Potential malware injection from smilies in old posts

[JonnyRadar]

Hi guys,

I was just trying to read this post here: _http://cassiopaea.org/forum/index.php/topic,7558.0.html which is "The Emerald Tables of Thoth... and the Zed" from page 22 of "The Work" board.

When I visited the link, I got a malware alert from Chrome (see attached image).

It makes me wonder if there are more posts with content from planetsmilies[dot]com that should be checked? Perhaps you could do a database search of forum posts for that url?

 

[Jacques]

Hi guys,

I was just trying to read this post here: _http://cassiopaea.org/forum/index.php/topic,7558.0.html which is "The Emerald Tables of Thoth... and the Zed" from page 22 of "The Work" board.

When I visited the link, I got a malware alert from Chrome (see attached image).

It makes me wonder if there are more posts with content from planetsmilies[dot]com that should be checked? Perhaps you could do a database search of forum posts for that url?

Hi Jonathan,

I have tried the link in Firefox and it opened without any problem. My AntiVirus did not detect anything.

However since you were speaking about "planetsmile", I did a search on that thread and I did not finf anything about that. No reference, no links.

So I don't understand why you are speaking about planetsmilies. Could it come from your computer ?

By the way, there were no posts in that thread with smilies.

 

[JonnyRadar]

So I don't understand why you are speaking about planetsmilies. Could it come from your computer ?

Hm, I suppose that is possible, thanks Gandalf. I'll do a scan on my machine and see what's up.

Planetsmilies was the domain referenced in the alert message. I assumed that it was a smiley emoticon someone had used in that thread (an external link to an image) that might be the cause of the alert. I didn't want to visit the planetsmilies website itself for that reason...

I'll let you guys know if I find anything locally that's the cause, as to narrow it down...

 

[Jacques]

Planetsmilies was the domain referenced in the alert message. I assumed that it was a smiley emoticon someone had used in that thread (an external link to an image) that might be the cause of the alert. I didn't want to visit the planetsmilies website itself for that reason...

As I added in my previous post, there are no posts in that thread with smilies.

 

[ignis.intimus]

However since you were speaking about "planetsmile", I did a search on that thread and I did not finf anything about that. No reference, no links.

So I don't understand why you are speaking about planetsmilies. Could it come from your computer ?

If you right-click and view source on that page, and search for "planet" you can see where it was inserted. However, it's not displaying on the page for some reason.

If I bring up the link to the actual gif itself, FF does warn me about a malicious site.

 

[Gawan]

Fwiw, I get the same message as Jonathan it loads and the suddenly stops. And it seems that it is an embedded smiley from this website chrome detects and then blocks.

Planetsmilies was the domain referenced in the alert message. I assumed that it was a smiley emoticon someone had used in that thread (an external link to an image) that might be the cause of the alert. I didn't want to visit the planetsmilies website itself for that reason...

As I added in my previous post, there are no posts in that thread with smilies.

That's strange then.

 

[Jacques]

However since you were speaking about "planetsmile", I did a search on that thread and I did not finf anything about that. No reference, no links.

So I don't understand why you are speaking about planetsmilies. Could it come from your computer ?

If you right-click and view source on that page, and search for "planet" you can see where it was inserted. However, it's not displaying on the page for some reason.

If I bring up the link to the actual gif itself, FF does warn me about a malicious site.

I right-click and view the source code and it is there the "planetsmilies". I selected the words before that and I did another search on that thread and I found the words but there is no smilies.

 

[Jacques]

Fwiw, I get the same message as Jonathan it loads and the suddenly stops. And it seems that it is an embedded smiley from this website chrome detects and then blocks.

Well, I have tried it with Chrome and I don't have that message.

The page has loaded without any difficulties.

 

[Jacques]

Could both of you try it again and see if it is ok now.

Thanks

 

[Foxx]

I'm not seeing an error on that page either, but there appears to be an image in this post:

http://cassiopaea.org/forum/index.php/topic,7558.msg53804.html#msg53804

at the very end after "....do-bee-do-bee-do" that is coming from "planetsmilies"[dot]com, which is reported as a malware site (according to google). It's referencing an image that probably doesn't exist anymore, so nothing appears directly on the page, but it can be seen in the HTML source code.

 

[Jacques]

I'm not seeing an error on that page either, but there appears to be an image in this post:

http://cassiopaea.org/forum/index.php/topic,7558.msg53804.html#msg53804

at the very end after "....do-bee-do-bee-do" that is coming from "planetsmilies"[dot]com, which is reported as a malware site (according to google). It's referencing an image that probably doesn't exist anymore, so nothing appears directly on the page, but it can be seen in the HTML source code.

I have just deleted it. ;D

So it should be ok.

 

[Gawan]

Thanks for your efforts Gandalf now it works!

 

[JonnyRadar]

Thanks Gandalf! I see no error now. :)

 

[Jacques]

Thanks Gandalf! I see no error now. :)

And thanks to you Jonathan for letting us know about that problem.