Malware Warning on the website

Troubleshooting
Post Reply
VK RAMAN
Posts: 4962
Joined: 03 Feb 2010, 00:29
Location: U.S.A
x 14
Contact:

#1 Malware Warning on the website

Post by VK RAMAN » 23 Apr 2014, 19:34

I am getting following message when I use Google chrome to reach rasikas.org:

The Website Ahead Contains Malware!
Google Chrome has blocked access to http://www.rasikas.org for now.
Even if you have visited this website safely in the past, visiting it now is very likely to infect your computer with malware.
Malware is malicious software that causes things like identity theft, financial loss, and permanent file deletion.

Anybody else has this occurring.
0 x

vasanthakokilam
Posts: 10908
Joined: 03 Feb 2010, 00:01
x 8
x 36

#2 Re: Google Chrome Vs Rasikas.org

Post by vasanthakokilam » 23 Apr 2014, 19:54

Yes, several people have reported this. It happens with both Chrome and Firefox. Srkris has been notified.
0 x

srkris
Site Admin
Posts: 3429
Joined: 02 Feb 2010, 03:34
Location: London, UK
x 10
x 28
Contact:

#3 Re: Google Chrome Vs Rasikas.org

Post by srkris » 23 Apr 2014, 22:38

The issue is now fixed (the warning was correct and there was malware on the site) and google has been alerted to review the message, but the warning message itself will continue for the next few hours until google reviews the site.
0 x

VK RAMAN
Posts: 4962
Joined: 03 Feb 2010, 00:29
Location: U.S.A
x 14
Contact:

#4 Re: Malware Warning on the website

Post by VK RAMAN » 23 Apr 2014, 23:25

Thank you Ramakrishnan for your prompt action and fixing the problem. I believe many of our members cut and paste Urls for websites without verifying the genuineness of the website. A guidance to the rasikas what to look for in a website before giving the urls will help the rasikas and protect our forum safety.
0 x

Pasupathy
Posts: 3940
Joined: 26 Jan 2013, 19:01
x 34
x 27

#5 Re: Malware Warning on the website

Post by Pasupathy » 24 Apr 2014, 02:54

Thanks, srkris, for quick action.
0 x

arasi
Posts: 15747
Joined: 22 Jun 2006, 09:30
x 357
x 188

#6 Re: Malware Warning on the website

Post by arasi » 24 Apr 2014, 03:34

Prompt action indeed, srkris! Thanks.
After losing what I typed last night, I will retype again, and try to catch up with Cleveland!
0 x

VK RAMAN
Posts: 4962
Joined: 03 Feb 2010, 00:29
Location: U.S.A
x 14
Contact:

#7 Re: Malware Warning on the website

Post by VK RAMAN » 24 Apr 2014, 07:40

Yes, No more warning from Google Chrome. Our Website works in Google Chrome also. Thanks Ramakrishnan.
0 x

Nick H
Posts: 8776
Joined: 03 Feb 2010, 02:03
x 443
x 228

#8 Re: Malware Warning on the website

Post by Nick H » 24 Apr 2014, 13:13

I never got a warning... I'm feeling left out!
I believe many of our members cut and paste Urls for websites without verifying the genuineness of the website. A guidance to the rasikas what to look for in a website before giving the urls will help the rasikas and protect our forum safety.
Perhaps because I use a bookmark to access the site and the URL is always the same?

Even though I am an ex IT professional, the world of viruses, malware, etc, has grown enormously since my retirement from active duty, and I am but a child in the face of it.
0 x

rajeshnat
Posts: 8164
Joined: 03 Feb 2010, 08:04
x 62
x 152

#9 Re: Malware Warning on the website

Post by rajeshnat » 24 Apr 2014, 13:44

NickH
In chrome and firefox it came and in IE it did not come(for one day I liked IE) . This issue was in laptops
On the mobile side , I did not have this problem of malware in my android mobile. Perhaps you were either browsing for the whole day in either a mobile or tablet - that is why you did not get it

Srkris
I will send a personal mail , possibly we should do few things . There are few out there for sure who donot like this site , we should have more security precautions.
Last edited by rajeshnat on 24 Apr 2014, 16:34, edited 1 time in total.
0 x

Nick H
Posts: 8776
Joined: 03 Feb 2010, 02:03
x 443
x 228

#10 Re: Malware Warning on the website

Post by Nick H » 24 Apr 2014, 14:51

I never browse on the phone, except for vital info like train times, when away, and I don't [yet] have a tablet.

I use Firefox, and Linux. That might make the difference
0 x

vasanthakokilam
Posts: 10908
Joined: 03 Feb 2010, 00:01
x 8
x 36

#11 Re: Malware Warning on the website

Post by vasanthakokilam » 24 Apr 2014, 21:32

Just so everyone is on the same page. This is the sequence of events.

1) Somehow malware of sorts gets into the server
2) Google, in their regular scan of the internet, detects this and adds the site to this 'malware infected site' list.
3) It is upto the browsers to check this list maintained by Google. Firefox and Chrome do it and not IE. I do not know about safari or opera. May be they do not.

Srkris, since there was a real malware problem, can you characterize what it is so members can assess if they need to do anything in case they got onto the site before the malware was removed?
0 x

eesha
Posts: 352
Joined: 30 Apr 2009, 23:15
x 5
x 4

#12 Re: Malware Warning on the website

Post by eesha » 24 Apr 2014, 22:36

VK RAMAN wrote:Thank you Ramakrishnan for your prompt action and fixing the problem. I believe many of our members cut and paste Urls for websites without verifying the genuineness of the website. A guidance to the rasikas what to look for in a website before giving the urls will help the rasikas and protect our forum safety.
When a member cuts and pastes a URL of a website that has malware and posts a message and when other members click on that URL, the PC / laptop of those members can get affected. This will NOT affect rasikas.org server

This malware has affected due to vulnerability in FTP service that runs on the server. The malware is injected into the server using this security vulnerability to hijack htm and php files to hijack the pages to a different destination.

We faced this issue with sangeethapriya server many years ago. I manually removed the malware code from all the infected htm, php files and then uninstalled FTP service

And that ended the problem

I find that rasika.org server accepts FTP connections. srkris should first disable, ideally uninstall this service. SFTP is nowadays preferred over FTP
0 x

srkris
Site Admin
Posts: 3429
Joined: 02 Feb 2010, 03:34
Location: London, UK
x 10
x 28
Contact:

#13 Re: Malware Warning on the website

Post by srkris » 24 Apr 2014, 22:42

There was an index.php file present on the server (not placed by me) that seemed to redirect the users to another website (which supposedly had some malware). Since google regularly scans the site, it found this and placed a warning. I got an email from google which described this, so I located the file and deleted it.

Since we have faced such issues in the past as well, I will find out if we can enable Secure Sockets Layer (SSL) -- the only disadvantage of that would be its effect on performance i.e. the site would load slower.

Eesha thanks for that suggestion, I will look into it right away.
0 x

eesha
Posts: 352
Joined: 30 Apr 2009, 23:15
x 5
x 4

#14 Re: Malware Warning on the website

Post by eesha » 24 Apr 2014, 22:51

srkris: enabling SSL will not help and is not required

the vulnerability is thru FTP service, as mentioned earlier

disabling FTP will solve

also disable telnetd if that is running
0 x

eesha
Posts: 352
Joined: 30 Apr 2009, 23:15
x 5
x 4

#15 Re: Malware Warning on the website

Post by eesha » 24 Apr 2014, 23:05

And another thing:

- change your root password mmdtly
- do not save your root password in your SFTP client software (I am saying SFTP because, I assume you will disable FTP and start using SFTP, if not done already)
0 x

srkris
Site Admin
Posts: 3429
Joined: 02 Feb 2010, 03:34
Location: London, UK
x 10
x 28
Contact:

#16 Re: Malware Warning on the website

Post by srkris » 24 Apr 2014, 23:34

Done. Thanks Eesha again for the suggestions.
0 x

vasanthakokilam
Posts: 10908
Joined: 03 Feb 2010, 00:01
x 8
x 36

#17 Re: Malware Warning on the website

Post by vasanthakokilam » 25 Apr 2014, 01:36

I feel better already. Thanks eesha and srkris
0 x

eesha
Posts: 352
Joined: 30 Apr 2009, 23:15
x 5
x 4

#18 Re: Malware Warning on the website

Post by eesha » 25 Apr 2014, 07:02

srkris wrote:Done. Thanks Eesha again for the suggestions.
I find that FTP process is still running. Please stop it and remove it from start up process list
0 x

srkris
Site Admin
Posts: 3429
Joined: 02 Feb 2010, 03:34
Location: London, UK
x 10
x 28
Contact:

#19 Re: Malware Warning on the website

Post by srkris » 27 Apr 2014, 11:56

Hi Eesha, apologies for the delayed reply. I have checked this with the host and they say we still get the login prompt but it wont allow login. I have tested this and find that its correct.
0 x

Post Reply