Gunsnet is "Attack Site"?????

[sevlex]

I am suddenly getting a message here from google that warns gunsnet.net is an attack site.

It just started popping up. Have we been hacked or are we under attack?

The warning then links to to this url:
http://www.stopbadware.org/firefox?hl=en-US&url=http%3A%2F%2Fwww.gunsnet.net%2Fshowthread.php% 3F7618-Gunsnet-is-quot-Arrack-Site-quot


Edit: header should read "attack".

[Sidartha]

About two hours ago it was telling me that I was missing plug-ins but there was no plug-in to install.
I'd say either one of the advertisers changed the coding on their banner or the admin changed a setting.
It's all better now anyway.

Edited to add: Nope. Now it's reading as an attack site for me too.

[Gunreference1]

I'm on their website. It doesn't appear to be malicious. They do ask for donations towards stopping 'Badware'. I would suggest turning up the setting on your pop-up blocker. Just my $0.02.

Steve

[Blacksmith]

Something is definitely wrong. I keep getting an alert from my virus program that it is blocking a virus called “Exploit Blackhole Exploit Kit (type 1889)

[TomO]

Well....I guess it might as well be an attack site; we're all armed with "assault" rifles. :)

[AKTexas]

I'm pleased I'm not the only one suffering this.

Alex?

[Tx Dogblaster]

Only certain members are attacked based on their opinions but not the whole site... :bigsmilebounce:

[aliceinchains]

Well....I guess it might as well be an attack site; we're all armed with "assault" rifles. :)




No need to waste ammo. I had beans for lunch and will gas them out.

[linx310]

Firefox is blocking the site also now...

[O.S.O.K.]

I was out of pocket (in lost wages, NV) for a few days - trade show - so I didn't see this...

OT - Linx - you moved north a bit huh?

[FunkyPertwee]

I can't access the site with firefox. When I do it looks like text only, really sucks. I'm posting this with IE, but I don't normally use it and won't start now.

I hope it gets fixed, whatever is wrong.

[63DH8]

My computer was affected too. Now it won't allow me to get any further than booting up. I thought I had Windows Defender, but I'm getting told my computer can't run that program. Methinks I'm screwed! :(

[Guns Network Staff]

I will ask Alex but our servers are not capabale of hosting any virus, worm or anything.

So sorry that is not happening.

[FunkyPertwee]

I turned off the "block attack sites" feature in firefox. Its under tools, options, security, then you'll see the check box for "block attack sites". Then the site will work again.

[cciota]

I was wondering what that was. Everytime I would come to our site i would get a message from Nortons 360 say my computer was being attacked. The risk name was "HTTP Malicious Toolkit Variant Activity 22" and the Atackers URL was scpp.co.cc/index.php?tp+5518726669ae6c5be. I finally clicked "quit notifying me". I figure it was a glitch in Nortons 360. I have a source address and destination address if you guys need it.

[studmuffin]

In my case the windows media player keeps popping up but wont play due to some glitch. I also canno close this window. Wierd. It looks like the site is being attacked from outside.

[Hedning]

Holy crap... I thought I was the only one with issues. My computer started acting weird when logging in with my stationary computer about 4-5 hours ago.... Some Java 6 shit kept popping up, and Avast found something it moved to the chest....WTF is going on?

[JVD]

I had Avast pop up and mention JS:Pddka-gen exploit and it aborted a connection of something trying to open a remote PDF file. Adobe actually opened so there is something to it.

Here's Microsoft's info about it

http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Exploit%3AWin32%2FPdfjsc.CR

[aliceinchains]

I was wondering what that was. Everytime I would come to our site i would get a message from Nortons 360 say my computer was being attacked. The risk name was "HTTP Malicious Toolkit Variant Activity 22" and the Atackers URL was scpp.co.cc/index.php?tp+5518726669ae6c5be. I finally clicked "quit notifying me". I figure it was a glitch in Nortons 360. I have a source address and destination address if you guys need it.



Yeah same shit here .

[alismith]

I was wondering what that was. Everytime I would come to our site i would get a message from Nortons 360 say my computer was being attacked. The risk name was "HTTP Malicious Toolkit Variant Activity 22" and the Atackers URL was scpp.co.cc/index.php?tp+5518726669ae6c5be. I finally clicked "quit notifying me". I figure it was a glitch in Nortons 360. I have a source address and destination address if you guys need it.

I got hit 4 times from my homepage (since I clicked "gunsnet" in my Favorites list) to this thread. So far, Norton is blocking all the attempts. Someone has loaded a virus onto this site. Glad to know I'm not alone with this.

[gunsnetadmin]

you'all still getting that message?

[Moebrown20]

The risk name was "HTTP Malicious Toolkit Variant Activity 22" and the Atackers URL was scpp.co.cc/index.php?tp+5518726669ae6c5be.

Same here.

[HDR]

you'all still getting that message?

Yup still getting it.



Safe Browsing

Diagnostic page for gunsnet.net

What is the current listing status for gunsnet.net?
Site is listed as suspicious - visiting this web site may harm your computer.
Part of this site was listed for suspicious activity 2 time(s) over the past 90 days.
What happened when Google visited this site?
Of the 11 pages we tested on the site over the past 90 days, 4 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2011-03-03, and the last time suspicious content was found on this site was on 2011-03-03.Malicious software includes 12 scripting exploit(s), 6 trojan(s). Successful infection resulted in an average of 9 new process(es) on the target machine.
Malicious software is hosted on 2 domain(s), including scpp.co.cc/ (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=scpp.co.cc/), hefdh43ehdfj.co.cc/ (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=hefdh43ehdfj.co.cc/).
This site was hosted on 1 network(s) including AS11427 (SCRR) (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=AS:11427).
Has this site acted as an intermediary resulting in further distribution of malware?
Over the past 90 days, gunsnet.net appeared to function as an intermediary for the infection of 1 site(s) including ak-47.net/ (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=ak-47.net/).
Has this site hosted malware?
Yes, this site has hosted malicious software over the past 90 days. It infected 1 domain(s), including ak-47.net/ (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=ak-47.net/).
How did this happen?
In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.
Next steps:


Return to the previous page. (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=http://www.gunsnet.net/newreply.php?p=105456&noquote=1#)
If you are the owner of this web site, you can request a review of your site using Google Webmaster Tools (http://www.google.com/webmasters/tools/). More information about the review process is available in Google's Webmaster Help Center (http://www.google.com/support/webmasters/bin/answer.py?answer=45432).

Plus:
"scpp.co.cc/index.php?tp=551872669ae6c5be";"Exploit Blackhole Exploit Kit (type 1889)";"Object was blocked"

"scpp.co.cc/index.php?tp=551872669ae6c5be";"Exploit Blackhole Exploit Kit (type 1889)";"Object was blocked"


Beats me but here are the messages; hopefully Alex can make some sense from it.

Anti gun Google in 2003?

[cciota]

Seems like the same gig I got! I was really going to be pissed off at the porno sites for screwing around with my computer.

[gunsnetadmin]

Ok, went ahead and removed a piece of software we were using for advertising. Just asked Google to rescan the site so the "attack site" categorization can be removed.


Just an FYI, if going to this site EVER asks you to install something, PLEASE REPORT IT IMMEDIATELY to either David (Guns Network Staff) or myself.

This site does not have any software that requires plug-ins that are not standard (Flash etc). If you have questions, just ask.

The proper place for notification is also http://www.gunsnet.net/forumdisplay.php?6-Update-Upgrade-Info-Forum

I get an email as soon as a topic is generated in there.


-Alex

[Guns Network Staff]

Alex found it. It was not on the servers system software. As Alex always told me it will be the additional software that will be vulnerable but not the system software.

It was in the banner software, in the delivery software section. So I have taken out the banner code for now.

As you all can see no horizontal banners until I get this other software going today.

We will be going to a different banner code.

[Bluntforce]

I turned off the "block attack sites" feature in firefox. Its under tools, options, security, then you'll see the check box for "block attack sites". Then the site will work again.

Thank you. Worked like a charm.

[cciota]

Alex found it. It was not on the servers system software. As Alex always told me it will be the additional software that will be vulnerable but not the system software.

It was in the banner software, in the delivery software section. So I have taken out the banner code for now.

As you all can see no horizontal banners until I get this other software going today.

We will be going to a different banner code.

Sweet! Good job guys!

[gunsnetadmin]

ak-47.net had the same issue. I have asked google to rescan the site. Hopefully this will be taken care of today.

Just to reiterate what David said.. our OS is on lockdown. If we get issues its through third party software.

[awp101]

Just happened to me as well. Using firefox, unchecked the "block attack sites" thing.

Is it just FF users? My FF updated before signing on to gunsnet, perhaps the issue is there?

FWIW I was able to open two threads including this one before I got the attack warning. If it wasn't for that, I wouldn't have known how to get around it.

[Tx Dogblaster]

Just now happened to me but it did it when I clicked from the 1st page of this thread to this page. I went to Firefox options and unchecked the "Block Attack Sites" box and it works fine now. I hate to leave that box unchecked though and I refuse to use I.E...

[Oswald Bastable]

Hmmm, using Opera and Avast here, not a single popup or problem recently, a quick malwarebytes scan shows nada.

[awp101]

A
It was in the banner software, in the delivery software section. So I have taken out the banner code for now.

As you all can see no horizontal banners until I get this other software going today.
I see banners.

No dead people, but I do see banners...

[Sherman]

In IE, I don't get the error. In Firefox I get it anytime I click on a link.

[h311bi11y]

Yeah, I had a problem earlier with a rogue av program. I thought it was another website that did it. But a quick scan with malwarebytes took care of it. Anyone with issues remaining from this situation try this (NOTE: this only works with broadband internet connections that use either ethernet or wi-fi):

Reboot your system into "safe mode with networking" (restart you system, then as soon as it shuts off and gets ready to restart, keep pressing the "f8" key until it comes up with a menu that has other options such as "safe mode" & "last known good configuration," then use the arrow keys on your keyboard to select "safe mode with networking" and hit the enter key).

Once your sytem boots into safe mode with networking, visit the website http://www.malwarebytes.org and click the blue button that says "download free edition."

After the installer downloads, run it. It's simple to install, just follow the instructions. When the installation is almost complete it will pop up a window that has 2 check boxes, one says "run program after install" (or something like that) the other says "check for updates." make sure both of them are checked.

Provided everything went smoothly, the main window will open on the "scanner" tab. select perform full scan (a quick scan may work, but it's best to play it safe). It will take some time to complete (the more files you have on your system, the longer it will take), but it should take care of the infection.

Once the scan is complete, it will pop up two windows, one will be the log file it creates (it's ok to simply close this one) and you can just click "ok" on the other one. Once this is done, click the "show results" button. Then when the list comes up, click the "remove all" button. The program will most likely want you to restart your computer after it finishes this, so go ahead and do it.

To be on the safe side, let you pc boot like normal, and once it is back up, run another scan.

Malwarebytes is a great little utility to run on a regular basis. It finds several things that most AV programs miss. The only problem with the free version of this program is that it does not run automatically. When you want to run it, you have to tell it to update manually (simply go to the "update" tab at the top and click "check for updates).

[swampdragon]

I can't access the site with firefox. When I do it looks like text only, really sucks. I'm posting this with IE, but I don't normally use it and won't start now.

I hope it gets fixed, whatever is wrong.

Safe Browsing
Diagnostic page for gunsnet.net

What is the current listing status for gunsnet.net?

Site is listed as suspicious - visiting this web site may harm your computer.

Part of this site was listed for suspicious activity 2 time(s) over the past 90 days.

What happened when Google visited this site?

Of the 11 pages we tested on the site over the past 90 days, 4 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2011-03-03, and the last time suspicious content was found on this site was on 2011-03-03.

Malicious software includes 12 scripting exploit(s), 6 trojan(s). Successful infection resulted in an average of 9 new process(es) on the target machine.

Malicious software is hosted on 2 domain(s), including scpp.co.cc/, hefdh43ehdfj.co.cc/.

This site was hosted on 1 network(s) including AS11427 (SCRR).

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, gunsnet.net appeared to function as an intermediary for the infection of 1 site(s) including ak-47.net/.

Has this site hosted malware?

Yes, this site has hosted malicious software over the past 90 days. It infected 1 domain(s), including ak-47.net/.

How did this happen?

In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

Next steps:

* Return to the previous page.
* If you are the owner of this web site, you can request a review of your site using Google Webmaster Tools. More information about the review process is available in Google's Webmaster Help Center.

[gunsnetadmin]

the banner software we were using was removed. Waiting on Google to re-scan the site. Until then, nothing more to see.

[alismith]

It appears to be working fine now. No warnings at all. I'm using IE and the full blown Norton Security Suite.

[Guns Network Staff]

I installed the newer banner software.

This one is new and not even related to the other code or company.

[Zoff12]

My computer was affected too. Now it won't allow me to get any further than booting up. I thought I had Windows Defender, but I'm getting told my computer can't run that program. Methinks I'm screwed! :(
Me too.

OK... I just finished cleaning out Zbot.B from my PC. I bypassed the Firefox warning and next I know... cleaning my PC.

[Penguin]

Hopefully I missed all the fun today. I haven't had any trouble though I am running Avast right now just to be a bit on the safe side.

[Blacksmith]

That stopped the attacks. But now the banner advertisement is covering my notification box and other controls on the top of the page. They are working fine. But I can’t see them until I hover over them.

[63DH8]

Awe CRAP!!! Y'all mean to say my computer acquired a .45 caliber hole for nothing????:crying_small:

[btcave]

Awe CRAP!!! Y'all mean to say my computer acquired a .45 caliber hole for nothing????:crying_small:

I hope you took video! :lool:

[gunsnetadmin]

That stopped the attacks. But now the banner advertisement is covering my notification box and other controls on the top of the page. They are working fine. But I can’t see them until I hover over them.

Ok, I'll put the flawed software back on. LOL. jk :P

[cevulirn]

I'm not sure if it was from the banner software here, or perhaps somewhere else, but I picked up a mild infection on my computer. (I don't always run antivirus, it makes things more entertaining sometimes.) A housecall scan seems to have cleaned it up, and I've got Avast running again now, so I'll soon see whats up.

[old Grump]

Well....I guess it might as well be an attack site; we're all armed with "assault" rifles. :)I resent that, all my guns are friendly. I on the other hand am a mean dirty fighting foul mouthed back stabbing, shin kicking sand in the eyes sum bitch.

[Partisan1983]

I'm just now finally able to get on. I first tried about 2 and half hours ago....


Is everything ok ?



Did someone try hacking the site ?

[Cypher]

My PC was hit by this too, McAfee detected a low level virus. I had to run a full MCrapafee scan and then a full Malewarebytes scan.

If anyone had a problem yesterday I would suggest installing, updating and running two full Malewarebytes scans on your PC. If you had problems and tweaked a setting to get back on the site then you are most likely still infected.

[gunsnetadmin]

My PC was hit by this too, McAfee detected a low level virus. I had to run a full MCrapafee scan and then a full Malewarebytes scan.

If anyone had a problem yesterday I would suggest installing, updating and running two full Malewarebytes scans on your PC. If you had problems and tweaked a setting to get back on the site then you are most likely still infected.


No, you're not infected unless you agreed to install the plug-in.

@Partisan1983 : yes, all fixed.


@Everyone: If you set your Firefox settings to not "block reported attack sites", set it back to the original value. GunsNet and AK-47.net are both clean.

[Krupski]

@Everyone: If you set your Firefox settings to not "block reported attack sites", set it back to the original value. GunsNet and AK-47.net are both clean.

FYI: Just set my Firefox back to "block attack sites = on" and it's working fine. :thumbsup:

[Cypher]

No, you're not infected unless you agreed to install the plug-in.

@Partisan1983 : yes, all fixed.


@Everyone: If you set your Firefox settings to not "block reported attack sites", set it back to the original value. GunsNet and AK-47.net are both clean.

I don't know, when I fisrt came in yesterday morning I opened up normal local apps worked some and everything was fine, opened up Gunsnet, the site hung and I started getting McAfee virus errors.

[sevlex]

Looks like everything is back to normal.

I ran a virus scan and came up clean. Should I do it in "Safe Mode"?

[Blacksmith]

Ok, I'll put the flawed software back on. LOL. jk :P

Thanks Alex :thumbsup:
This hovering crap is for the birds.
LOL

[slamfire51]

I learned a loooooooooooong time ago, that when a warning pops up, don't go there.
I could have ignored the warning, but after the last incident with a virus, I now heed.

[imanaknut]

Glad things have been cleared up. I am using Google Chrome and this is the alert I received:


Warning: Something's Not Right Here!
www.gunsnet.net contains content from scpp.co.cc, a site known to distribute malware. Your computer might catch a virus if you visit this site.

When you get a message like that, you believe it. And then my anti-virus went off alerting me that it trapped a virus and began an emergency scan. McAfee removed the virus and an infected cookie. Nice to know it works!

[awp101]

Still getting this if I block attack sites in FF:
Reported Attack Page!


This web page at www.gunsnet.net has been reported as an attack page and has been blocked based on your security preferences.

Attack pages try to install programs that steal private information, use your computer to attack others, or damage your system.

Some attack pages intentionally distribute harmful software, but many are compromised without the knowledge or permission of their owners.

If I click the "This is not an attack website" thing in the warning bar at the top of that page I get taken to stopbadware.org.

The thing is, I haven't installed any add ons.:oh:

[gunsnetadmin]

Still getting this if I block attack sites in FF:
Reported Attack Page!


This web page at www.gunsnet.net has been reported as an attack page and has been blocked based on your security preferences.

Attack pages try to install programs that steal private information, use your computer to attack others, or damage your system.

Some attack pages intentionally distribute harmful software, but many are compromised without the knowledge or permission of their owners.

If I click the "This is not an attack website" thing in the warning bar at the top of that page I get taken to stopbadware.org.

The thing is, I haven't installed any add ons.:oh:

Dunno what to tell you. We are clear with google and I am not seeing a block with GN or AK.

[slamfire51]

Still getting this if I block attack sites in FF:
Reported Attack Page!


This web page at www.gunsnet.net has been reported as an attack page and has been blocked based on your security preferences.

Attack pages try to install programs that steal private information, use your computer to attack others, or damage your system.

Some attack pages intentionally distribute harmful software, but many are compromised without the knowledge or permission of their owners.

If I click the "This is not an attack website" thing in the warning bar at the top of that page I get taken to stopbadware.org.

The thing is, I haven't installed any add ons.:oh:

Try rebooting.
I did and the warning POOOOOOFed!

[awp101]

Dunno if it was the reboot or clearing of the cache but it's good now...:oh:

[Zoff12]

Took a few runs through the anti-virus but my PC seems clean now. No warnings anymore.

[slamfire51]

Dunno if it was the reboot or clearing of the cache but it's good now...:oh:

Glad you're normal again.

[awp101]

Glad you're normal again.
There's a looooong list of folks who'd argue that I was NEVER normal and therefore couldn't be normal "again"...:lool:

[slamfire51]

There's a looooong list of folks who'd argue that I was NEVER normal and therefore couldn't be normal "again"...:lool:

I'll give you the benefit of the doubt. Hell, we're all abnormal to an extent.
Take comfort that 1 person considers you "normal".