Kvatch Rebuilt Site infected? : IV

» Thu Dec 16, 2010 1:27 am

UPDATE: Statement from Ionis, KR leader:

Hello,

I am aware of the problems with Kvatch.net, I'm quite saddened by the sorry state it's in, I had some good times on those forums lol. I have not spoken to the web host since before KR was released and even then it was Elessar who acted as intermediary handling the site business, thus he also had the FTP login details. Unfortunately Elessar is no longer active and this means I myself cannot actively do anything about it. I would advise you and everyone else to steer clear of the site.

Concerning the future of KR, I very much doubt there will be another version, with Elessar and the original team gone I cannot see myself or Zaldir releasing a 1.2. However Elessar and I have always had the view that KR should be open-source and moddable so if anyone wants to release bug fixes or what not they are welcome to.

In regards to KRU I left that in the capable hands of Zaldir, the last I saw of it it was quite far along so I may actually return to help him iron out a release, we shall see!

Sorry to keep everyone in the dark about Kvatch.net I hope this clears things up

.

Ionis

The following is the original post, archived for posterity:

I'm assuming it's been that way for a while, but on a whim I decided to go to the Kvatch Rebuilt website to check on the progress of KRU (last time I went before was months ago).

As the site was loading, I was met with Google Chrome's "Warning: Visiting this site may harm your computer!" message telling me "The website at [URL of Kvatch Rebuilt website] contains elements from the site [censored by poster], which appears to host malware".

I continued anyway, out of curiosity, and then some generic faux-antivirus scareware tried to download and install itself on my computer. I managed to stop it, but I'm still trying to figure out what happened and how long it's been this way.

Google search yielded no results, and I PM'd the mod's author on YouTube, however I haven't received any reply.

Is KR dead? Thanks for the help.

(I decided to censor links and avoid posting URLs. I don't want to accidentally send you to a malware infected website)

» Wed Dec 15, 2010 3:40 pm

I know the Kvatch Rebuilt forums got hacked months ago. I think it was in July. At that time, the main site was still ok. I just checked and the main site seems to be ok - I'm not getting a warning in Firefox. I think the new guy that's working on it has no idea what to do and just left it that way. I don't know where he's at with the update - I haven't seen anything since the update on the main page in June. It's not a big team anymore, so I don't know if it's lost momentum or what.

» Wed Dec 15, 2010 4:26 pm

I know the Kvatch Rebuilt forums got hacked months ago. I think it was in July. At that time, the main site was still ok. I just checked and the main site seems to be ok - I'm not getting a warning in Firefox. I think the new guy that's working on it has no idea what to do and just left it that way. I don't know where he's at with the update - I haven't seen anything since the update on the main page in June. It's not a big team anymore, so I don't know if it's lost momentum or what.

You know, the scareware incident occurred a few weeks ago for me, I visited today to check up on it. Maybe it's been fixed and Chrome is just still reporting it as dangerous.

» Wed Dec 15, 2010 8:50 pm

So I just visited it. Same thing happened. That is, I proceeded past the warning message, and scareware tried to install itself.

» Thu Dec 16, 2010 6:32 am

I'm just visiting kvatch.net, not the forums. Are you getting the warning just with kvatch.net?

» Wed Dec 15, 2010 10:07 pm

I'm just visiting kvatch.net, not the forums. Are you getting the warning just with kvatch.net?

Yeah I go to the main site, and then all of the sudden it jumps to a white screen with this green icon in the middle. Then a pop up appears telling me my computer is unprotected and that I should download some generic antivirus program that is probably scareware. Tell me, do you have JS disabled?

» Thu Dec 16, 2010 6:30 am

Tesnexus is having the same problems right now -- seems the ad server they use to get revenue for the sites has been distributing malware infested ads (Guess the ad site doesn't bother to check the ads before pushing them out to sites !) - so Google has added them to a blacklist to keep people from becoming infected by going to the site and getting the ads - Tesnexus has since blocked the infected ads and cleaned the site but Google takes awhile to remove the warnings once a site is blacklisted. Not sure if it is the same thing happening at Kvatch Rebuilt site but wouldn't be surprised if it was - I'd give them a few days to get things sorted out and then try again.

» Thu Dec 16, 2010 8:17 am

So this is interesting: I launched up FF and tried to visit the website. I was able to safely visit the website for a few seconds, however I decided to close the tab when I noticed the bottom bar telling me it was waiting for the url of the offending site Chrome told me about.

@JDFan: when did TESNexus begin having problems? I don't know how long KR has been, but I know it's at least a few weeks. However, I'm pretty sure it's an ad exploit, considering Firefox was waiting for the offending site to load a banner ad.

» Thu Dec 16, 2010 4:51 am

Alright so I decided to wait on the site to load it's ad, and lo and behold, the instant it did Firefox was compromised and I became infected. A quick clean with MSE took care of it though. So yeah, it looks like it is an ad exploit. Do you know the URL of the ad that compromised TESNexus, JDFan?

» Thu Dec 16, 2010 6:12 am

I didn't think KR had any ads on the main page, but I may have blocked those ages ago... The forums are completely corrupted. I saw something trying to load at one point when I visited the forums, but have never seen anything on the main page. I'm installing and running Microsoft security essentials right now - I don't think I have anything, but doesn't hurt to check.

For Nexus, see the posting in this forum. Problem started for them yesterday and some people are still reporting problems.

» Wed Dec 15, 2010 9:15 pm

This is worse than I thought, because I just http://img80.imageshack.us/img80/3799/scr3502867.jpg when I was enter the forum. That forum is really dead. :dead:

» Thu Dec 16, 2010 4:32 am

So this is interesting: I launched up FF and tried to visit the website. I was able to safely visit the website for a few seconds, however I decided to close the tab when I noticed the bottom bar telling me it was waiting for the url of the offending site Chrome told me about.

@JDFan: when did TESNexus begin having problems? I don't know how long KR has been, but I know it's at least a few weeks. However, I'm pretty sure it's an ad exploit, considering Firefox was waiting for the offending site to load a banner ad.

It's been a day or so that Tesnexus has been going through it but DarkOne is pretty good about responding to things quickly so a smaller site like Kvatch rebuilt might take longer to become aware of the problem. -- figure I'm pretty sure the ad server Tesnexus uses is a pretty common ad server site so there are bound to be others that use them for their ad revenue as well - so we'll probably see quite a few sites affected in the upcoming weeks.

» Wed Dec 15, 2010 8:16 pm

@leonardo2: Yeah, that's what I see too. It's been like that since July. I was monitoring a post on those forums, so I know right when it happened because I got an email update that the post I was monitoring had been updated! It got updated alright!

» Wed Dec 15, 2010 11:02 pm

Alright so I decided to wait on the site to load it's ad, and lo and behold, the instant it did Firefox was compromised and I became infected. A quick clean with MSE took care of it though. So yeah, it looks like it is an ad exploit. Do you know the URL of the ad that compromised TESNexus, JDFan?

http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=http://www.tesnexus.com/downloads/file.php?id=22745

» Wed Dec 15, 2010 9:43 pm

http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=http://www.tesnexus.com/downloads/file.php?id=22745

Thanks. The domain doesn't match the one infecting KR's website, so I think I can assume the two problems are unrelated.
Here, I'm editing in the http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http://onlineisdudescars.com/js.php&client=googlechrome&hl=en-US for kvatch.net. Well, it's not for kvatch.net, but for the site infecting it. Interestingly enough, though, the diagnostic page for kvatch.net is clean, despite Chrome saying otherwise and linking to the diagnostic page for the site that maybe using kvatch.net as an intermediary.

» Thu Dec 16, 2010 2:14 am

http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=http://www.tesnexus.com/downloads/file.php?id=22745

That's for Nexus - I posted the same thing in the thread about Nexus' problems. Kvatch Rebuilt seems to have a different problem - it seems to be a direct hack rather than malware via advertising.

» Wed Dec 15, 2010 9:30 pm

That's for Nexus - I posted the same thing in the thread about Nexus' problems. Kvatch Rebuilt seems to have a different problem - it seems to be a direct hack rather than malware via advertising.

Nah, I don't think it's just a direct hack. Usually those are out of pure malice. Scareware is usually used for financial gain. However, I'm not entirely sure.

» Thu Dec 16, 2010 10:04 am

That's for Nexus - I posted the same thing in the thread about Nexus' problems. Kvatch Rebuilt seems to have a different problem - it seems to be a direct hack rather than malware via advertising.

Yes I know -- He asked what site it was that served the ads to NEXUS to compare with the one he is getting from Kvatch rebuilt site !!

» Thu Dec 16, 2010 8:09 am

I don't know what exactly is going on with Kvatch.net. I'm starting to think it's a bunch of things. I just wish I could get a response from the creator.

» Thu Dec 16, 2010 1:44 am

I don't know what exactly is going on with Kvatch.net. I'm starting to think it's a bunch of things. I just wish I could get a response from the creator.

I sent zaldir a note about it ages ago and never heard anything or saw anything different. I think he's gone, unfortunately. I think it was a direct hack to bring down the forums and they succeeded. Zaldir seems to have just said "screw it" and moved on, but I could be reading too much into it. I just checked my system with MSE and nothing was actually loaded.

» Thu Dec 16, 2010 8:53 am

I sent zaldir a note about it ages ago and never heard anything or saw anything different. I think he's gone, unfortunately. I think it was a direct hack to bring down the forums and they succeeded. Zaldir seems to have just said "screw it" and moved on, but I could be reading too much into it. I just checked my system with MSE and nothing was actually loaded.

Zaldir apparently has a blog... Well, maybe we can contact him through that. Anyways, I though Zaldir was the one behind KRU. I thought Kvatch Rebuilt had a different team and they picked Zaldir to head KRU development.
Add: I think I should also mention the blog is pretty active. Last post was only a week or two ago.

» Thu Dec 16, 2010 6:18 am

So there is a little information in Zaldir's guestbook, head to his blog and read some of the comments.

» Thu Dec 16, 2010 12:05 pm

Oh! That's good to know. Where's his blog and guestbook? Just got the warning from kvatch.net and MSE freaked out, so everything is bad now for me...

» Thu Dec 16, 2010 2:52 am

Oh! That's good to know. Where's his blog and guestbook? Just got the warning from kvatch.net and MSE freaked out, so everything is bad now for me...

http://www.zaldir.co.uk/apps/guestbook/ Also, don't worry, MSE should take care of the infection. Just kill anything accessing the infected site and run a quick scan with MSE. It should actually open a balloon window telling you to clean your computer, so just do so. Also, make sure it is actually MSE trying to run a scan. A lot of scareware manifests itself as fake antivirus programs to trick you into buying their product by reporting viruses that are not present on your computer. Just make sure the taskbar icon is indeed the MSE icon. If it's a green shield with a white check I wouldn't recommend clicking it. If you see that, I'd suggest booting into safe mode with networking and downloading MalwareBytes anti-malware and run a scan. You should be OK though, it seems the scareware is in the MSE database, so it should take care of it.

» Thu Dec 16, 2010 1:29 pm

OK so stupid me thought Elessar_VPR was the main KR guy. He hasn't been active for a year on these forums, and his last youtube login was a month ago. However, I can't believe I forgot this, Ionis is the guy who lead the KR thing, and he's actually pretty active. Last login was 2 or 3 days ago. I'm going to send him a PM and see if I can get more info.