Virus!

So the past 2 days I've come to the website, I've been hit with a virus. The root site isn't weezer.com so I think it's advertisements, but you guys need to look into this. The virus is "exploit redkit exploit kit" or something like that.

0 members like this

▶ Reply to This

Replies to This Discussion

Permalink Reply by AF on January 30, 2013 at 9:25pm

Google searching for "weezer.com" still puts the "This site may harm your computer" message under the link, and Firefox still puts up the "attack site" barrier before I can access the site. I wonder if perhaps those two things will linger for a while after the problem is fixed though.

I don't know if it makes any difference regarding the attack messages, but the following CSS file used by this site still refers to the header image "HeaderClinch3a.jpg" hosted on both the domains riverscuomo.com and weezerpedia.com:
http://static.ning.com/weezerofficial/instances/css/theme-982_13596...

The RC.com version is referenced in this part of the CSS:

body{background:#26273C url(http://riverscuomo.com/HeaderClinch3a.jpg?xn_version=201212142055) center top no-repeat;}

which makes me think it must still be hiding up there at the top of the page somewhere.

The weezerpedia-hosted copy appears to be being used as a background in the little box at the top of the posts on the main page (where I think the "Karl's Korner" image used to be).

Those two copies of the image seem to be redundant (RC.com version) or in the wrong place (weezerpedia.com version).

▶ Reply

Permalink Reply by karl koch [karlophone] on January 31, 2013 at 6:54pm

hey thanks AF - i THOUGHT i had replaced the background image (that was the riverscuomo.com thing) with my new (identical) header (hosted elsewhere). But i realized later, i accidentally replaced the karls corner image with it and didnt even notice?!? what a spaz, sorry. After more tweaking, NOW i believe were good. everyone do a lil cache refresh and see if theres still a problem. i think we are finally past this mess.....

▶ Reply

Permalink Reply by AF on February 1, 2013 at 8:18pm

No worries. I haven't got any "intrusion alert" messages the last couple of times I've logged onto the site, so hopefully that means it's all cool now.

There is still something weird with the header though, different to how it was before. There is the proper header picture (the one hosted on weezerpedia.com) which is set as the body background in the CSS, but there is another copy of that image over the top of it which makes the spacing all mucked up and looks wonky. This second version is in the pages' HTML rather than something in the CSS file. The code is:

<div id="xg_masthead">
<h1 id="xg_sitename" class="xj_site_name"><a id="application_name_header_link" href="/"><img src="http://api.ning.com:80/files/yPWOjLyPfIe-w6NLKDiDNK7vhZHd9TLEnTIU4vFK8eYxWgVg8xqUGPT4vKzSdYe9i6wm9B5dpmq7BiJQcoqE3WIEVsqLsNOW/HeaderClinch3a.jpg" alt="Weezer"></a></h1>
<p id="xg_sitedesc" class="xj_site_desc"></p>
</div>

This is just a weird extra header image in a DIV over the top of the existing one, and I can see the weezerpedia copy poking out from underneath it. It definitely didn't look like that in the past. If you want any clarification about what I'm talking about, just let me know. I'm not sure how well I'm explaining what I mean.

▶ Reply

Permalink Reply by Lion on the floor (natkat) on February 3, 2013 at 6:33pm

Still shows up on my computer that "this site may harm your computer" and can't easily log on. I have

Mac/apple products . Haven't really come on here since this mess and only way I am posting this now is via =w= app which is horrible/ painful to use and seems to keep me logged on when I'm not. So with regards to apple product users not sure if its just me but still have the "virus" issue :'(

▶ Reply

Permalink Reply by G Foo Chombey on February 3, 2013 at 8:19pm

I didn't clear my cache, but just now I had no attack site warning. Also the background is a different color blue. I like the new blue, but it doesn't match the banner.

▶ Reply

Permalink Reply by Lion on the floor (natkat) on February 4, 2013 at 7:33pm

Attack site warning is gone through direct access but still there through google...

▶ Reply

Permalink Reply by AF on February 4, 2013 at 8:23pm

I believe a site stays on the Google list (which Firefox also uses) until the site's admin contacts them to be re-tested.

http://support.google.com/webmasters/bin/answer.py?hl=en&answer...

▶ Reply

Permalink Reply by karl koch [karlophone] on February 7, 2013 at 3:53pm

hi -

sorry this has taken so long. the issue im waiting on is a snag with the google webmaster tools verification process. i should have the answer very soon and then i can get the site verified and all clear finally.

AF - good call seeing the "dual" header. another perosn was helping me and i think we both tried to fix the header problem at the same time, and so, we both put one up in different ways in the css. now im not sure which one to delete haha

-karl

▶ Reply

Permalink Reply by AF on February 8, 2013 at 12:23am

No worries. :) I'm pretty sure the weezerpedia-hosted image is the one that's in the right place. That's where it had always been before.

As G Foo Chombey mentioned, the background colour of the site has changed too. It used to be "#26273c" to match with the header, but now it's "#1b1a3c" which doesn't match properly.

▶ Reply

Permalink Reply by Lisa on February 9, 2013 at 6:23am

I wanted to report that around the same time the other weirdness started, some elements stopped working on the iPad. I can't get the "like" (heart) buttons to work, or the "more" button at the bottom of the "recent activity" column on the left side of the homepage.

Thanks for working to fix the warnings!