Haunt Forum Reported Attack Site

[figstimpy]

Anyone else getting this, it just started this morning, anytime I try to go anywhere on Hauntforum I get reported attack site and have to click ignore warning.

Just wondering if something has been loaded to site or if its something with my computer

[Otaku]

I got the same warning when I first clicked on the site today. I clicked "Enter the Site" and haven't had a repeat, but I haven't rebooted yet. I use Norton Internet Suite 2010.

[figstimpy]

i am using avast and anytime i try to move to a new page or submit a post i get it, so if you had it start this morning also then maybe there has been an attack on the site?

[corner haunt]

Yep me too with McAfee!

[HouseBloodthorn]

I'm also getting this. I believe it's a Mozilla/Firefox thing and not specific to any particular AV program. I'm using AVG and it's not the one blocking it.

[HouseBloodthorn]

FYI... Doesn't seem to happen when using IE7.

[figstimpy]

k IE seems fine, so is it a firefox update that just came down the line, or is IE just not picking something up..... oh well need my halloween fix anyways virus or not, worry about it in November lol

[halstaff]

I'm using Firefox and I'm getting it as well.

[Joiseygal]

Make sure you have a virus protector because I just got a high alert notification that a virus was blocked. I also got the same warning coming into the Hauntforum and hit ignore. It seems strange!?!?!

[Otaku]

FYI... Doesn't seem to happen when using IE7.

I'm using IE7 and got the warning, but only on the first time I entered the site. Ran scans with NIS and Hitman Pro - no issues.

[SuperCreep31]

I am using Google Chrome and i am getting Virus Alert Warnings from Symantec Endpoint Protection and when I hit ignore and go on the site Windows Media Player opens and trys to play something but Symatec Endpoint Protection blocks it...I think HauntForum is under attack.

[berzerkmonkey]

Using Firefox and also got the warning. I also had some sort of media file try to open, and then Firefox crashed. Has anyone notified ZombieF?
EDIT: Happening in Chrome too.

[sickNtwisted]

I have a Mac and didn't receive any warning.

[SuperCreep31]

Using Firefox and also got the warning. I also had some sort of media file try to open, and then Firefox crashed. Has anyone notified ZombieF?

that's exactly what happened to me

[berzerkmonkey]

I have a Mac and didn't receive any warning.
That's because most attacks are targeted at Windows PCs. Linux doesn't have a problem either (just checked through my media server.)

[Severin]

Getting this also.

This is not a browser issue. This warning is being issued by Google. Apparently there is an attack site that MAY be gaining access through Hauntforum. Could be from someone using a bogus image hosting site or something. Could also just be another account on the server that has the problem.

The reason you're not getting this in IE is probably because the safe surf plugin isn't available in IE.

[SuperCreep31]

now the malware notice pops up twice before i can get in...does that mean there are two malicious items?

[RoxyBlue]

I just logged on through our home computer and got no warnings at all. We have IE 8 on this computer.

There is this message from ZombieF on HauntForum's Facebook site:

"HauntForum.com WARNING! HauntForum has recently been hacked and now contains malicous code that may harm your computer! Please heed any warnings your PC gives you when accessing HauntForum.com until further notice."

He posted the note a few hours ago.

[Severin]

I just logged on through our home computer and got no warnings at all. We have IE 8 on this computer.

Only people with the Google Safe Browsing extension will be getting this warning. IE+ doesn't have the extension.

You can disable it in Firefox by Going to Tools--->Options--->Security---> and unticking "Block Reported Attack Sites" But this turns off your protection completely, so its NOT recommended.

[jaege]

When I tried to log onto the sight I got a malware warning. I think a moderator should check and see whats whats.

[SuperCreep31]

there is already a thread about this. For more information about the attack go here: http://hauntforum.com/showthread.php?t=24683

[Frighteners Entertainment]

I called Z, he's aware of this...1st time I was able to post today...WEIRD!

[dflowers]

I just got it also. It is a Java Script and is downloading malware to your computer in order to get you to purchase a anitivirus software that will remove the infected files. I have seen this at other sites recently. I am on IE7.

[smoke624]

same here, seems to just be with firefox browser

[Frighteners Entertainment]

I get the same with google chrome. haven't tried safari yet.

[MonkeyBasic]

Oh good, it's not just me. I wonder if it has anything to do with the new toolbar at the bottom of the page?

Here's what Google says: http://www.google.com/safebrowsing/diagnostic?site=http://hauntforum.com/&hl=en

[Mr_Chicken]

I'm getting the warning through Chrome on a Mac.

[Tinman]

Now this is scary, a week before Halloween.

Google diagnostic page:
Safe Browsing

Diagnostic page for hauntforum.com


What is the current listing status for hauntforum.com?
Site is listed as suspicious - visiting this web site may harm your computer.
Part of this site was listed for suspicious activity 1 time(s) over the past 90 days.
What happened when Google visited this site?
Of the 22 pages we tested on the site over the past 90 days, 11 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-10-23, and the last time suspicious content was found on this site was on 2010-10-23.Malicious software is hosted on 2 domain(s), including requestbusforward.co.cc/ (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=requestbusforward.co.cc/), personallybuild.co.cc/ (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=personallybuild.co.cc/).
1 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including clickme43.ipq.co/ (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=clickme43.ipq.co/).
This site was hosted on 1 network(s) including AS33322 (NDCHOST) (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=AS:33322).
Has this site acted as an intermediary resulting in further distribution of malware?
Over the past 90 days, hauntforum.com appeared to function as an intermediary for the infection of 1 site(s) including hauntproject.com/ (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=hauntproject.com/).
Has this site hosted malware?
No, this site has not hosted malicious software over the past 90 days.
How did this happen?
In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

Next steps:

Return to the previous page. (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=http://www.hauntforum.com/index.php#)
If you are the owner of this web site, you can request a review of your site using Google Webmaster Tools (http://www.google.com/webmasters/tools/). More information about the review process is available in Google's Webmaster Help Center (http://www.google.com/support/webmasters/bin/answer.py?answer=45432).
Norton Message:
http://i135.photobucket.com/albums/q147/leahs_dad/temp/security.jpg

[GPSaxophone]

I couldn't even login with firefox. It kept giving me the security warning. I got on with IE and noticed the toolbar at the bottom right away. Get rid of it!

[SuperCreep31]

I couldn't even login with firefox. It kept giving me the security warning. I got on with IE and noticed the toolbar at the bottom right away. Get rid of it!

the wibiya toolbar?

[debbie5]

Hmmm...I think my puter got eaten. Shit.

[Otaku]

Has anyone gotten any malware installed on their machines from this event? Norton Internet Suite 2010 caught this bug and blocked it on mine. I checked for Wibiya problems and found a few issues (borderline malware).
I had a lot of success using MalwareBytes and Hitman Pro 3.5 in getting the AntiVirus 2010 malware off my kids' machine - a previous post mentioned this as the malware. Both are free programs, but HM Pro has a 30 day limit. If you try using MB and the bug won't let it start, install it from a thumb drive. You may need to download it from another machine; some malware recognize the MB program and won't allow an internet connection to the download site. SuperAntiSpyware is also a good resource, and is free.
A good site for getting in-depth advice is www.bleepingcomputer.com. It's a forum (registration free) and the mods know their stuff.
As far as that Wibiya toolbar goes, it may have installed itself as a plug-in. Check your list of plug-ins running under IE. If it's there, disable it, then delete the program.

[hedg12]

I agree with Otaku - Malwarebytes does a great job of taking care of this kind of problem. If you have to install it from a thumbdrive / different computer, you'll need to update the definitions manually, too. There's an explanation of how to do that here (http://techdows.com/2010/09/manually-downloading-malwarebytes-anti-malware-definitions-to-update-malwarebytes-offline.html).

BTW, it appears that GOE's been infected too, so if you frequent that site, look out.

[MonkeyBasic]

A week before Halloween... hmmm... Conspiracy?

[jaege]

Yep I have AVG and Malwarebytes, and I am getting this message too.

[SuperCreep31]

hauntforum just crashed my whole computer...I can't turn it on without getting a blue screen...gotta take it to the shop and I recommend you guys stay off the site for a couple days as well

[DarkLore]

Great...three days after my virus program expired. Sorry to hear that SuperCreep31, thanks for the warning.

[Zombie-F]

Problem solved. Some malicious code was inserted to our ad server and has now been removed. You will still likely get a warning message if you're using FireFox or Chrome. You may choose to ignore this warning until Google has had the chance to remove us from their malware list.

If you have visited the site at all between Friday evening and now, please run a virus and/or malware scan on your computer (which you should routinely do anyhow).