JREF triggering Avast.

[steve s]

For the last couple of days, whenever I visit the JREF site it triggers my Avast software to put up the following warning...



Is JREF's site infected? This doesn't have anything to do with my computer, does it?

Steve S

 

[Blue Mountain]

No, it's not the JREF itself: the URL is cdn-s3.cogmatch.net. "cdn" usually means "Content Distribution Network," which is a set of geographically disperse computers designed to deliver content (primarily high-bandwidth items such as pictures and videos) to end users. "s3" may be a reference to Amazon S3, a cloud hosting provider.

Do you get this error when going to JREF's main page at www.randi.org, or the forums at forums.randi.org? The two sites are served by different computers. I've looked at all the files sent by both "www.randi.org" and "forums.randi.org" and none of them contain a link to cogmacth.net, although I'm running an ad blocker and it may be an ad that's causing your browser to want to get content from them.

As far as I can tell the JREF website is not infected, but there may be an issue with a server run by a company that JREF uses to serve advertising.

 

[steve s]

Thanks for the info. It happened while accessing the forum page. And no ad appeared in the banner, so that's what probably was blocked. It also happened at a graphics site I frequent. No other tabs were open.
What's odd is that it has never happened before, and now it's happened several times in as many days.

Steve S

 

[smartcooky]

For the forum admins,

This has been a known problem on vBulletin (which I believe is the software this forum is running on). It can mean that some header templates have been hacked, and "iframes" with potentially malicious URLs may have been installed.

We had a a similar problem at rugbyrefs.com and this is what was done to fix it...

1, Check that there are no unfamiliar admins
2, Check Control panel log for unfamiliar activity

If no & no, probably safe,

If yes:

1, Ban the user & their IP (Need to get the IP from the CP Logs)
2, Delete the /install folder
3, Search templates for "biz", "derpina" & "iframe". Delete any unfamiliar.
4, Look in all your header templates at the bottom for a weird huge script, if there, delete it.
5, Check plugin manager, look at top for a script called "init_startup" delete it.

Lastly probably pays to upgrade/Reinstall all your VB files to ensure no other scripts that have not been found are still lurking.

 

[Blue Mountain]

For the forum admins,

This has been a known problem on vBulletin (which I believe is the software this forum is running on). It can mean that some header templates have been hacked, and "iframes" with potentially malicious URLs may have been installed.

<snip>

I did another test, this time disabling my ad blocker. Using Firefox's "Save page" feature, which has an option to save all content (HTML, CSS, images, javascript, etc), I looked through the resulting file set for "iframe" and found only two references, neither out of the ordinary: one in a Yahoo javascript library, and the other in Google Analytics code.

So from that simple test it appears the forum software is secure. Also, Steve's description of the symptoms--an empty ad where he was expecting one, and the fact it happens on another site--points to something dodgy on the part of the ad servers. Which is outside of the forum's control.

That's one of the reasons I run JavaScript blockers and ad blockers. There's just too much untrustworthy crap out there on the internet (I'm referring to practices as opposed to content, although there's no shortage of dodgy content as well) for me to feel safe while surfing with a wide open browser.

 

[Darat]

No indications this is a problem with the JREF servers or Forum software.

 

[jj]

I've gotten the same warning, every time it's been due to an advertisement selected for the page top.

This is why it goes away, too, when that advert is no longer pushed at the page.