Malware alert

[Pieter]

In Google chrome:

"The website at www.fencing.net contains elements from the site centiyo.com, which appears to host malware – software that can hurt your computer or otherwise operate without your consent. Just visiting a site that contains malware can infect your computer.
For detailed information about the problems with these elements, visit the Google Safe Browsing diagnostic page for centiyo.com.
Learn more about how to protect yourself from harmful software online."

Seemed to try to launch a java app as well...

[Stormbringer]

I got the same alert in Chrome on Windows (Vista), and in Chromium on Linux (Kubuntu).

I didn't get any notice of a java app, though...

Also, whatever it is doesn't seem to bother Firefox on Linux.

[Craig]

Saw this this morning and got rid of it. Still trying to find out what happened to push that onto the server.

Craig

In Google chrome:

"The website at www.fencing.net contains elements from the site centiyo.com, which appears to host malware – software that can hurt your computer or otherwise operate without your consent. Just visiting a site that contains malware can infect your computer.
For detailed information about the problems with these elements, visit the Google Safe Browsing diagnostic page for centiyo.com.
Learn more about how to protect yourself from harmful software online."

Seemed to try to launch a java app as well...

[thetortfeasor]

I got the same alert in Chrome on Windows (Vista), and in Chromium on Linux (Kubuntu).

I didn't get any notice of a java app, though...

Also, whatever it is doesn't seem to bother Firefox on Linux.

I didn't either, but avast! did notify me that unless I aborted the connection with f.net, I would be allowing a Trojan to enter my computer. Ick. Thankfully, the next time I tried to access f.net the problem was already solved.

[qatet]

I don't know if it's related, but I just got male enhancement spam from admin@fencing.net.

[Craig]

Just got off with our server support and they've deleted and locked down the offending files. We also got rid of a few thousand emails that were in the servers' queue.

The server was using a dummy profile pic upload to send emails from the server to all emails in the database. Doesn't look like any of that info was transmitted offsite, just used to send the emails.

Until the next security patch is updated, I've removed the ability to upload photos or profile pictures as that is where the vulnerability occurred.

Craig