate-ii-shadows-of-amn-9/guide-to-tactical-mods-spoilers-116063.html#post1068546"]BG2 tactical mods guide[/url]
What? You're still here? Go write a review![url="http://www.gamebanshee.com/forums/rpg-user-reviews-118/"]Here[/url]
Insane Ironman BG2 let's play! [url="http://www.bay12forums.com/smf/index.php?topic=81201.msg2140894#msg2140894"]Here[/url]

User avatar
BuckGB
Posts: 1576
Joined: Mon Oct 09, 2000 10:00 pm
Contact:

Postby BuckGB » Fri Dec 03, 2010 2:46 pm

Google managed to flag us as "unsafe" a few minutes after being hacked, but now that the website is cleaned up, it's taking them hours to declare us "safe" again. 8 hours after submitting my request to be re-reviewed, I still see:

"A review for this site is still being processed. Please check back later."

Thanks, Google.

User avatar
Stworca
Posts: 1223
Joined: Tue Aug 11, 2009 8:20 am
Location: D, NL & PL
Contact:

Postby Stworca » Fri Dec 03, 2010 3:25 pm

So you have no evil plan to take over the world using Gamebanshee site?
Shame on you!
[url="http://www.gamebanshee.com/forums/baldurs-gate-ii-shadows-of-amn-9/guide-to-tactical-mods-spoilers-116063.html#post1068546"]BG2 tactical mods guide[/url]
What? You're still here? Go write a review![url="http://www.gamebanshee.com/forums/rpg-user-reviews-118/"]Here[/url]
Insane Ironman BG2 let's play! [url="http://www.bay12forums.com/smf/index.php?topic=81201.msg2140894#msg2140894"]Here[/url]

User avatar
jklinders
Posts: 339
Joined: Thu Aug 07, 2008 6:17 pm
Location: Halifax NS Canada
Contact:

Postby jklinders » Fri Dec 03, 2010 3:36 pm

I'm getting the same issue. I had to disable my browser's security just to report this. Using Firefox. I'll be staying clear for a bit to give you guys time to find the problem.

Hope you guys suss it out soon. I really don't want to stay away but I know better than to ignore my browser's warnings. I hope you guys were not hacked.

User avatar
Brother None
Posts: 1075
Joined: Thu Jun 21, 2007 1:45 pm
Location: Liberty City, the Netherlands
Contact:

Postby Brother None » Fri Dec 03, 2010 4:51 pm

The hack is gone but the warning is still there, and will be until Google gets around to removing it. Details [url="http://www.gamebanshee.com/news/100625-a-magical-evening-of-file-searching.html"]here[/url].
GameBanshee, your resource for all things RPG
No Mutants Allowed, your Fallout resource
"Those who say they give the public what it wants begin by underestimating public taste and end by debauching it" T.S. Eliot

User avatar
BuckGB
Posts: 1576
Joined: Mon Oct 09, 2000 10:00 pm
Contact:

Postby BuckGB » Fri Dec 03, 2010 4:56 pm

Stworca wrote:So you have no evil plan to take over the world using Gamebanshee site?


Ruling the world? My plans are much more lofty! :D

Anyway, Google has now set the status to:

"A review for this site has finished. The site was found clean. The badware warnings from web search are being removed. Please note that it can take some time for this change to propagate."

I guess it takes a few minutes to add the warnings, but a long time to remove them. Awesome.

User avatar
Crenshinibon
Posts: 2665
Joined: Wed Mar 22, 2006 5:35 pm
Contact:

Postby Crenshinibon » Fri Dec 03, 2010 6:41 pm

Thanks for all the hard work in getting everything up and running. My day at work just wasn't the same without regularly checking the forums and the news. I was sad.

Can you update us when you find out where the breach occurred and how exactly these hellions were able to get these files onto GB? I assume that these files were just redirect scripts, is that correct?
[font="Times New Roman"]“The world breaks every one and afterward many are strong at the broken places. But those that will not break it kills. It kills the very good and the very gentle and the very brave impartially.”[/font]

User avatar
childofbhaal
Posts: 76
Joined: Wed Nov 03, 2010 7:41 am
Location: EU
Contact:

Postby childofbhaal » Fri Dec 03, 2010 9:21 pm

Looks like its back,I get this message again:


Gartar wrote:Reported Attack Page!

This web page at webarh.com has been reported as an attack page and has been blocked based on your security preferences.

Attack pages try to install programs that steal private information, use your computer to attack others, or damage your system.

Some attack pages intentionally distribute harmful software, but many are compromised without the knowledge or permission of their owners.


Usually such things happen because of the ads,be careful with them(I have bad experience with ads on a few other sites).

I am not afraid of this tbh(using firefox with adblock and noscript addons) and after the yesterdays problem I made a full scan with avast,spybot search and destroy,mailwarebytes antimailware,SUPERAntiSPyware,Ad-Aware,windows mailcious program removing tool,Sophos Anti Rootkit GUI,Hijack this and found nothing(cleared my registry with CCcleaner too).I recommend getting these btw(they are all free) if you want a safe and secure system.

User avatar
Charnel
Posts: 29
Joined: Wed Dec 26, 2007 7:48 am
Location: KotOR purgatory, U.S.A.
Contact:

Postby Charnel » Fri Dec 03, 2010 9:48 pm

I'm getting these "attack page" reports as well. Reported it this morning but it looks like webarh.com has hijacked some pages. Brother None's link takes me to a webarh.com URL and not a gamebanshee.com URL. Good thing I use NoScript.