Panic Mode on (80) is reporting malware in Chrome !

Message boards : Number crunching : Panic Mode on (80) is reporting malware in Chrome !
Message board moderation

To post messages, you must log in.

AuthorMessage
Gone

Send message
Joined: 31 May 99
Posts: 150
Credit: 125,779,206
RAC: 0
United Kingdom
Message 1332584 - Posted: 29 Jan 2013, 22:59:59 UTC

I am getting this when I try to access the thread.
Anybody else seeing malware there ?


Google Chrome has blocked access to this page on setiathome.berkeley.edu.
Content from valid.canardpc.com, a known malware distributor, has been inserted into this web page. Visiting this page now is very likely to infect your computer with malware.
ID: 1332584 · Report as offensive
Richard Haselgrove Project Donor
Volunteer tester

Send message
Joined: 4 Jul 99
Posts: 14649
Credit: 200,643,578
RAC: 874
United Kingdom
Message 1332589 - Posted: 29 Jan 2013, 23:17:32 UTC - in response to Message 1332584.  
Last modified: 29 Jan 2013, 23:23:18 UTC

I am getting this when I try to access the thread.
Anybody else seeing malware there ?


Google Chrome has blocked access to this page on setiathome.berkeley.edu.
Content from valid.canardpc.com, a known malware distributor, has been inserted into this web page. Visiting this page now is very likely to infect your computer with malware.

I'm using Google Chrome, and I'm getting no warnings when either reading or posting in that thread.

I have user signatures disabled via community preferences - they are the most likely vector for any malware on this board.

Edit - yes, I get warnings too when I turn user signatures back on.
ID: 1332589 · Report as offensive
Gone

Send message
Joined: 31 May 99
Posts: 150
Credit: 125,779,206
RAC: 0
United Kingdom
Message 1332590 - Posted: 29 Jan 2013, 23:25:14 UTC - in response to Message 1332589.  

Yes, it stops when I disable signatures too.

I wonder who has the fancy malware enabled signature block ?
ID: 1332590 · Report as offensive
Profile Dimly Lit Lightbulb 😀
Volunteer tester
Avatar

Send message
Joined: 30 Aug 08
Posts: 15399
Credit: 7,423,413
RAC: 1
United Kingdom
Message 1332591 - Posted: 29 Jan 2013, 23:29:54 UTC

I have show images as links and get no warning, if I switch that off I get the warning.

Member of the People Encouraging Niceness In Society club.

ID: 1332591 · Report as offensive
Richard Haselgrove Project Donor
Volunteer tester

Send message
Joined: 4 Jul 99
Posts: 14649
Credit: 200,643,578
RAC: 874
United Kingdom
Message 1332592 - Posted: 29 Jan 2013, 23:45:13 UTC - in response to Message 1332590.  

Yes, it stops when I disable signatures too.

I wonder who has the fancy malware enabled signature block ?

By setting one message per page, and stepping through:

I got the first warning on a message by Siran d'Vel'nahr.
ID: 1332592 · Report as offensive
Gone

Send message
Joined: 31 May 99
Posts: 150
Credit: 125,779,206
RAC: 0
United Kingdom
Message 1332593 - Posted: 29 Jan 2013, 23:47:31 UTC - in response to Message 1332591.  

My Spock-like logic has deduced that it is an externally linked image in a signature block.

That narrows it down a bit. lol
ID: 1332593 · Report as offensive
Gone

Send message
Joined: 31 May 99
Posts: 150
Credit: 125,779,206
RAC: 0
United Kingdom
Message 1332594 - Posted: 29 Jan 2013, 23:49:45 UTC - in response to Message 1332592.  

CMDR Siran d'Vel'nahr XO USS Vre'kasht NCC-33187 ?

A Vulcan in the Federation, posting malware ?
ID: 1332594 · Report as offensive
Richard Haselgrove Project Donor
Volunteer tester

Send message
Joined: 4 Jul 99
Posts: 14649
Credit: 200,643,578
RAC: 874
United Kingdom
Message 1332595 - Posted: 29 Jan 2013, 23:51:12 UTC - in response to Message 1332593.  

My Spock-like logic has deduced that it is an externally linked image in a signature block.

That narrows it down a bit. lol

Siran has "http://valid.canardpc.com/cache/banner/1662584.png" in his signature block - that's the hosting site in the Chrome warning. His other image (his personal website) doesn't cause any warnings in Chrome.
ID: 1332595 · Report as offensive
Gone

Send message
Joined: 31 May 99
Posts: 150
Credit: 125,779,206
RAC: 0
United Kingdom
Message 1332596 - Posted: 29 Jan 2013, 23:58:51 UTC - in response to Message 1332595.  

Well tracked Richard.
I don't think a .png can have any active content in it, it must be that canardpc.com are a very naughty bunch..

French Duck computers....
ID: 1332596 · Report as offensive
Profile j mercer
Avatar

Send message
Joined: 3 Jun 99
Posts: 2422
Credit: 12,323,733
RAC: 1
United States
Message 1332599 - Posted: 30 Jan 2013, 0:16:48 UTC

The png is a 'CPU-Z' validation of his computer.
...
ID: 1332599 · Report as offensive
David S
Volunteer tester
Avatar

Send message
Joined: 4 Oct 99
Posts: 18352
Credit: 27,761,924
RAC: 12
United States
Message 1332653 - Posted: 30 Jan 2013, 4:16:40 UTC

Earlier today at work the Panic Mode thread just stalled while loading. This happened on both Explorer and Firefox. I suspect our firewall was choking on something, possibly that same image, but it wasn't sticking at that point or simply refusing to load the image like you might expect.

A few weeks ago the whole page was getting blocked by the firewall, but it cleared when the thread grew to a new page. This time it was different. And right now, I'm using Chrome at home and not getting a problem, with signatures fully enabled.

David
Sitting on my butt while others boldly go,
Waiting for a message from a small furry creature from Alpha Centauri.

ID: 1332653 · Report as offensive
Profile Siran d'Vel'nahr
Volunteer tester
Avatar

Send message
Joined: 23 May 99
Posts: 7379
Credit: 44,181,323
RAC: 238
United States
Message 1332762 - Posted: 30 Jan 2013, 12:55:56 UTC
Last modified: 30 Jan 2013, 13:05:11 UTC

Greetings guys,

This is a total surprise to me. I have had that link in my sig for years with no problem until now. I have removed the link from my sig. My guess is that the server has been hit. I experienced this same thing in the club I am in; a website was no longer accessible because Google had it blocked as an attack site.

My apologies for this. I am not one for advocating the spread of malware.

Keep on BOINCing...! :)

[edit]
I do not use Chrome myself, do not really care for it personally. I use, and have used, Firefox since the early days. I have received no warning from going into a thread here that I have posted in. Strange, strange indeed. :/
[/edit]
CAPT Siran d'Vel'nahr - L L & P _\\//
Winders 11 OS? "What a piece of junk!" - L. Skywalker
"Logic is the cement of our civilization with which we ascend from chaos using reason as our guide." - T'Plana-hath
ID: 1332762 · Report as offensive
Profile Ex: "Socialist"
Volunteer tester
Avatar

Send message
Joined: 12 Mar 12
Posts: 3433
Credit: 2,616,158
RAC: 2
United States
Message 1332808 - Posted: 30 Jan 2013, 15:27:02 UTC

What a nice guy! Everyone appreciates it.

It's not the first time someone's sig, or a posted link/pic here has triggered anti-malware software. Sometimes it just happens.
#resist
ID: 1332808 · Report as offensive
Profile James Sotherden
Avatar

Send message
Joined: 16 May 99
Posts: 10436
Credit: 110,373,059
RAC: 54
United States
Message 1332831 - Posted: 30 Jan 2013, 16:43:05 UTC

Now that the problem is resolved I will lock this thread so as not to confuse posters in to thinking that this is a new panic thread.
[/quote]

Old James
ID: 1332831 · Report as offensive

Message boards : Number crunching : Panic Mode on (80) is reporting malware in Chrome !


 
©2024 University of California
 
SETI@home and Astropulse are funded by grants from the National Science Foundation, NASA, and donations from SETI@home volunteers. AstroPulse is funded in part by the NSF through grant AST-0307956.