Results 1 to 18 of 18

Thread: Site malware?

  1. #1
    Grand Shriner Doctor Go's Avatar
    Join Date
    Jan 2010
    Posts
    1,008

    Site malware?

    Following the site shut-down last week, every time I go to the site, the screen goes crazy and I get this error message:

    .
    .
    .
    .

    Well, I would add an image of what I get on screen, but the Shrine WON'T let me add or attach an image. Following all of the rules, size, dimensions, etc. but no luck.

    Anyway, there's a weird screen that takes over the browser every time I open the Shrine. Mods should take a look at it. They can also email me and I will email the image that I can't upload here.

  2. #2
    Grand Shriner
    Join Date
    Dec 2017
    Posts
    203
    Currently the only way to get rid of it, until you shut down your browser session, is to refresh the homepage.

  3. #3
    Grand Shriner Doctor Go's Avatar
    Join Date
    Jan 2010
    Posts
    1,008
    Which is what appears to get rid of it. Until you open the webpage again.

    Any fix for this on the horizon? It just seems annoying, not destructive - yet.

  4. #4
    M0dern Crusader Lefance's Avatar
    Join Date
    Mar 2008
    Posts
    2,773
    I had the exactly same problem, been avoiding FFS for a few days due that... but now it seems to work again. Phew!
    Yappari Saigo wa "Ai ga Katsu".

  5. #5
    Grand Shriner
    Join Date
    Dec 2017
    Posts
    203
    Yeah, seems to be gone now.

  6. #6
    I'm so glad I'm not young anymore. JonC's Avatar
    Join Date
    Mar 2007
    Posts
    3,150
    Nope, still the same. Virus warning, happens twice every time you opening, or go back to, any page.
    Do to changes in my schedule, I am not able to do uploads, renew links or fulfill requests at this time. I will resume uploads if and when the situation changes.

  7. #7
    Fairy Queen PPKA's Avatar
    Join Date
    Sep 2017
    Location
    Zanaris
    Posts
    2,444
    Quote Originally Posted by Doctor Go View Post
    Following the site shut-down last week, every time I go to the site, the screen goes crazy and I get this error message:
    This happens to me too when I try to sign in with Chrome. With Internet Explorer there is no problem.

  8. #8
    Hebrew Shriner Dracula's Avatar
    Join Date
    Nov 2006
    Location
    Margaritaville, FL
    Posts
    169
    Has anyone confirmed the problem has been cleaned up? Was FFShrine hacked?
    OrangeC's humble servant.

  9. #9
    I'm so glad I'm not young anymore. JonC's Avatar
    Join Date
    Mar 2007
    Posts
    3,150
    Still happening, but now only once per page upload.
    So progress?
    Either that, or the second attack is now getting through. I don't know.

  10. #10
    Grand Shriner
    Join Date
    Oct 2010
    Posts
    281
    It appears to be KPOT Stealer malware, which is pretty nasty if not removed from your computer and can lead to personal data being stolen and even ID fraud.

    I saw the pop-up with the fake Chrome updater a few times so have kept away from the site for a few days.

    I just tried the site now for the first time and didn't see it this time. That said, I do have malwarebytes, cybersec, adblock and a host of other plugins.

    I would think the site needs a serious security update, especially because it's not yet HTTPS.

    dR

  11. #11
    Grand Shriner QMarks's Avatar
    Join Date
    Feb 2013
    Posts
    388
    For now just use uBlock Origin or something like that and block the jquery.su domain to be safe.

  12. #12
    Grand Shriner
    Join Date
    Oct 2010
    Posts
    281
    I'm using uBlock Origin but I can't work out how to specifically block the jquery.su domain.

  13. #13
    Grand Shriner QMarks's Avatar
    Join Date
    Feb 2013
    Posts
    388
    Open the uBlock Origin Dashboard, go to the My filters tab, and add the domain there.

    That being said, I heard it might still occasionally slip by somehow regardless, so you might also want to go with NoScript on top of that just to be sure.

  14. #14
    One-Year War Veteran/WWWA Tro-Con KusanagiShiro's Avatar
    Join Date
    Mar 2007
    Location
    San Rafael, CA
    Posts
    1,751
    I reached out to Sarah and she is looking into it
    If you have a question about Ys or LUNAR, ASK AWAY! I will answer it to the best of my ability!


  15. #15
    Onion Kid
    Join Date
    Jun 2016
    Posts
    4
    This message?

  16. #16
    Shriner sisterfate's Avatar
    Join Date
    Jul 2010
    Posts
    70
    Same for me today - it has returned!

  17. #17
    Onion Kid
    Join Date
    Jan 2017
    Posts
    5
    Is there something I should do if I experienced this? How do I remove it? On a mac.

  18. #18
    Onion Kid
    Join Date
    Jun 2016
    Posts
    4
    Quote Originally Posted by ani2424 View Post
    Is there something I should do if I experienced this? How do I remove it? On a mac.
    Refresh the page, and it will disappear for a few days.

    DO NOT install anything on your system.

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •