Retro Video Gamer

Today when I visited RVG, I got to this page first...

(http://www7.pic-upload.de/17.05.13/53oehhm2gzsh.jpg) (//http)

"Malicious software warning"

"A visit to this website can be malicous. We have reports of this site distributing malware.

Opera strongly warns you not to go there".

Laird takes the day off and the whole place goes to hell! 

The 360/I.E browser throws up a warning message if i put RVG into Goggle, so just WTF is going on here.I'm not using a PC so nothing to infect as such, 360 browser won't even let you download files, but has the site been 'infected'? can someone please explain...


I assume way these smart filters work is someone reports a site as having malware of some type, they put a warning up related to link etc, until investigation is done/site clear of malware or clear it never had it in 1st place?


would appreciate some words from admins as to status of this site..

It's been reported and being looked into..this to me is a false / positive , it's possible that the code running on the main page is fooling the browsers interpretation of a malware etc.. I've reported this thread to the main admin

It's gone now. Has RVG staff had enough time to use its malware to rob us of all our savings?

Cheers for the report. Yandex and AVG seem to not like certain script code we use on the frontpage, they see it as a malware injection and I can assure you all that this is not the case. We do regular checks and continue to do checks and I will look into getting this code change so we can avoid this in the future.

Quote from: "zapiy"Cheers for the report. Yandex and AVG seem to not like certain script code we use on the frontpage, they see it as a malware injection and I can assure you all that this is not the case. We do regular checks and continue to do checks and I will look into getting this code change so we can avoid this in the future.

From my PC days AVG, ohhh that was a wretched creation, warn you about stuff that was harmless, but the real nasty stuff? come on in!!! and using it on a laptop? bloody hell, on yer knees and crawl.

The warning was gone last night, but is back now.

Quote from: "108 Stars"The warning was gone last night, but is back now.

Still clear on I.E smart screen.

Will look into it guys once I have finished work.

This sometimes happens even with perfectly legitimate sites.  I'm not sure why it happens but it is something that I've seen before.  Somehow a good page gets tagged this way.

Quote from: "TrekMD"This sometimes happens even with perfectly legitimate sites.  I'm not sure why it happens but it is something that I've seen before.  Somehow a good page gets tagged this way.

I.E also had Racketboy's SEGA pages marked up as Malware yesterday, clear today, so is somewhat confusing.

Right  now RVG is not tagged any longer in Opera.

Yeah I don't understand it all either. All I know is we are clear of dodgy infections.

I get web toolkit attacks, every attempt to visit, using Norton.

What page is this on?

I am getting the warning again.

This was funny at first, but right now I am beginning to wonder if your site has not been infected with some malware you are unaware of. You make the warning disappear, but it comes back, so I presume there must be something going on you are unaware of...

I am looking into it. From what I can gather is someone may have a signature that's got a malware link.

BTW I am not making anything disappear. That's the weird thing about this, how does it come and go. When you get it please get the page details from the warning you get. Cheers.

My attack is coming from the home page. The attacking computer is corporate.aftabcurrency.net

Ok when you get that can you view more details and send to me.

I have removed loads of site features and stopped certain code for signatures.

Any change?

I don't know the cause, my link is directly to the forum overview, and I don't see any details, just that the site is "blacklisted"

In non-technical terms, just what exactly is this malware doing? whats the risk?
(basically WTF is the malware doing? key logger or what?)

just checked with I.E smartscreen, link still clear.

Malware can be everything that's bad for your computer. Key loggers for example as you said. Mal stands for malicous, can be any kind of viruses I guess.

I told zapiy that him using an Amstrad CPC to run the forum would only ever end in tears but he just wouldn't listen. 

This is extremely hard to pin down. There is no knowing what the threat level is but any threat level is more than we want. Like I have said I have scanned the main files and there is nothing in the files so there must be a link somewhere.

We will find it, what annoys me about these detecting program's is they say you have a threat but don't pinpoint it.

Had a keylogger on my PC years back, plus those 'fake' anti-virus things.assume here only PC's could be effected? the web browser on 360 (which i'm using) does'nt allow download of anything it seems.tried to download music, pictures etc, it said oh no!

I don't get any warnings of any kind on either of my PC's using Google Chrome with Spybot and MS Security Essentials.

Quote from: "zapiy"This is extremely hard to pin down. There is no knowing what the threat level is but any threat level is more than we want. Like I have said I have scanned the main files and there is nothing in the files so there must be a link somewhere.

We will find it, what annoys me about these detecting program's is they say you have a threat but don't pinpoint it.

You can try communicating with the manufacturer of whatever software is flagging the site to find out.  Sometimes, there is nothing wrong at all and they are flagging the site for no reason. 

I myself have not encountered anything of malware, spyware, Trojan activity of any kind or pop ups or security breach messages at all on the forum when loading (all tested will a clean cache), browser Firefox 20.0.1, internet explorer 10 x64 bit, security software: Zone Alarm Security 2013 pro edition, plus malware bytes 1.75 pro

tablet devices used
Ipad 2 , safari, Perfect browser (latest versions)
Android tablet 10" and Arcos Gamepad tablet both running, opera Mini / mobile (latest versions)
LG p990 smart phone using it's in house browser and Opera Mobile (Latest versions)

Like i say there was a 'blip' on I.E on 360 few days back, smart screen filter gave a warning site had been reported for Malware, but that's gone now.

Friend of mine years back (techno-savy person) had spate of bad luck, via Firefox security update his laptop picked up a keylogger, he had PC wiped etc said 'I'll be bloody careful from now on!' (famous last words) then weeks after, fell for a scam email claiming to be from his bank, asking him to update his security profile, all they needed was current password etc etc, which he gave, thought no more of it until out shopping with the missus next day, went to pay, no money in account, been cleaned out by someone in USA!.

Could'nt believe he fell for that old scam, but just proves enough do.

Quote from: "Greyfox"I myself have not encountered anything of malware, spyware, Trojan activity of any kind or pop ups or security breach messages at all on the forum when loading (all tested will a clean cache), browser Firefox 20.0.1, internet explorer 10 x64 bit, security software: Zone Alarm Security 2013 pro edition, plus malware bytes 1.75 pro

tablet devices used
Ipad 2 , safari, Perfect browser (latest versions)
Android tablet 10" and Arcos Gamepad tablet both running, opera Mini / mobile (latest versions)
LG p990 smart phone using it's in house browser and Opera Mobile (Latest versions)

from personal (past) exp, if there's something there, Malware Bytes will find it-bought a ye olde PC off mates mother, just for olden day PC gaming, thought i'll run Malware Bytes, just to be safe, mate says he's cleaned PC, the amount of high risk threats it found (looks like she visted some 'curious' sites in her time online, lol), which other Anti-Virus scans failed on, convinced me of it's worth.

When I'm not out saving the world, working on wonderful retro styled graphics, taking photographes, making stuff and netting, posting, chatting and all that wonderful stuff, I've a certification here on computer and hardware maintence and repair, Microsoft Xp trouble shooter, technical support on both software and windows internal, and virus and malware system treatment and root kit Trojan suppression = I know bit or two on all this jazz, sure done 2 laptop remasters this weekend, handy number, especially with the Hiren boot CD collection, ohh did I mention windows Xp, vista, win7 system Password removal , malware bytes is excellent and they also have root kit Trojan remover now..free of charge, since 9/10 your looking at a reformat in clean install from one of those nasty root kits..

I am the same, i have no issues..

Nor do i see any here.

https://safeweb.norton.com/report/show? ... amer.co.uk (https://safeweb.norton.com/report/show?url=www.retrovideogamer.co.uk)

Well, now WOT is also giving poor ratings to the site.  Not sure what is going on.  It says the site has been listed as having malware by a site called Yandex.
http://yandex.com/infected?l10n=en&url= ... amer.co.uk (http://yandex.com/infected?l10n=en&url=retrovideogamer.co.uk)

Whatever the problem is it must be solved somehow. When the site is flagged on major browsers no new visitors will come.

Yandex still seems to be listing it as potentially harmful site. 

That's my issue here. No major site or company is listing the site. Only a Russian search engine with connections to Opera and WOT.

But rest assured I am removing stuff to see where the issue is and then bring everything else back.

What annoys me is I have registered with Yandex and the only page with a so call issue is the frontpage. So far today Yandex had told me the site is clean and has an issue twice. How is that possible. Do viruses play hide and seek now lol.

Quote from: "zapiy"That's my issue here. No major site or company is listing the site. Only a Russian search engine with connections to Opera and WOT.

But rest assured I am removing stuff to see where the issue is and then bring everything else back.

What annoys me is I have registered with Yandex and the only page with a so call issue is the frontpage. So far today Yandex had told me the site is clean and has an issue twice. How is that possible. Do viruses play hide and seek now lol.

It's a living smart virus!  It knows where to hide!   

Lol and of its there zapiy the huntsman is coming for it. Lol

Our hosts have now completed a full check of the server and it found no issues..

Also today at http://sitecheck.sucuri.net/results/ret ... amer.co.uk (http://sitecheck.sucuri.net/results/retrovideogamer.co.uk) we are clean..

Unsure what was causing it but it would be more down to good code be confused as bad code.

Glad to hear it is solved, though. 

Glad to hear it. Opera/Yandex still flag RVG as scam, but at least with Opera's vanishing market share that will not have a big impact.

You sure? Not for me those sites don't? Can you send me the link to these please fella.

What link? I just get a warning whenever I visit RVG, like on the pic I posted at the beginning of this thread, and a red warning beside the URL-field all the time.

I suppose Opera is working with Yandex, and Yandex  still has RVG blacklisted.

Okay, here's the site you reach when you click on the Yandex logo in the warning...

http://help.yandex.com/search/?id=1111971 (http://help.yandex.com/search/?id=1111971)

Ok i have asked those sites to recheck us now and this should only take a couple of days apparently.

Cheers all.

Hopefully this gets resolved.

I received a Norton warning that blackhole toolkit was attacking my computer. Homepage visit today.

There must be an error. The site was offline for a while and now I don't get any warnings anymore.

I was happy too quickly, in the last session there was no warning, but it's back. So the wait for Yandex to delist RVG continues.

I am on it and have recruited so IT help on this. Sadly I can not afford to pay for someone to help us so I did some hunting and found someone willing to help us.

Hey Zap, any updates on this?  WOT still has the site in red (listing it as a bad site). 

Have done a thorough scan and no issues.

Without sounding brash, who and what is WOT and does anyone really use it?

Quote from: "zapiy"Have done a thorough scan and no issues.

Without sounding brash, who and what is WOT and does anyone really use it?

WOT is an abbreviation for Web Of Trust.  Take a look at their site:  WOT (//http)

You can see about how many people use it on there.  About 81 million downloads of the browser extension to date.  So, I'd say that people do use it.

Ok so we need to look at this closer and see what's what.

Trouble is, the scan software finds nothing. 90% of all online scanners say we are safe so which do we believe.

Quote from: "zapiy"Ok so we need to look at this closer and see what's what.

Trouble is, the scan software finds nothing. 90% of all online scanners say we are safe so which do we believe.

But WOT works with the site that had RVG black listed.  It is possible they haven't updated their rankings.  They also use user rankings but I doubt that is the problem. 

Yeah i am on it. I simply can not afford to pay a server tech to work on it.

Well, it now seems Norton Internet Security is branding the site as a dangerous site as well.  I just got a message from Onthinice on another forum that Norton will not let him log on to RVG.  Here is what he sent me:

Hey! I tried to get on RetroVideoGamer today and a little box from my Norton Internet Security, said the site is unsafe, two threats detected.

I asked him to get me a screen shot.  Could someone be doing this to the site deliberately? 

Quote from: "TrekMD"Well, it now seems Norton Internet Security is branding the site as a dangerous site as well.  I just got a message from Onthinice on another forum that Norton will not let him log on to RVG.  Here is what he sent me:

Hey! I tried to get on RetroVideoGamer today and a little box from my Norton Internet Security, said the site is unsafe, two threats detected.

I have NIS on my PC and have had no such security alert/s from it.

QuoteI asked him to get me a screen shot.  Could someone be doing this to the site deliberately?

I think we both know that's a yes. 

Neither my virus scanner (Symantec Endpoint Protection) nor my firewall (Comodo) have said anything about the site having issues.  The only place I got something was with WOT. 

Quote from: "TrekMD"Well, it now seems Norton Internet Security is branding the site as a dangerous site as well.  I just got a message from Onthinice on another forum that Norton will not let him log on to RVG.  Here is what he sent me:

Hey! I tried to get on RetroVideoGamer today and a little box from my Norton Internet Security, said the site is unsafe, two threats detected.

I asked him to get me a screen shot.  Could someone be doing this to the site deliberately?

Yes, certain 'people' not happy with ruining a more popular set of Atari/retro gaming sites, but are so
bitter that to this day, years well after the fact, they still like to slip the ol' knife in the back. Why is this
you ask and why after all this time these certain 'people' if you will are still vengent? Simple! Sometimes
when the likes of said 'people' are caught red handed playing the fool by someone clearly on to their
deceptions, the truth of them being revealed destroys them from within so hard that they can't recover.

So their only hope of saving face, is to commit all sorts of nefarious acts, including back stabbing people
with lies and other misinformation on sites that said adversaries of their slander have no ability to defend
or answer to their charges...and anyone else that may try will also share the fate of unreasonable banned
for life status. One must understand, to allow the truth to be told is never a good thing when an entire
site of fools is trying to perpetrate a lie because they were found out for the creeps they really, truly are.

I'm not saying any one is doing such a thing :26:

Again, not accusing anyone,  :4:

Interesting....after posting my previous post in this thread, I wanted to look at my profile and got
the following warning from AVG



This link on retrovideogamer.co.uk is safe for browsing

http://www.retrovideogamer.co.uk/themes/default/scripts/profile.js (//http)


However, we recommend caution while surfing on retrovideogamer.co.uk
 In the last 30 days AVG has detected:
1 active threats
 5 compromised pages


Unfortunately, it does not tell me which pages but you might want to take a look into it Zapiy...

https://safeweb.norton.com/report/show?url=www.retrovideogamer.co.uk (//https)

This shows clear from Norton.


As for AVG, that does not like any iframes and we have a couple on the frontpage. All are good code so i cant help that.

Just got this message. Go to full report and it says all clear. 

That doesn't make sense. 

Partial solution. When I logged in to RVG, my wife's email was still logged on the computer. Attacks came at every page click. I logged out and they quit.

If I search the site as a guest, then no attacks either.

Sounds like it might be browser hijacks from another source then

Tried logging in here last night as mate brought his laptop into work, they've wi-fi in canteen now.He was using Firefox and it gave me a message alone lines of...

'The Web Page you have requested is caterogized as malware and has been blocked by Firefox' (and then:Please contact XXX XXXX-Our company owners support site for more information, cannot give out company name for the legal crap we had to sign).

I am at a loss now...

We are clean here http://sitecheck.sucuri.net/results/www.retrovideogamer.co.uk (//http)

It appears to be false positives.

QuoteA false positive, also known as a false detection or false alarm, occurs when an antivirus program detects a known virus string in an uninfected file. The file, while not infected with an actual virus, does contain a string of characters that matches a string from an actual virus.

A false positive can also occur when a program performs an action, which appears to the antivirus program to be a virus-like activity.

Norton AntiVirus and Symantec AntiVirus Corporate Edition use Bloodhound heuristics to detect virus-like activity.

Examples of such activity can include, but are not limited to, writing to the master boot record of the hard disk, making changes to a system file, or running a custom macro in a program such as Microsoft Word.

False detections, once confirmed, are usually corrected as soon as possible

Well, this is different now.  This is Firefox itself blocking the page and marking it as malware.  I wonder how they ID pages that have malware.  It may necessary to contact Mozilla directly on this one.

I only use Firefox on every PC in the house and i have no issues..

I use Firefox as well and this happened to me once a while back and I just figured it was a fluke.  This was before this became an issue with Norton, WOT, etc.  Firefox does have the ability to block pages it deems unsafe, even if whatever information they use is wrong. 

I think they are all false positives of the scanner sees a string in some code thats similar to a virus string it will flag it..

Quote from: "zapiy"I think they are all false positives of the scanner sees a string in some code thats similar to a virus string it will flag it..

Well, given everything that you've had checked, they may very well be false positive findings that are causing the problem.  It's just annoying because it may be driving folks away from the page.

We had some signatures that were pointing to dodgy sites but they have all gone.

These are something i will look at but if we are showing clean on all the web scan sites then we are clean..

I noticed a ROMs site, ISO Zone, was linked in a recent post on RVG. Not sure if that would be causing th above issue though.

This is fixed, any issues?

When I open the site, WOT no longer gives a warning.  It does not have any real rating for the page, so if folks can give it a good rating that will be helpful.

Good stuff, maybe you could start a new thread for that Eugenio?

Quote from: "zapiy"Good stuff, maybe you could start a new thread for that Eugenio?

Sure thing.