Virus threat

[DemonGoddess]

The site is still showing as tested clean by StopTheHacker.

I've submitted it for review to Google to get us removed from the blacklist. As this can take time, I ask that you be patient. In the meantime, yes, you will see warnings because we're on the blacklist. It's irrelevant to them that the site is actually safe. That's something they'll determine themselves.

The thing is, what they're calling "suspicious code" is the banner invocation script. It's exactly as it's supposed to be, no changes at all.

[Guest Reader_1962]

When trying to enter the site a page comes up saying that this site is an attack site for malware. This message comes from Google, but Norton Security does not detect any threats.

Hi 3-1-13 and i got blocked messages from both google and bing when trying to get here. They say still you have malware badware problems.

[pittwitch]

There's a news post forthcoming that will explain everything. Hold tight.

[Guest BlackFalcon]

I'm getting the warning screen as well.

[Guest Argoroth]

What is the current listing status for adult-fanfiction.org?

Site is listed as suspicious - visiting this web site may harm your computer.

Part of this site was listed for suspicious activity 23 time(s) over the past 90 days.

What happened when Google visited this site?

Of

the 715 pages we tested on the site over the past 90 days, 496 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2013-03-01, and the last time suspicious content was found on this site was on 2013-03-01.

Malicious software is hosted on 2 domain(s), including

edithfilms.ch/

,

djiki.info/

.

This site was hosted on 1 network(s) including

AS36444 (NEXCESS)

.

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, adult-fanfiction.org appeared to function as an intermediary for the infection of 9 site(s) including

adultfanfictionnet.net/

,

readershavechosen.com/

,

greywolfenterprise.com/

.

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.

How did this happen?

In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

This means that it is an ad that is causing the site to be blacklisted by google, and the problem is not with AFF. I would probably recommend informing the hosts and/or stopping ads from their sites (especially adultfanfictionnet.net, since it seems doubly suspicious). That's just my personal opinion, as well as how I read the information on the Chrome warning info page.

[Guest Argoroth]

Sorry read it wrong. It seems that it is edithfilms.ch and djiki.info that are hosting the malware, so they are the ones that should be blocked.

[DemonGoddess]

As I explained before, the files that google is seeing on AFF itself as being suspicious, are actually the banner invocation code, which is unmodified from the time it was added to the site.

The problem right now is the black list and being ON the black list. As I've submitted AFF for review for removal, until we get removed from it, that page will continue to display.

[Guest Crimson1of1Crimson]

I want to say thank you, DemonGoddess061 for repeatedly answering everyone's questions about what happening with the site. When this started happening to me I found this thread and your answers cleared up any of my questions. I only now want to tell you that yes its still happening, I am using chrome and AVG. I understand that sometimes it's not you being slow but someone else and you just have to answer questions, so thanks to you and all of the other tech support people working on this to make sure we as readers are safe.

[DemonGoddess]

You're welcome! As to tech support, you're looking at it. Me, myself, and I

At this point, it's a matter of time now. Google's Webmaster Tools are showing NO issues in my control panel for the site. NONE. So, I expect we'll be removed from the blacklist today some time.

[Aysha c.c.]

Well I'm no longer getting threat warnings from my antivirus, so thanks for taking care of everything. I'm glad things are getting back to normal. I'd hate to see anything damage the reputation of our site I truly cherish it and the outlet. It provides for all of us.

Thanks again for all your hard work.

[KDeheart]

So Im confused, did any of the antiviruses that detected threats just say they did because google had this site blacklisted or was there actual malware being downloaded?

Because it sounds to me like everything, browsers and AV programs, are relying on google blacklist and not actually detecting anything themselves for website security.

Anyway, glad AFF is no longer blacklisted. Looking forward to new stories again

Edited March 3, 2013 by KDeheart

[Guest dazedandconfuse]

FYI, starting Feb 25th to March 1st everytime I visited AFF my PC got hit by some sort of virus attack (I have some of the reported threats below for your attention.) I wanted to be sure where it was coming from so after I cleaned my PC of these threats and surfed the web nothing happened but when I viewed AFF during that time it would happen again. It was only when I visited AFF it would happen. I just thought you might want to check this out. Did you find any of these threats when you scanned the site? I just hope this doesn't happen again today, it's very troublesome. Thank you! I don't mean to annoy you and appreciate all your hard work.

Exploit:Java/CVE-2012-1723

Exploit:Java/CVE-2012-0431

Exploit:Java/CVE-2012-0422

Exploit:Java/CVE-2012-1723!jar

Trojan:Win32/stoberox.B

Trojan:Win32/FakeSysdef

[BronxWench]

My AV never tripped, nor did Spybot or MalwareBytes. I've been all over the site throughout this incident, forum and archive, and the only thing that I saw was Google making much ado about nothing. Chrome was panicky, but I never had any infection, infestation or even attempted incursion.

So, I'd say that my AV at least isn't relying on Google's blacklist, which makes me feel better, since I'm beginning to lose a little faith in Google's blacklist.

[DemonGoddess]

Only thing I can think of that may have tripped your AV is either a false positive, or something piggybacked in on one of the banners, or there was a spoof of the address elsewhere with the viruses embedded. Without seeing the exact path of where/how it attempted to download for you, I couldn't say either way.

Although, I will say some of the warnings listed adultfanfictionnet.net, which is a parked domain. No files associated WITH the domain (I would know this because we own the domain and have nothing at all on it). Which leads me to believe a spoof of the web address occurred.

[Guest Studentresearcher]

I find it interesting that the subsites are treated differently from the main site--anime.adultfanfiction.com is now considered clean by Google Chrome, whereas the main site still isn't.

(I also noticed that the claim of passing infection from another site claimed that same site passed an infection to Pixiv. That implies there was at least one infected ad at some point in the past, but it was widespread enough that it's probably been purged at this point.)

[DemonGoddess]

we've never dealt with Pixiv, so wouldn't know.

Google actually treats the subdomains as separate sites, even though they're all the same site, served by the same database.

[Guest kula]

I'm getting the same message from Chrome

[DemonGoddess]

Chrome is the only browser now kicking a warning, and not for most of the site. That is because of Google's blacklist, which the site is still on. Once they finish removing the site from the blacklist, the warning will disappear.

[Guest Robin Mask]

Chrome is the only browser now kicking a warning, and not for most of the site. That is because of Google's blacklist, which the site is still on. Once they finish removing the site from the blacklist, the warning will disappear.

This is good to know. I've finally been able to get back onto the site, but parts of my profile page won't load without the 'malware warning' on Chrome.

If I were to use Internet Explorer would it be safe to use? It sounds like the site's actually fine, so I imagine it should . . .

[kagome26isawsome]

I have been using Internet explorer for a while since i cant use Chrome..the Malware warning doesnt show up so yea use IE if you can

[DemonGoddess]

Chrome is only kicking at the root directory and the member login now. Within all the other subdomains, it's not. Not only that, Google removed us from the blacklist. So, I guess I have to email them AGAIN and ask them to remove those warning redirects as they're not valid and do not apply to the site.

[SladinForever]

The only thing I'm still experiencing with Firefox is the bookmark icon still appears as the red square with a white circle and red line in it, which was the warning symbol for me. I deleted the bookmark and then re-bookmarked the page, but that didn't fix the symbol. What should I do to fix it?

[DemonGoddess]

clear your cookies. You can manually remove any of the site cookies by searching .adult-fanfiction.org and deleting them.

[Guest Shadowstarprincess Pridest]

im having trouble posting new chapter on both chrome and explorer

[BronxWench]

@Shadowstarprincess Pridest: What exactly is the problem?

Edited March 6, 2013 by BronxWench