Auctiva - Reported Attack Site!?!?!

[McO_32]

I went to log on to Auctiva today and got this message



"Reported Attack Site!

This web site at FREE eBay Auction Management, Auction Templates, Auction Tools, and Unlimited Image Hosting has been reported as an attack site and has been blocked based on your security preferences.

Attack sites try to install programs that steal private information, use your computer to attack others, or damage your system.

Some attack sites intentionally distribute harmful software, but many are compromised without the knowledge or permission of their owners."




So I get the choice either to Get me out of here, Ignore this warning or Why is this site blocked

So I clicked on Why this site is blocked and got this message:




"Safe Browsing
Diagnostic page for auctiva.com

What is the current listing status for auctiva.com?

Site is listed as suspicious - visiting this website may harm your computer.

Part of this site was listed for suspicious activity 1 time(s) over the past 90 days.

What happened when Google visited this site?

Of the 42 pages that we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time that Google visited this site was on 2009-02-21, and suspicious content was never found on this site within the past 90 days.

This site was hosted on 3 network(s) including AS16509 (AMAZON), AS174 (COGENT), AS14744 (INTERNAP).

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, auctiva.com did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.

How did this happen?

In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.


Next steps:

* Return to the previous page.
* If you are the owner of this website, you can request a review of your site using Google Webmaster Tools. More information about the review process is available in Google's Webmaster Help Centre."




So do I log-on or what, I'm not sure what to do?

McO_32.

[aspkin]

Yeah, I saw that earlier today as well.

It seems like a mistake to me.. everything seems fine at Auctiva.

[McO_32]

I agree, probably this then:

" ... In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message."

I'll wait a few hours and try again.

[aspkin]

You can disable the warning temporary if you need to access the site.

Firefox > Tools > Options > Security

Add an exception, and uncheck 'tell me if this site I'm visiting is a suspected attack site'

[sowhat]

I just got that message right now too.

I was also having trouble posting auctions to ebay last night through auctiva.

The warning said it had not found anything suspicious on the auctiva site. I'm thinking because it's a third party posting to ebay, it may just be an extra precaution which may be the reason for this part:

" ... In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message."

Maybe ebay has had problems with other third party sites and put up some kind of security. I'm gonna continue posting through auctiva and report back if I have any issues.

[oompaloompa]

Hi got this too, got a avast trojan warning, each time I pressed a button . I still managed to list some stuff successfully.

[sowhat]

I just clicked the "ALERT" button at the top right of the auctiva page and it said this:

"A few of our auctiva.com web servers have been pulled out to do some emergency repairs. This means we are running on fewer servers than normal and the site will be running slower than normal. Friday 7:30pm update: We are faster than earlier today, but are continuing to rotate servers in and out and are still not at full capacity. Planning to be back to full capacity Saturday afternoon. "

[Here We Go Again]

What is the current listing status for auctiva.com?
Site is listed as suspicious - visiting this web site may harm your computer.

Part of this site was listed for suspicious activity 2 time(s) over the past 90 days.

What happened when Google visited this site?
Of the 45 pages we tested on the site over the past 90 days, 5 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-02-21, and the last time suspicious content was found on this site was on 2009-02-21.
Malicious software includes 6 scripting exploit(s), 6 trojan(s). Successful infection resulted in an average of 10 new processes on the target machine.

Malicious software is hosted on 2 domain(s), including luckffxi.com/, auctlva.com/.

1 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including me9x.cn/.

This site was hosted on 3 network(s) including AS16509 (AMAZON), AS174 (COGENT), AS14744 (INTERNAP).

Has this site acted as an intermediary resulting in further distribution of malware?
Over the past 90 days, auctiva.com did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?
No, this site has not hosted malicious software over the past 90 days.

How did this happen?
In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

[aspkin]

They got hacked... eek!

Well hopefully they get it fixed fast.

[Here We Go Again]

Hackers Servers Information:
luckffxi.com
ICANN Registrar: XIN NET TECHNOLOGY CORPORATION
Created: 2009-01-08
Expires: 2010-01-08
Updated: 2009-01-08
Registrar Status: ok
Name Server: NS1.TOFOR.COM
Name Server: NS2.TOFOR.COM

IP Address: 210.51.10.19
IP Location - Beijing - Beijing - Sintel-mercury-interactive

Registrant Search: "aa bb" owns about 12 other domains


Registrant:
Organization : aa bb
Name : aabb
Address : Fujian province,Xiamen City
City : Xiamen
Province/State : Beijing
Country : cn
Postal Code : 361004

Administrative Contact:
Name : aabb
Organization : aabb
Address : Fujian province,Xiamen City
City : Xiamen
Province/State : Beijing
Country : cn
Postal Code : 361004
Phone Number : 86-101-234567
Fax : 86-101-234567
Email : 843338876@qq.com

Technical Contact:
Name : aabb
Organization : aabb
Address : Fujian province,Xiamen City
City : Xiamen
Province/State : Beijing
Country : cn
Postal Code : 361004
Phone Number : 86-101-234567
Fax : 86-101-234567


me9x.cn

Created: 2009-01-02
Expires: 2010-01-02
Whois Server: whois.cnnic.net.cn

IP Address: 222.77.179.223
IP Location - China - Chinanet Fujian Province Network

Email Search: 123456@qq.com is associated with about 22 domains

[TMiles]

I was on Auctiva few night back, and my virus software blocked something!!! Who wants to bet eBay paid a black hatter to crash their site...

[suspended user]

Originally Posted by aspkin

You can disable the warning temporary if you need to access the site.

Firefox > Tools > Options > Security

Add an exception, and uncheck 'tell me if this site I'm visiting is a suspected attack site'

I was actually working on the site when this happened and the warning popped up. I did exactly that and went to firefox and made it an exception.

[GreenBean]

^^^^ Have that as well. Listings are up. Will see what happens later.

[Burning]

Yes, this is the exact message I got.

[newdenim]

Thats why i love this forum! You get the latest update on whats going on with ebay/paypal/everything else... Loven it!!

[Here We Go Again]

Auctiva looks to be totally down now.
FREE eBay Auction Management, Auction Templates, Auction Tools, and Unlimited Image Hosting

In Firefox I get the following message:

The site you are trying to view does not currently have a default page. It may be in the process of being upgraded and configured.

Please try this site again later. If you still experience the problem, try contacting the Web site administrator.

If you are the Web site administrator and feel you have received this message in error, please see "Enabling and Disabling Dynamic Content" in IIS Help.
To access IIS Help

1. Click Start, and then click Run.
2. In the Open text box, type inetmgr. IIS Manager appears.
3. From the Help menu, click Help Topics.
4. Click Internet Information Services.

[suspended user]

Just signed on auctiva with my other computer to see if the warning still shows and sure enough it does. I went and made an exception in firefox/security and unchecked the tell me if I am visting a suspected attack site click ok was able to access the site and do what I needed to do.

[suspended user]

Also found this notice on Auctiva's site
A few of our auctiva.com web servers have been pulled out to do some emergency repairs. This means we are running on fewer servers than normal and the site will be running slower than normal. Friday 7:30pm update: We are faster than earlier today, but are continuing to rotate servers in and out and are still not at full capacity. Planning to be back to full capacity Saturday afternoon.

Its Sunday morning now so the info is not updated by them.

[oompaloompa]

sunday night, they say they are working on fewer servers, tried to do some listings, came up with that error message in red, I think its time to take a few days off from auctiva, until it settles.

[McO_32]

Still down in the UK, I can click ignore warning but every page I get the burgundy warning page with the same continue options. I was gonna list some more bits but think I'll have an early night instead

[Here We Go Again]

In the USA if you go around the warning in Firefox you can get in and the site works but it is slow do the traffic.

Here is the latest update from the Auctiva Message Board:
Posted February 22, 2009 01:55 PM
Hi Community,

Update - Our engineering team is still investigating this situation but, at this point, it appears the reason these virus alert warnings started showing up on our site is because some of our machines were injected with malware originating in China. The malware we believe to be at fault has also hit a number of other high profile websites over the past 6 months.

If our current suspicions about what happened are correct, we know some things we can do to prevent this from happening again, but some additional investigation will be required before we reach a conclusive determination.

The affected machines are no longer in our rotation so it is currently safe to navigate the Auctiva website, however, if you did visit our site between Thursday evening and Saturday afternoon at about 2 PM PT, as a precautionary measure, we recommend taking the following actions to ensure that your computers are not infected:

1) Clear your browser cache, delete ALL temporary internet files, and restart your browser.
2) If using a Windows machine, make sure you are updated with all the current Microsoft updates and patches.
3) Make sure you are running some reputable antivirus software (AVG is available for free at AVG Free - Download antivirus and antispyware software for Windows XP and Vista and is known to catch this malware)
4) Use the Firefox browser if possible, as it has been shown to be less susceptible to this sort of malware than Internet Explorer.

We will post further updates on this situation to this thread as additional information becomes available. If you have any additional questions, please feel free to contact our customer support team using the appropriate link on our help page: Auctiva Help Request

-Mike

This message has been edited. Last edited by: Auctiva Mike D., February 22, 2009 02:04 PM

So according to the owner/manager/IT Dept. all is well as or right now.

[sowhat]

Originally Posted by aspkin

They got hacked... eek!

Well hopefully they get it fixed fast.

whoa!!!

thats crazy!!

i agree with oompaloompa. im taking a few days off from auctiva as well. they now have a notice up saying they are having major problems. i will just have to go old school and list through ebay.