exploit kit?

[Catfish]

hi all,
I'm new here so forgive me if I'm posting in wrong place or violating any rules. Anyways, I clicked on one of the downloads and I was notified by my AV it had detected and blocked a exploit kit. are the downloads from elsewhere? is there anything I should know?

[Catfish]

I do realize it could have been from elsewhere but I wanted some feedback for safety sake

[SE7EN]

well, which download was it... what OS, web browser and antivirus are you running? I am confident in the security of items the staff upload, but there is always that slight % chance of 3rd party malicious actions. I will look into it when I have the above details. Thanks for the information

[Catfish]

Im not exactly sure the download name, I know I should have wrote it down, but I believe it was one of the AD&D's here's the index Roms/Nintendo/NES/USA/. I'm running windows 8 with Norton security its up to date and most likely browsing with internet explorer at the time. Thank you for taking a look.

[Kherr]

We have had malicious code injected into the site through some vulnerabilities in the past, but I know for a fact that the site is 100% virus free atm. If you could give me the direct link where your anti-virus threw up it's red flag, I'd be more than appreciative so I could check into it so I could discuss it with the owner. Thank you for saying something about this so we can squash it.

[SE7EN]

I will give those ADnD downloads a lookover here shortly. I would advise you to consider using more secure AntiVirus and WebBrowsers. While both Norton and Internet Explorer have come a long ways in the past couple years, there are much better alternatives. I would recommend either Google Chrome or Firefox (or one of it's 64 bit alternatives if you have a nicer system, I personally prefer WaterFox) and ALMOST any other AV kit would be better than Norton I would recommend ESET, but even the MS Essentials that comes with Windows is a good FREE alternative.

update: ESET reports clean, I even unzipped them and scanned the folders, then the single files. I have also ran VirusTotal scans on the files and here are the results, all being clean.
1. AD&D_Heros_of_the_Lance

Code: Select all

https://www.virustotal.com/en/file/e487f2a24adc443db35d4502bf98d50a5de0c383b22aaec4f07b5290857a2529/analysis/1367521954/

2. AD&D_Hillsfar

Code: Select all

https://www.virustotal.com/en/file/e84db4b874f5791bc8d6922efcfe8dc6c700d0ee849cb1b69120950ddbbbb3a1/analysis/1367522204/

3. AD&D_Pool_of_Radiance

Code: Select all

https://www.virustotal.com/en/file/b269331470c9a83e7e8fec0263a4739da781ac463f2edd133b447cf4e2726841/analysis/1367521990/

[Catfish]

here's the url and ip address where the attack originated from imbiss-directory.net:8000/lxprmy?fsmrroh=4507480 173.255.200.91 clearly that's not this websites url or ip but at the time I was browsing this website and assumed it came from an attempted pop up. I did have other windows open just surfing new sites.

[SE7EN]

you could open up your browser history, and go one by one through the ones from that timeframe, and find specifically which one it was. if it did somehow come from this site, we can try to see if the issue can be reproduced by another person OR the possibility that you have other malware on your machine sending you to unintended sites (although if this is the case, you should notice redirects more often than just this once). This may seem like a bad idea lol.. but my theory is that you have already been exposed once, you were either infected with something or not. A second time wouldn't do any damage (your AV will either block it appropriately like it should, or it didn't the first time anyways and no further harm would be done). Another solution would be to somehow copy the 30 minutes of history surrounding the incident, and having someone (you, us, or a third party) visit those websites one at a time in a sandboxed environment (virtual machine, sandbox program, etc)

[Catfish]

thanks for the input se7en. The thought I'd gotten cybergonorhea prior to visiting had crossed my mind but i cant find it regardless I'll straighten it out. Thanks for the help everybody.

[SE7EN]

hey, no problem man. always happy to help out when I can. keep us updated as to any new info you have, especially if there is any security issues with the site, so we can take care of it as quickly as possible.