*** OFFISHUL OMG IT'S AN SF.COM ATTACK SITE THREAD ***

[SunnySooner]

WTH???? When I try to navigate to SF.com, I keep getting warnings that this site is an attack page and may damage my 'puter. Anyone else? First time this has happened to me.

[JLEW1818]

yep, i am too

[SunnySooner]

Have we been hacked or sumthin??

[Crucifax Autumn]

The other thread said there's yet ANOTHER thread in the help discussing this.

[SunnySooner]

What other thread, what "help"??

[yermom]

i think it's bogus, but they could probably ditch the .js that is doing funny stuff...

[yermom]

What other thread, what "help"??

http://www.soonerfans.com/forums/showthread.php?t=138759

[Crucifax Autumn]

trouble and suggestions forum...Not that there are any REAL solid answers there! lol

[SunnySooner]

Hmmm, looks like it's been going on for awhile for some folks, weird. I hope it's crap, this is a new 'puter!!!!

[StoopTroup]

whornfans.com can give ya a really bad infection that can't be cured and results in a lifetime of disappointments. Avoid that one at all costs.

[tidalmouse]

I've seen nothing but my Computer is basically wide open except for the Comcast Firewall,so I'd get no prior Warning. :pop:

I cleaned Crap that had been in mine for Years with "Avast",Free Download.Things have been smoothe since then. :P

[colleyvillesooner]

just started getting the same thing today.

[Crucifax Autumn]

Safe Browsing

Diagnostic page for soonerfans.com

What is the current listing status for soonerfans.com?

Site is listed as suspicious - visiting this web site may harm your computer.
What happened when Google visited this site?

Of the 181 pages we tested on the site over the past 90 days, 2 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-01-29, and the last time suspicious content was found on this site was on 2010-01-29.Malicious software is hosted on 1 domain(s), including bawled.in/ (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=bawled.in/).
1 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including 4ura.us/ (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=4ura.us/).
This site was hosted on 1 network(s) including AS27473 (CIHOST) (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=AS:27473).
Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, soonerfans.com did not appear to function as an intermediary for the infection of any sites.
Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.
How did this happen?

In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.
Next steps:


Return to the previous page. (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=http://www.soonerfans.com/forums/forumdisplay.php?f=2#)
If you are the owner of this web site, you can request a review of your site using Google Webmaster Tools (http://www.google.com/webmasters/tools/). More information about the review process is available in Google's Webmaster Help Center (http://www.google.com/support/webmasters/bin/answer.py?answer=45432).

Updated 15 hours ago
©2008 Google - Google Home (http://www.google.com/)

[StoopTroup]

We is all saved!

http://fashiontribes.typepad.com/main/images/o_brother_tim_blake_nelson.jpg

[LosAngelesSooner]

So, I just installed a new security add on for my Firefox browser and now every time I click on ANYTHING on SF.com or try to read any thread I get a warning page that SF.com is "an attack site" which looks like this:



What is the current listing status for soonerfans.com?
Site is listed as suspicious - visiting this web site may harm your computer.

What happened when Google visited this site?
Of the 181 pages we tested on the site over the past 90 days, 2 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-01-29, and the last time suspicious content was found on this site was on 2010-01-29.Malicious software is hosted on 1 domain(s), including bawled.in/ (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=bawled.in/).


1 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including 4ura.us/ (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=4ura.us/).


This site was hosted on 1 network(s) including AS27473 (CIHOST) (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=AS:27473).

Has this site acted as an intermediary resulting in further distribution of malware?
Over the past 90 days, soonerfans.com did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?
No, this site has not hosted malicious software over the past 90 days.

How did this happen?
In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.


And when I try to tell it that it's NOT an attack site I get redirected to this page: LINK (http://www.stopbadware.org/home/reviewinfo?hl=en-US&url=http%3A%2F%2Fwww.soonerfans.com%2Fforums%2Frep utation.php%3Fdo%3Daddreputation%26p%3D2826469)

Does anyone have ANY idea what this is about?

They are claiming that SF.com has 2 instances of dangerous imbeded scripts.

This isn't happening with any other page I visit.

[soonerboomer93]

Safe Browsing

Diagnostic page for soonerfans.com

What is the current listing status for soonerfans.com?

Site is listed as suspicious - visiting this web site may harm your computer.
What happened when Google visited this site?

Of the 181 pages we tested on the site over the past 90 days, 2 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-01-29, and the last time suspicious content was found on this site was on 2010-01-29.Malicious software is hosted on 1 domain(s), including bawled.in/ (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=bawled.in/).
1 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including 4ura.us/ (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=4ura.us/).
This site was hosted on 1 network(s) including AS27473 (CIHOST) (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=AS:27473).
Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, soonerfans.com did not appear to function as an intermediary for the infection of any sites.
Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.
How did this happen?

In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.
Next steps:


Return to the previous page. (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=http://www.soonerfans.com/forums/forumdisplay.php?f=2#)
If you are the owner of this web site, you can request a review of your site using Google Webmaster Tools (http://www.google.com/webmasters/tools/). More information about the review process is available in Google's Webmaster Help Center (http://www.google.com/support/webmasters/bin/answer.py?answer=45432).

Updated 15 hours ago
©2008 Google - Google Home (http://www.google.com/)

you might PM that to Phil. I know I had pm'd him some of the information Kaspersky was giving me.

[Crucifax Autumn]

PAy attention man...There's already a thread.

[OUHOMER]

yes this sucks

[tidalmouse]

Shirley SoonerFans.com will Protect us. :pop:

The stuff it talked about in your Post Crux sounds like it may have something to do with that "Mass PM" a bunch of us recieved;or not. :confused:

[LosAngelesSooner]

How could I tell? I keep getting the damn message...LOL

merge?

[Crucifax Autumn]

Screw that. If another 40 people post threads about it it, we'll be close to Jeffcoat thread levels.

[LosAngelesSooner]

Who is Jeffcoat?

[LosAngelesSooner]

Craptastic. I got it, too.

[Crucifax Autumn]

A texass high school football player that had 873 threads discussing if he'd go to OU, texass, or Houston over the past 2 weeks.

[Crucifax Autumn]

I wonder if they are really related though. The warning text seems to imply that it would be something a bit different, but then again I know about as much about it as Vet knows about the music of Slayer.

[yermom]

my understanding, assuming the site has not been hijacked, the exploit being detected could be due to the fact that the method that was used to force a message could also be used to deliver some malevolent payload. some security software can find malware that hasn't been identified yet by looking for methods like this

[KC//CRIMSON]

Soonerfans.com a virus has been detected: JS:Redirector-BB [Trj]

What's strange is if you enter through Google it pops up every time, enter through Bing and nothing.

[Crucifax Autumn]

The message shows up if you do a google search for Soonerfans.com too.

Whatever it is appears to be hosted here: bawled.in/ and somehow serving the shat up on SF. The only way to know more specifically WHAT it is is for Phil or someone else with ownership type info to contact Google and get a greater amount of information.

[Crucifax Autumn]

Soonerfans.com a virus has been detected: JS:Redirector-BB [Trj]

What's strange is if you enter through Google it pops up every time, enter through Bing and nothing.

Isn't the redirector thing something entirely different that was supposedly explained away already as being a false alarm?

I got the impression from the text on the Google warning that this is different from the previous issue.

[LosAngelesSooner]

Is he a Sooner?

[Crucifax Autumn]

No, he chose the cows and so now he is gonna be known as dooshcoat!

[OULenexaman]

I have not seen jack ****.....but I just use my history link...

[LosAngelesSooner]

It happens to me even when I hit the REFRESH.

[LosAngelesSooner]

Eff him.

Eff any kid who's not a Sooner.

[OULenexaman]

lost in LA...

[OULenexaman]

still nothing....must be terrorists...I'm toast...cant even spell right now...could be that lady that died from the poltergiest movies..

[OU-HSV]

you might PM that to Phil. I know I had pm'd him some of the information Kaspersky was giving me.

Yeah I sent Phil a PM as well, just giving him a heads up that something odd was going on

[yermom]

it's coming up every time in Chrome

[Crucifax Autumn]

I didn't bother despite someone suggesting I do just that. I kinda figured the people running this joint might occasionally pop in for a visit! ;)

[Soonerus]

...virus report every time I sign on...needs to be fixed...

[Crucifax Autumn]

Echo....Echo...Echo

This record is reversible...Turn back...Turn back...Turn back

[the_ouskull]

it's coming up every time in Chrome

If this post works, it'll be the first one that has, but it's also the first one I haven't tried to "Quick Reply."

I'm using Firefox and Ubuntu, and get the page every time I refresh, or click any link, and it doesn't matter how I get to the site, be it bookmark, Google, or whatever...

Someone call me when the sh*t is working again, please.

the_ouskull

[yermom]

i mean the message about it being a bad site

[Crucifax Autumn]

Someone call me when the sh*t is working again, please.

the_ouskull

What do you want us to call you? ;)

[Crucifax Autumn]

i mean the message about it being a bad site

We all know SF is one bad *** motherfrogger!

[85Sooner]

i AM GETTING IT AS WELL.

[Crucifax Autumn]

Everyone using a browser other than IE is getting it. Phil replied on the thread on the football forum about this and he's currrently digging into it.

[Phil]

Working on it.

[Crucifax Autumn]

If you need more info from members, the other thread here in the SO has a lot more posts.

[OU-HSV]

it's coming up every time in Chrome

ditto

[Collier11]

suck azz

[GottaHavePride]

I just hit that too...

[Phil]

I think we've got it cleaned up. I have submitted it back to Google for a review to see if they will unlist us so that thing will quit coming up.

[Collier11]

Just an fyi, it is still coming up on firefox but not IE, I hope this can be fixed?

[SunnySooner]

Firefox is now good, for me anyway, peeps, I think we're safe.

Once again, the brave and valiant colors of Crimson and Cream have defeated the evil burnt orange empire!!!!!!!!! As someone else observed, we all just KNOW it was a damn texun responsible for all this cow ****!!!!!!!! Boomer!!!!

Live On, University!!!!!!

:D :D :D :D :D :D :D :D :D :D :D

[StoopTroup]

I think I was just vio-googlated.

[btk108]

good jorb, Phil..you Gentle Warrior...ehehheh how much did that just cost me?

[Rogue]

Sweet, glad it's back.
Firefox wouldn't let me log in earlier today.
Was SF taken over by the Dark Side or something?