Virus Warning Accessing This Forum

First class · 9 Feb 2012

Warning: Invalid argument supplied for foreach() in [path]/forumdisplay.php(978) : eval()'d code on line 3

Lines and lines of the above!

RailUK Forums

Xenophon PCDGS · 9 Feb 2012

Schnellzug said:
it's just done it now, It said
"Norton has blocked: Web Attack: Exploit Website 9", I think it was.

The other one beside this that my Norton 360 found was something to do with "Website 14", but I cannot find my note with the full wording of both of these.

EDIT : The full title was Blackhole Toolkit Website 14 (Just found my note)

Statto · 9 Feb 2012

I've just has this trying to get on the site.

Reported Attack Page!

This web page at www.railforums.co.uk has been reported as an attack page and has been blocked based on your security preferences.

Attack pages try to install programs that steal private information, use your computer to attack others, or damage your system.

Some attack pages intentionally distribute harmful software, but many are compromised without the knowledge or permission of their owners.

First class · 9 Feb 2012

Anyone else get the naughty Russian adverts?

Makes a change to Thomas Cook holidays!

Moog_1984 · 9 Feb 2012

still happening, Avast picks up a Trojan Horse threat from some game ad link.

Need to get a better cross-domain policy with your ad' seller....

First class · 9 Feb 2012

Can the forum mods reassure us our details are secure like email addresses etc?

sn1975 · 9 Feb 2012

Haven't been on the forum for a couple of days and usually access via a bookmark. Just received the "reported attack page" message. Running XP SP3, ESET Smart Security 4 and Firefox 10.

When I clicked my bookmark was asked to download a PDF document, which I declined.

Steve.

causton · 9 Feb 2012

LM__ said:
Can the forum mods reassure us our details are secure like email addresses etc?

The details should be fine as these are kept in an encrypted database which hasn't been compromised by the look of things.

It's just that inside the website are adverts, and inside the adverts is some nasty code. Which isn't good, and needs to be fixed, as I can't go more than a couple of pages each time without seeing the pic in the attachment below...

ralphchadkirk · 9 Feb 2012

Only passwords are MD5 encrypted.

Sent from my iPhone 4 using Tapatalk

Mike395 · 9 Feb 2012

ralphchadkirk said:
Only passwords are MD5 encrypted.

Indeed, but it does not appear that the SQL database has been compromised, and that is where all user data is stored

SS4 · 9 Feb 2012

LM__ said:
Anyone else get the naughty Russian adverts? Makes a change to Thomas Cook holidays!

Ivo probably got solar panels :lol:

I got it when I logged onto the forums on firefox 10.

Crossover · 9 Feb 2012

I'm on FF10 and got the attack page too. The non www. version of the site works without the attack page though. I ran a virus scan on my PC with ESET earlier and it didn't come up with anything

Sun! · 9 Feb 2012

Firefox is blocking access to the site as is Google Chrome. Avast is also giving a warning. :/

lyesbkz · 9 Feb 2012

Safari is blocking too. See here (if it hasn't already been posted, sorry, difficult to navigate with this stupid thing every page!)

First class · 9 Feb 2012

AVG IS Business advised me to contact:

[Mod Note - Private Details Removed]

???? 123 reg looks quite legit to be honest....

Xenophon PCDGS · 9 Feb 2012

I have gone back to Internet Explorer 9 (never thought that I would ever say that again) and there is no problem at all in accessing the site. Google Chrome was causing too much hassle at present.

Madge Wildfire · 9 Feb 2012

I am on an Apple Mac, and while I get the warning page I just click proceed to the site anyway - taking the chance that any malware is unlikely to be a file that a Mac could process, plus my OS always asks before any file can be downloaded.

I have not had any attempt to auto-download files to my machine, so I am hoping that the problem is not too serious.

I use Chrome, but it might be different on a Mac. I found Firefox to be problematic on my MacBook.

causton · 9 Feb 2012

Madge Wildfire said:
I am on an Apple Mac, and while I get the warning page I just click proceed to the site anyway - taking the chance that any malware is unlikely to be a file that a Mac could process, plus my OS always asks before any file can be downloaded.

I have not had any attempt to auto-download files to my machine, so I am hoping that the problem is not too serious.

I use Chrome, but it might be different on a Mac. I found Firefox to be problematic on my MacBook.

Same, except I went into Preferences, then Under the Hood, then unticked enable phishing and malware protection... has 'fixed it' (left me open to other vulnerable websites oh dear

) so far!

Crossover · 9 Feb 2012

LM__ said:
AVG IS Business advised me to contact:

[Mod Note - Private Details Removed]

???? 123 reg looks quite legit to be honest....

123 reg is a domain registration company...they are legit, have bought domains from them before

Schnellzug · 9 Feb 2012

Paul Sidorczuk said:
I have gone back to Internet Explorer 9 (never thought that I would ever say that again) and there is no problem at all in accessing the site. Google Chrome was causing too much hassle at present.

I usually use InternetExplorer Whichever version this is, and apart from those little messages I mentioned I've had no problems accessing either. Maybe i might try it with something else just to see what it does.
--- old post above --- --- new post below ---
* No, i tried it with Chrome, although i didn't log in, but there didn't seema ny Difficulties.

anthony263 · 9 Feb 2012

I just had virius warning now after I typed in the website adress for this forum and click enter just before this page loaded

Heinz57 · 9 Feb 2012

I'm getting it too. I got the AVG popup yesterday.

And today Firefox doesn't want me to come on at all, brings up a security warning page.

ModChod · 9 Feb 2012

Is it just the adverts that are causing this? You could try the 'Mobile SKin' which is ad free and selected by a drop down box towards the bottom of the page.

This should allow you to browse the site without warnings/chance of getting infected.

lyesbkz · 9 Feb 2012

ModChod said:
Is it just the adverts that are causing this? You could try the 'Mobile SKin' which is ad free and selected by a drop down box towards the bottom of the page.

This should allow you to browse the site without warnings/chance of getting infected.

Now that the domain is blacklisted by Google, browsers which obtain their safety data from this source will display the warning anyway. Also I'm now stuck in the Mobile theme. I'm sure there was a thread with a link to get back somewhere, time to search for it......

Schnellzug · 9 Feb 2012

i'VE JUST NOTIced (caps lock) that the Ads seem to have been suspended.

dvboy · 9 Feb 2012

Google Chrome keeps warning me of Malwhere every time I load the site or click a link anywhere on it:

Warning: Something's Not Right Here!
www.railforums.co.uk contains malware. Your computer might catch a virus if you visit this site.
Google has found malicious software may be installed onto your computer if you proceed. If you've visited this site in the past or you trust this site, it's possible that it has just recently been compromised by a hacker. You should not proceed, and perhaps try again tomorrow or go somewhere else.
We have already notified www.railforums.co.uk that we found malware on the site. For more about the problems found on www.railforums.co.uk, visit the Google Safe Browsing diagnostic page.

If you understand that visiting this site may harm your computer, proceed anyway.

[tickbox] Help improve detection of malware by sending additional data to Google about sites on which you see this warning. This data will be handled in accordance with the Safe Browsing privacy policies.

I was using the site fine on IE8 at work, and on my Andoid mobile today.

junglejames · 9 Feb 2012

Funnily enough, yesterday i got what seems like a dodgy auto windows update. Wouldnt configure it correctly, and never let me log on to my computer again. Had to do a full reboot back to factory settings.
Cant see this being related though.

Ascot · 9 Feb 2012

Firefox just started to report this as an "Attack Site" for me and it's a pain to keep clicking :P.

Code:

What is the current listing status for www.railforums.co.uk?

    Site is listed as suspicious - visiting this website may harm your computer.

    Part of this site was listed for suspicious activity 1 time(s) over the past 90 days.

What happened when Google visited this site?

    Of the 9 pages we tested on the site over the past 90 days, 1 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2012-02-09, and the last time suspicious content was found on this site was on 2012-02-08.

    This site was hosted on 1 network(s) including AS50056 (AI).

Has this site acted as an intermediary resulting in further distribution of malware?

    Over the past 90 days, www.railforums.co.uk did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?

    No, this site has not hosted malicious software over the past 90 days.

How did this happen?

    In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

Badger · 9 Feb 2012

LM__ said:
AVG IS Business advised me to contact:

???? 123 reg looks quite legit to be honest....

Just over-thinking by AVG. railforums.co.uk is registered with 123 reg and so AVG thinks it's OWNED by 123 reg.

junglejames · 9 Feb 2012

Seems as though there are still the odd problems. Twice I tried to get onto the site recently, and both times Norton blocked an attack, and closed the site down. Worked 3rd time though.
Is it definitely just coming off the ads as mentioned? Seems as though it has really imbedded itself somewhere.

Virus Warning Accessing This Forum

Established Member

RailUK Forums

Veteran Member

Established Member

Established Member

Member

Established Member

Member

Established Member

Attachments

Established Member

Forum Staff

Established Member

Established Member

Member

Member

Established Member

Veteran Member

Member

Established Member

Established Member

Established Member

Established Member

Member

Member

Member

Established Member

Established Member

Established Member

Established Member

Member

Established Member