_GOTOBOTTOM
Site Talk
Site announcements, comments, or feedback about the site.
Armorama: Malware Site [resolved]
tatbaqui
Staff MemberNews Writer
ARMORAMA
#040
Visit this Community
Metro Manila, Philippines
Joined: May 06, 2007
KitMaker: 2,713 posts
Armorama: 2,451 posts
Posted: Friday, November 30, 2012 - 06:11 PM UTC
I keep getting this message since this morning when logging in via Google Chrome -- has the site been hacked? So far no issues with IE browser. Cheers
pseudorealityx
Visit this Community
Georgia, United States
Joined: January 31, 2010
KitMaker: 2,191 posts
Armorama: 1,814 posts
Posted: Friday, November 30, 2012 - 06:18 PM UTC
Firefox is reporting it has issues too.
Dragon164
#226
Visit this Community
British Columbia, Canada
Joined: February 20, 2012
KitMaker: 1,909 posts
Armorama: 1,066 posts
Posted: Friday, November 30, 2012 - 06:23 PM UTC
I have been getting this too.
When I click on more info I get this:

Safe Browsing
Diagnostic page for www.armorama.com

What is the current listing status for www.armorama.com?
Site is listed as suspicious - visiting this web site may harm your computer.

What happened when Google visited this site?
Of the 46 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2012-11-30, and suspicious content was never found on this site within the past 90 days.
This site was hosted on 2 network(s) including AS26496 (PAH), AS15169 (Google Internet Backbone).

Has this site acted as an intermediary resulting in further distribution of malware?
Over the past 90 days, www.armorama.com did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?
No, this site has not hosted malicious software over the past 90 days.

How did this happen?
In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

Next steps:
Return to the previous page.
If you are the owner of this web site, you can request a review of your site using Google Webmaster Tools. More information about the review process is available in Google's Webmaster Help Center.

Says nothing has been found but still pops up, strange.

Cheers Rob.
Braille
#135
Visit this Community
California, United States
Joined: August 05, 2007
KitMaker: 1,501 posts
Armorama: 1,485 posts
Posted: Friday, November 30, 2012 - 06:45 PM UTC
I normally use Google Chrome and I too have just gotten this message about Melware?

What's up guys?

Are there people some where that hate this site, hihi!

I am now using IE for the time being, feel like I now live in an undeveloped country with all this stuff happening so feaquently.

Hope this issue gets resolved soon.

~ Eddy
okdoky
Visit this Community
Scotland, United Kingdom
Joined: April 30, 2007
KitMaker: 1,597 posts
Armorama: 806 posts
Posted: Friday, November 30, 2012 - 11:23 PM UTC
I got this too this morning using Fire Fox

What happened when Google visited this site?

Of the 65 pages we tested on the site over the past 90 days, 9 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2012-11-30, and the last time suspicious content was found on this site was on 2012-11-30.

Malicious software is hosted on 1 domain(s), including URL REMOVED! /.

2 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including kitseller.net/, abvent.tk/.

This site was hosted on 2 network(s) including AS26496 (PAH), AS15169 (Google Internet Backbone).

Hope is of some use to the forum administrators ! It is like warfare on the internet !

Keep up the good work against these scum !

All the very best

Nige
retiredyank
Visit this Community
Arkansas, United States
Joined: June 29, 2009
KitMaker: 11,610 posts
Armorama: 7,843 posts
Posted: Saturday, December 01, 2012 - 01:24 AM UTC
Just got this one myself, using Firefox. I have faith in my redoubled security program, but I know that not everyone is so lucky.
And I thought the worst part were the spammers.
SdAufKla
Visit this Community
South Carolina, United States
Joined: May 07, 2010
KitMaker: 2,238 posts
Armorama: 2,158 posts
Posted: Saturday, December 01, 2012 - 02:09 AM UTC
Just got the same notification page from Google Chrome myself and had to navigate around it to get here.

Don't know what the fix might be for the Armorama admins, but it's worrisome, and I hope the site admins can get it resolved quick and easy.
imatanker
Visit this Community
Maine, United States
Joined: February 11, 2011
KitMaker: 1,654 posts
Armorama: 1,565 posts
Posted: Saturday, December 01, 2012 - 02:36 AM UTC
Windows XP,running IE.No problems.Jeff T.
DaveCox
Visit this Community
England - South East, United Kingdom
Joined: January 11, 2003
KitMaker: 4,307 posts
Armorama: 2,130 posts
Posted: Saturday, December 01, 2012 - 02:48 AM UTC
I don't know where you guys are getting these messages from

I run win7 32 & 64 bit,IE9 with Malware Bytes running full time in the background - no messages and a full scan revealed no problems. I trust Jim and his team to keep this site clean and so far no issues have occured. My mate uses Google Chrome and hasn't had any messages either.

Perhaps it's the security settings you're using?
SdAufKla
Visit this Community
South Carolina, United States
Joined: May 07, 2010
KitMaker: 2,238 posts
Armorama: 2,158 posts
Posted: Saturday, December 01, 2012 - 03:40 AM UTC
Seems to be just folks using Firefox and Chrome.

There's even a thread started about the "Armorama Malware" message over on Missing-Lynx, General Topics forum.

Interestingly, after I just told Chrome to go to the website anyways, I haven't gotten the message again.
jerem25
Visit this Community
Metro Manila, Philippines
Joined: December 08, 2007
KitMaker: 35 posts
Armorama: 34 posts
Posted: Saturday, December 01, 2012 - 04:43 AM UTC
I get this message both on Mozilla and Chrome when trying to go to armorama.com.. But it works if you will type armorama.kitmaker.net. I got no message and go directly to the site. Cheers
CMOT
Staff MemberEditor-in-Chief
ARMORAMA
Visit this Community
England - South West, United Kingdom
Joined: May 14, 2006
KitMaker: 10,954 posts
Armorama: 8,571 posts
Posted: Saturday, December 01, 2012 - 05:10 AM UTC
Jim is aware of this and looking into it.
tatbaqui
Staff MemberNews Writer
ARMORAMA
#040
Visit this Community
Metro Manila, Philippines
Joined: May 06, 2007
KitMaker: 2,713 posts
Armorama: 2,451 posts
Posted: Saturday, December 01, 2012 - 05:14 AM UTC

Quoted Text

I have been getting this too.
When I click on more info I get this:

Safe Browsing
Diagnostic page for www.armorama.com

What is the current listing status for www.armorama.com?
Site is listed as suspicious - visiting this web site may harm your computer.

What happened when Google visited this site?
Of the 46 pages we tested on the site over the past 90 days...



Same message screen I got as well. And also this:



I found it odd and disturbing, especially the statement "....www.armorama.com, a known malware distributor".

Anyways, access via Chrome now seems to be ok -- no more of those messages.

Cheers
Frenchy
Visit this Community
Rhone, France
Joined: December 02, 2002
KitMaker: 12,719 posts
Armorama: 12,507 posts
Posted: Saturday, December 01, 2012 - 06:00 AM UTC
This may have something to do with StopBadware.org...

http://support.mozilla.org/fr/questions/765945

Frenchy
Spiderfrommars
Visit this Community
Milano, Italy
Joined: July 13, 2010
KitMaker: 3,845 posts
Armorama: 3,543 posts
Posted: Saturday, December 01, 2012 - 07:07 AM UTC
I read the same message this morning and about 2 hours ago

My browser is Firefox

Delta42
Visit this Community
Georgia, United States
Joined: August 27, 2002
KitMaker: 616 posts
Armorama: 511 posts
Posted: Saturday, December 01, 2012 - 07:19 AM UTC
I got a notification yesterday, but my Norton Internet Security program zapped it before it did anything. Since then, I have had no problems. I'm using IE.

Dave
staff_Jim
Staff MemberPublisher
KITMAKER NETWORK
Visit this Community
New Hampshire, United States
Joined: December 15, 2001
KitMaker: 12,571 posts
Armorama: 6,599 posts
Posted: Saturday, December 01, 2012 - 08:26 AM UTC
Google and others are really making mountains out of molehills here. There was a problem on our AD SITE (not armorama.com or any of our other main sites). Someone had either hacked and or figured out how to SQL inject some malicious data and files on to that server. Two ads were updated to try to display a 'banner.js' (javascript) file. There were two .php files that supported this attack. It looked like a packet-type Denial of Service attack to me and not even against us but other servers. So not malware really but viruses against other web servers and NOT your personal computers. I thought it was odd when I went to our page which normally would have triggered a warning from AVG about a malicious file upload attempt, etc. I only got a warning from AVG when I went to try to look at the PHP files so perhaps the banner.js file never even was able to work the way it was designed. Anyways... long story short, the site should be clean now and I have fixed the data, secured the directory for the banners, and generally cleaned up the file upload process to make sure non-image files are not able to be uploaded. I couldn't believe the developers who made the ad software had not already done this. Sigh....

10-15 hours and Google should have it cleared up. Not sure about all the new 'notified' browsers and apps (like Norton) that are playing havoc as well. I am really not sure this idea of blocking sites BEFORE they attempt to deliver malware is the way to go. I know of several sites like ours that have gone through this recently and while there was an issue with our sites this time, and I am glad to know about it, no one on this site appears to ever have been at risk.

Thanks,
Jim
TankCarl
Visit this Community
Rhode Island, United States
Joined: May 10, 2002
KitMaker: 3,581 posts
Armorama: 2,782 posts
Posted: Saturday, December 01, 2012 - 08:35 AM UTC
Got the malware warning on Firefox, so I backdoored through kitmaker.net.
PantherF
Visit this Community
Indiana, United States
Joined: June 10, 2005
KitMaker: 6,188 posts
Armorama: 5,960 posts
Posted: Saturday, December 01, 2012 - 09:50 PM UTC
Man, a whole day without ARMORAMA and I'm already having withdrawal symptoms.

Had to get up early to see if it works.
Whew... finally it does!










~ Jeff
SdAufKla
Visit this Community
South Carolina, United States
Joined: May 07, 2010
KitMaker: 2,238 posts
Armorama: 2,158 posts
Posted: Tuesday, December 04, 2012 - 03:09 AM UTC
I know it must have been a big PITA, Jim, but thanks for taking the time to root out the problem and fix it.

Didn't stop me from visiting the site, but it sure was aggravating, and, hey, from a layman's point of view, you just never know what's really going on behind the curtain when it comes to the internet and security.

So, thanks again for "jousting those windmills" and "slaying those dragons" and quieting the things that go bump under our computers!
staff_Jim
Staff MemberPublisher
KITMAKER NETWORK
Visit this Community
New Hampshire, United States
Joined: December 15, 2001
KitMaker: 12,571 posts
Armorama: 6,599 posts
Posted: Tuesday, December 04, 2012 - 05:14 AM UTC
Mike - Your welcome!

All - I just noted that www.armorama.co.uk is still blocked so I added the site to our Google Webmaster Tools page and requested a review to clear that up. I think that should solve most of the issues anyone else is having. Cached page files in your browser might be the only other reason people are occasionally seeing the malware message.

Thanks,
Jim
firstcircle
Visit this Community
England - South East, United Kingdom
Joined: November 19, 2008
KitMaker: 2,249 posts
Armorama: 2,007 posts
Posted: Tuesday, December 04, 2012 - 12:08 PM UTC

Quoted Text

I just noted that www.armorama.co.uk is still blocked



Only blocked by Chrome from what I can see - IE9 allows it. *sigh* what a great browser it is!!
tatbaqui
Staff MemberNews Writer
ARMORAMA
#040
Visit this Community
Metro Manila, Philippines
Joined: May 06, 2007
KitMaker: 2,713 posts
Armorama: 2,451 posts
Posted: Tuesday, December 04, 2012 - 03:34 PM UTC
Good to hear that it is resolved Jim.

The one thing that ticked me was the statement "....armorama.com, a known malware distributor...". Obviously its a boilerplate of some sort, automated and all. But it sure does place the site in a bad light which may not necessarily be the case here.

On one hand I find it good to have that extra level of security (though at times irritating) but maybe Google can improve on the messaging they put up in these situations.

Cheers
 _GOTOTOP