Ship of Fools: Malware Message when attempting to post

Thread: Malware Message when attempting to post Board: Oblivion / Ship of Fools.

To visit this thread, use this URL:
http://forum.ship-of-fools.com/cgi-bin/ultimatebb.cgi?ubb=get_topic;f=70;t=024273

Posted by lilBuddha (# 14333) on :

I received the following message when attempting to post in Heaven.

quote:
forum.ship-of-fools.com contains content from alancresswell.pwp.blueyonder.co.uk, a site known to distribute malware. Your computer might catch a virus if you visit this site.
Google has found malicious software may be installed onto your computer if you proceed. If you've visited this site in the past or you trust this site, it's possible that it has just recently been compromised by a hacker. You should not proceed, and perhaps try again tomorrow or go somewhere else.
We have already notified alancresswell.pwp.blueyonder.co.uk that we found malware on the site. For more about the problems found on alancresswell.pwp.blueyonder.co.uk, visit the Google Safe Browsing diagnostic page.

Posted by Lothlorien (# 4927) on :

I've seen a similar but not identical message on the blog of a pastor down here.

However, I've posted several times today. The latest was in heaven about a minute ago, and no message at all.

Posted by Japes (# 5358) on :

It's just popped up for me on the "Well that's that then" thread in All Saints.

Posted by birdie (# 2173) on :

I just got the same message. I was on the 'today's active threads' page and tried to click on an All Saints thread. (Which I'm pretty sure does have a post from Alan on it.)

ETA: Same thread as Japes - couldn't remember what it was called!

[ 29. October 2012, 06:27: Message edited by: birdie ]

Posted by Kelly Alves (# 2522) on :

Same here.

Posted by Kelly Alves (# 2522) on :

Sorry should add that I PM'ed Alan and will try to alert anyone else around.

Posted by Alan Cresswell (# 31) on :

Hmmm, very strange.

A quick look at the content of my webspace and there's only one file new file there - something called google-verify.php. Since I didn't put it there, I deleted it.

I also don't know what part of my webspace is in any sense on the Ship - there's a link to my website on my profile, but that's it as far as I know.

Posted by Alan Cresswell (# 31) on :

Further probing found my index.htm file also had a recent modification date and was some 4 times the size it should be. So, I replaced it with the copy from my hard drive.

Also, my avatar is from a file on my webspace - which is why the message appears here. My hypothesis is that you'll get the message opening any page which contains my avatar, but no message on pages which don't.

I'm going to assume that even if I've cleared the malware from my webspace, it'll take time before it's given the all-clear. So, for now to save you all getting that message I'm going to switch to a generic avatar (one that's seasonal for halloween!).

[ 29. October 2012, 07:50: Message edited by: Alan Cresswell ]

Posted by Kelly Alves (# 2522) on :

[Killing me]

You are a paragon of class, Alan.

I'm in the middle of cleaning my hard drive just in case, but thanks for the explanation. Hope your end of things works out well.

Posted by Curiosity killed ... (# 11770) on :

I'm still getting that screen (Linux and Chromium) on longer older threads if I try to post. It looks as if it's going to take a time to clear off.

Posted by PeteC (# 10422) on :

I switched browsers and it cleared in the meantime. All is well here now (Firefox, Explorer, Chrome)

Posted by Alan Cresswell (# 31) on :

quote:
Originally posted by Curiosity killed ...:
I'm still getting that screen (Linux and Chromium) on longer older threads if I try to post. It looks as if it's going to take a time to clear off.

It takes time for the Ship software to change avatars on all pages. It will do it once someone posts on a thread, but if it hasn't been posted on since the change it tends to take a while - though I've never bothered to find out how long.

Posted by St. Stephen the Stoned (# 9841) on :

Linux + Chromium here too, and just had the same message while trying to post to the UBB Practice thread in Styx.

Posted by Curiosity killed ... (# 11770) on :

Problem is, Alan, we're not going to post when we get that message. I'm not bothering to work out how to get past it. So it's going to take the Ship updating for things to move on.

Posted by St. Stephen the Stoned (# 9841) on :

...but succesful with Firefox. However, during the time it took to exit Chromium , switch to Firefox, post to the Practice thread, be told to sign in, sign in, post, preview, and post again, the problem may well have gone away.

So this post is probably useless.

Sorry.

(eta: and I got hit by Flood Control too, which added ~120 seconds to the process.)

[ 29. October 2012, 09:56: Message edited by: St. Stephen the Stoned ]

Posted by Marvin the Martian (# 4360) on :

quote:
Originally posted by Curiosity killed ...:
I'm not bothering to work out how to get past it.

You click on the "proceed anyway" link just below the big green button that says "Go Back".

Posted by Chorister (# 473) on :

I blame the Cuban Missile Crisis - there's been a lot about it in the news recently, being as how it's the Anniversary. A pumpkin sounds much safer....

Posted by Alan Cresswell (# 31) on :

I found the Control Panel option that seems to have updated everything. Hopefully, that should get rid of the malware message relating to my webspace.

Posted by Quizmaster (# 1435) on :

I just got the same message trying to access Ship-pedia.

I chose GO BACK rather than PROCEED.

Good luck tracking the cause of the problem.

Posted by Alan Cresswell (# 31) on :

Which is interesting, because I have never posted on the Ship-pedia thread (at least not the current version - I have done so in the past). So, what link to my webspace could possibly be embedded in that thread?

Posted by Curiosity killed ... (# 11770) on :

I got the malware notice when I posted on the Shipedia thread this morning, but not until I tried to post. The other thread that was giving me the Malware notice yesterday - All Saints, So that's it then - didn't this morning, but I haven't tried posting on it.

Posted by Alan Cresswell (# 31) on :

quote:
Originally posted by Quizmaster:
I just got the same message trying to access Ship-pedia.

I chose GO BACK rather than PROCEED.

Good luck tracking the cause of the problem.

OK, I've tracked that particular problem and have taken steps that should eventually remove it. I'm going to check a few things now I know what's causing the problem and make sure that, as far as possible, I've got everything sorted before taking the Ship down for another maintenance (I didn't want to have to do it a second time, avoiding a third time would be good).

UBB.classic^TM 6.5.0