ALERT - malware being pushed via g-krigg.com? check site!

[xheralt]

Accessing the website today, about 2:45 Central, I was immediately presented with a popup trying to run "firefox-patch.js", which I declined because I know that's not how FF does updates. Also a tab opened in my browser claiming to be a "critical Firefox update" but originating from some random site. Tom, PLEASE have whoever does website maintenance go over your site code with a fine-tooth comb! May have been poisoned ad or some such, you might have to audit those as well; visiting gunnerkrigg dotcom a second time did not trigger said popup.

[todd]

This might or might not be related, but I've noticed lately that this forum's site goes through a lot of "site is not responding" moments and needs to be reloaded. Maybe it's just on my computer, though; has this happened to anyone else?

[speedwell]

Never happens to me. But I'm on full commercial antivirus (ESET), and simultaneously running AdBlock Plus and Ghostery.

[saardvark]

Feb 9, 2017 0:29:52 GMT todd said:

This might or might not be related, but I've noticed lately that this forum's site goes through a lot of "site is not responding" moments and needs to be reloaded. Maybe it's just on my computer, though; has this happened to anyone else?

its happening to me too....

[Lightice]

Feb 9, 2017 0:29:52 GMT todd said:

This might or might not be related, but I've noticed lately that this forum's site goes through a lot of "site is not responding" moments and needs to be reloaded. Maybe it's just on my computer, though; has this happened to anyone else?

The forum and the main site run on different platforms. I doubt that they are related. At some point I had occasional site not responding-message from the forums, but it's been a long time since that last happened. I doubt that's anything more than that the servers at Proboards were under strain or maintenance.

[Jelly Jellybean]

Feb 10, 2017 12:35:43 GMT Lightice said:

Feb 9, 2017 0:29:52 GMT todd said:

This might or might not be related, but I've noticed lately that this forum's site goes through a lot of "site is not responding" moments and needs to be reloaded. Maybe it's just on my computer, though; has this happened to anyone else?

The forum and the main site run on different platforms. I doubt that they are related. At some point I had occasional site not responding-message from the forums, but it's been a long time since that last happened. I doubt that's anything more than that the servers at Proboards were under strain or maintenance.

Bears used to attack their servers, but I haven't heard of that happening for quite a while. Back then the bears didn't need paw hooks or razor collars.

[jda]

Is it the shadowmen first wave of attack,of many to come?
(No)

[arf]

I've occasionally had something similar happen when accessing the proboard,* but not the site itself.

* I simply close the window, and try again later. Yes I do use anti-virus software. Do you need to ask these days?

[fanofts]

I've never seen any problems with the gunnerkrigg dot com domain.

Useful tools:

virustotal.com/ for scanning URLs - but beware false positives

For example the last analysis over a month ago was clean (EDIT: but I derped and my re-analysis overwrote the link, so please ignore)
virustotal.com/en/url/2a005e41e2af6755d7bad82cdaeefaf15403c70d539b18ed1c27b92177f1f134/analysis/

I made a fresh one here and all looks clean:

virustotal.com/en/url/2a005e41e2af6755d7bad82cdaeefaf15403c70d539b18ed1c27b92177f1f134/analysis/1487008950/

Get more information from the sucuri and quttera links, again they sometimes have false reports so you need to dig deeper:

sitecheck.sucuri.net/results/www.gunnerkrigg.com

quttera.com/detailed_report/www.gunnerkrigg.com

Now, proboards I trust a lot less because they manipulate the html links post-load. Therefore I disable javascript in Chrome (Firefox allows a workaround to avoid the redirect). Inserting third party redirection is never a good idea in my (long) experience.