X-Plane.org MALWARE DETECTED

[AnonymousUser68]

So it wasn't just a false positive 

I am not very technical, do you know if the user profiles are safe? 

[HPM]

We were reportedly hacked by someone in Geneva. Mark is working with Invision to patch it up and the forum will be offline until he gets it worked out.

 

Curse those filthy Genevans! Just because they're only the second largest city in Switzerland, the have to get all antsy and go out in the world like they're all that. Totally overcompensating.

[AnonymousUser68]

Well this is weird, I have a few .org screenshots as well as links on my website (xplaneaustralia) and this is what I end up with. 

[woweezowee]

yep, the x-plane world does indeed end today. damn mayas. but now http://www.x-plane.de is also affected.

[Andyrooc]

The Org is back online. Nasty bit of malware infected the index page apparently.

 

http://reports.antivirus-lab.com/261983/trojan-lameshield-60/

 

This site will need the same update The Org got I assume?

[Cameron]

The Org is back online. Nasty bit of malware infected the index page apparently.

 

http://reports.antivirus-lab.com/261983/trojan-lameshield-60/

 

This site will need the same update The Org got I assume?

 

No, we protected ourselves against all of this weeks ago.

[maestrogn]

TKyler:

 

Thank you so much for that plateau fix. Graz airport is now exactly where it should be and I did several takeoffs and landings to try it from different directions.

 

I really appreciate your help and it is so good to be able to fly the scenery I'm actually in now.

 

Happy Holidays!

 

mGN

[tkyler]

glad to help mGN and glad you're up and running and enjoying the scenery.  ask anytime, we'll be here.

 

TomK

 

Laminar/IXEG

[Andyrooc]

No, we protected ourselves against all of this weeks ago.

Nice!

[Patrik Hedström]

Could it be somebody from Geneva that was pissed off with one of the .org mods (xdave?)?

 

I'm pretty sure that if .org does not change there mods soon they will only get more and more of these prolems.

[chris k]

I dont think so. More likely it was a security hole, found by an automated scan to see if any Invision Powerboards still have the exploit, and they inject.[*]

 

Lots of time and effort just to inject something on a redirect page targeting only Win32/XP users doesn't seem like a targeted attack against any particular site.

 

- CK.

 

[*] The Opinions/Analysys expressed above are my own, but may be rented for a nominal fee.

[Patrik Hedström]

I dont think so. More likely it was a security hole, found by an automated scan to see if any Invision Powerboards still have the exploit, and they inject.[*]

 

Lots of time and effort just to inject something on a redirect page targeting only Win32/XP users doesn't seem like a targeted attack against any particular site.

 

- CK.

 

[*] The Opinions/Analysys expressed above are my own, but may be rented for a nominal fee.

Good point.

[MdMax]

After X-Plane.org, FlightSim.com:

http://www.flightsim.com/vbfs/forumdisplay.php?11-X-Plane

 

 

What is the current listing status for flightsim.com?

Site is listed as suspicious - visiting this web site may harm your computer.

Part of this site was listed for suspicious activity 2 time(s) over the past 90 days.

What happened when Google visited this site?

Of the 68 pages we tested on the site over the past 90 days, 6 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2012-12-25, and the last time suspicious content was found on this site was on 2012-12-24.

Malicious software is hosted on 1 domain(s), including

penetraterarest.pro/

.

1 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including

journaldugeek.com/

.

This site was hosted on 3 network(s) including

AS32613 (IWEB)

,

AS13335 (CLOUDFLARENET)

,

AS15169 (Google Internet Backbone)

.

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, flightsim.com appeared to function as an intermediary for the infection of 2 site(s) including

trainsim.com/

,

train-sim.com/

.

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.

How did this happen?

In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

[Patrik Hedström]

Oh Boy...