🔒 Locked

Internet WORM Detected

Started by Pixel Tamer Jul 8, 2006 at 10:44 PM 20 replies 5.3k views

Original Post

Jul 8, 2006 at 10:44 PM

I sent an e-mail to webmaster@gamedev.net a week ago, but I haven't gotten a response, so I guess I have to ask this publicly. Since I started visiting this site a few weeks ago, I have gotten numerous warnings from my AV software about an internet worm being detected and blocked. (At that point, this site is blocked for me until I reboot.) At first, I thought this only happened from the main site (http://www.gamdev.net), but this week it's been happening when I was viewing the forum as well. Here's a screenshot of the warning I get. I can't resize the dialog box, so the two images are the same warning, only I scrolled details so you can see all the info:

The other odd thing is that each time I get this, the attacked port is different. So far, your site has tried to access the following ports: 4430, 3604, 2024, 1071, and 1423. To be clear, this only happens when I visit your site. I know that gamedev.net is a very respected website, so I am in no way accusing the operators of gamedev.net of doing anything malicious. I am sure there is a logical, benign reason that I am getting these intrusion attempts; I just need help figuring out what that reason is. Thanks.

superpig

Jul 9, 2006 at 10:19 AM

Huh, that's weird...

Edit: It's this. Looking at the source to this page, I don't see any IFRAMEs or EMBEDs - does it only happen on specific pages?

KulSeran

Jul 9, 2006 at 10:33 AM

You might consider getting a "hosts" file for your computer, or a similar solution. This
could definatly be a not so benign ad that is getting loaded when you vist the site.
There appears to be minimal connection between the ad and the actual gamedev.net website, though
the ad are mostly targeted towards the comuity, there is always that stray ad that seems to sneek in.
That is one posiblility you could think about.

Alimonster

Jul 9, 2006 at 11:15 AM

Quote:
Original post by KulSeran
You might consider getting a "hosts" file for your computer, or a similar solution. This
could definatly be a not so benign ad that is getting loaded when you vist the site.
There appears to be minimal connection between the ad and the actual gamedev.net website, though
the ad are mostly targeted towards the comuity, there is always that stray ad that seems to sneek in.
That is one posiblility you could think about.

Here's a useful hosts file

Pixel Tamer

Jul 9, 2006 at 7:34 PM

Quote:
Original post by Anonymous Poster
Quote:
This issue is reported to affect Microsoft Internet Explorer 6 running on a Windows 2000 SP4 platform. Microsoft Internet Explorer 6 Service Pack 2 is not reported to be prone to this vulnerability.

An update is in order, or just stop using a really bad browser :)

I suppose it's logical to jump to a false conclusion based on text from my AV software, but I exclusively use Firefox as my browser. Remember, IE is part of the OS, so the mere mention of it in a protocol name says nothing about the actual browser being used.

Pixel Tamer

Jul 9, 2006 at 7:40 PM

Quote:
Original post by KulSeran
You might consider getting a "hosts" file for your computer, or a similar solution. This
could definatly be a not so benign ad that is getting loaded when you vist the site.
There appears to be minimal connection between the ad and the actual gamedev.net website, though
the ad are mostly targeted towards the comuity, there is always that stray ad that seems to sneek in.
That is one posiblility you could think about.

My thought, too, that this may be related to a 3rd party ad used by gamedev.net, but that begs the question: Why has no one else experienced this problem? Given the wide usage of Norton AV, surely I am not the only one here that is running it. Oh, and for clarity's sake, I'm just using Norton Antivirus, not their Internet Security product thingamajiggy. :)

superpig

Jul 10, 2006 at 2:11 AM

I guess NAV would be intercepting packets at the TCP stack level, so it doesn't matter which program eventually ends up processing those packets.

As noted, if you can give me any info on which pages or ads cause this to happen, I'll be in a much better place to start tracking it down.

Pixel Tamer

Jul 10, 2006 at 6:19 AM

Quote:
Original post by superpig
As noted, if you can give me any info on which pages or ads cause this to happen, I'll be in a much better place to start tracking it down.

Well, sure, but how would I know which ad is causing the problem? The only ad I ever see is that little Apple iPod .gif image as I have all the rest blocked. (Well, it's been a few weeks since I joined, so I don't specifically remember, but out of reflex whenever I see an ad I block it (see Adblock Extension for Firefox). I am not seeing any ads, so either you don't have any, or I have blocked them already. [cool])

With that said, it's probably not an ad because my browser won't even contact the external URL.

As far as which page, I already stated that in the original message (and in my e-mail). It will happen at anytime, either when I first connect to the home page (http://www.gamedev.net) or when randomly reading through the forums. When it happens, though, Norton will shut down access to your site (or your IP rather), so I can't see anything after the aforementioned Security Alert is thrown up. Firefox jumps to its "Connection Was Reset" error page. Sorry.

Edit/Update: It just happened yet again just after I posted the above. This time, it was Port 1577. All I did was post this reply, went to the top level forum page, and then clicked on the Visual Arts subform. The moment I clicked, I got the security warning:

superpig

Jul 10, 2006 at 6:33 AM

Quote:
Original post by Pixel Tamer
Well, sure, but how would I know which ad is causing the problem? The only ad I ever see is that little Apple iPod .gif image as I have all the rest blocked.

View the page source. IIRC, Adblock only stops the images from loading and being displayed; it doesn't mess with the source of the page.

Quote:
(Well, it's been a few weeks since I joined, so I don't specifically remember, but out of reflex whenever I see an ad I block it (see Adblock Extension for Firefox). I am not seeing any ads, so either you don't have any, or I have blocked them already. [cool])

With that said, it's probably not an ad because my browser won't even contact the external URL.

No, it probably is - one that includes an

Pixel Tamer

Jul 10, 2006 at 6:41 AM

I updated my above post as you were posting this.

Quote:
Original post by superpig
To my knowledge, you're the only person who has reported this, which makes me continue to wonder whether it's a problem at our end at all.

Yeah, that's always the case. Okay. Never mind. Sorry to have bothered you. [oh]

Quote:
Original post by superpig
(Oh, and thanks for helping to cut off the site's ad revenue. Your support is appreciated.)

I'm not a wasteful impulse shopper, so I don't visit ad sites anyway. Why do I need to waste browser space looking at them? I thought this site accepted donations? Isn't that what becoming a GDNet+ member is all about?

Kylotan

Jul 10, 2006 at 3:46 PM

GDNet+ members support the site with subscriptions. Other members support the site through ad clicks and/or views. If the existence of GDNet+ meant they didn't need ads, I'm sure they'd take them down.

DevLiquidKnight

Jul 15, 2006 at 2:51 PM

Quote:
Original post by superpig
Hum. Well, given that I can't reproduce this at my end, and I can't find any obvious instances of malformed in the site codebase, I'm at a bit of a loss as to how to persue this. To my knowledge, you're the only person who has reported this, which makes me continue to wonder whether it's a problem at our end at all.

You can include me in that who have now reported superpig. It has been bothering me like crazy lately. Today I signed on gamedev and it blocked the site about 4 times in a row. It has done it a few other times the last few weeks and I thought it was just a fluke at first but now its becoming a real problem.

By the way you don't need to restart the system to make it go away though. You must go to the options in Norton and unblock the IP address of GameDev every time this happens.

Now while this might seem like a big issue seeing as only 2 of us reported it. What about the other people who now can no longer visit GameDev because of it being IP blocked? You probably haven't even heard of them because some of them might not be able to figure out how to unblock it. Norton is a rather popular Anti-Virus solution, I am sure it is just a matter of time before there are more reports.

Seems to me like the longer this occurs the more people will begin disappearing. Especially considering it does not always happen, the rate at which its displayed is rather random.

superpig

Jul 20, 2006 at 7:57 PM

So, anyone want to start a pool on how many emails it'll take before I get through to a Symantec engineer?

So far I've sent one and had one stock reply that completely misunderstands the issue...

superpig

Jul 21, 2006 at 8:46 PM

OK, I'm finally getting somewhere with Symantec.

Could someone who's seeing this issue send me the Activity Log for the Internet Worm Protection service? Ideally, clear it first, then visit the site to trigger the alert, so that there's no irrelevant data in the log.

Here's the steps their techie has given me:

Quote:

1) To View the Activity Log:

-Open Norton AntiVirus.
-Click on Reports on the left side.
-On the right side Click View Activity.
-On the left pane, right click on the Norton Internet Worm Protection.
-Click on Clear all Categories.
-Click on Yes.

2) Try to access the Web site.
3) Export* all the Norton Internet Worm Protection logg* to the text file. In
order to do so, please refer the Online Knowledge Base document provided below:

Title: 'How to export the Activity log to a text file'
Document ID: 2000083016295406
> Web URL:
http://service1.symantec.com/Support/nav.nsf/docid/2000083016295406?Open&src=w

Pixel Tamer

Jul 21, 2006 at 10:56 PM

The log won't give you any more information than I already provided above via my screenshots.

For example, exporting my log now only reveals the following about this specific intrusion:

7/11/2006 8:49:06 PM,Intrusion detected and blocked. All communication with www.gamedev.net(216.185.96.234) will be blocked for 30 minutes.,Intrusion detected and blocked. All communication with www.gamedev.net(216.185.96.234) will be blocked for 30 minutes.7/11/2006 8:49:06 PM,Intrusion: HTTP MS IE Malf. IFRAME/EMBED BO.,"Intrusion: HTTP MS IE Malf. IFRAME/EMBED BO.  Intruder: www.gamedev.net(216.185.96.234)(http(80)).   Risk Level: High.  Protocol: TCP.  Attacked IP: EARTH(192.168.1.100).  Attacked Port: 1667."7/11/2006 8:05:42 PM,Internet Worm Protection is monitoring 569 signatures.,Internet Worm Protection is monitoring 569 signatures.7/11/2006 8:05:42 PM,Internet Worm Protection is monitoring 569 signatures.,Internet Worm Protection is monitoring 569 signatures.7/11/2006 8:02:44 PM,Internet Worm Protection has been enabled.,Internet Worm Protection has been enabled.7/11/2006 8:02:44 PM,Internet Worm Protection is monitoring 569 signatures.,Internet Worm Protection is monitoring 569 signatures.7/11/2006 8:02:44 PM,Internet Worm Protection is monitoring 569 signatures.,Internet Worm Protection is monitoring 569 signatures.7/11/2006 8:02:22 PM,Internet Worm Protection Signature File Version: 6/14/2006 Rev. 94. Internet Worm Protection Engine Version: 2.0.0.50707.,Internet Worm Protection Signature File Version: 6/14/2006 Rev. 94. Internet Worm Protection Engine Version: 2.0.0.50707.

(Included are a few lines prior so you can see the engine version and such. Also, be aware that the log is prepended, hence why the dates are in descending order.)

That's exactly the same info I posted above. The only thing that changes with each intrusion is the attacked port.

And yes, that was the last one that happened (i.e., 10 days ago), but admittedly I don't spend much time on this site anymore since I am always plagued with this worm intrusion if I stay longer than five minutes. :(

Edit: See what I mean? All I did was edit this post to change the [ code ] tags to [ source ] tags (so it would horizontally scroll), and when I clicked "Make Modifications," I got another intrusion attempt:

7/21/2006 11:01:51 PM,Intrusion detected and blocked. All communication with www.gamedev.net(216.185.96.234) will be blocked for 30 minutes.,Intrusion detected and blocked. All communication with www.gamedev.net(216.185.96.234) will be blocked for 30 minutes.7/21/2006 11:01:51 PM,Intrusion: HTTP MS IE Malf. IFRAME/EMBED BO.,"Intrusion: HTTP MS IE Malf. IFRAME/EMBED BO.  Intruder: www.gamedev.net(216.185.96.234)(http(80)).   Risk Level: High.  Protocol: TCP.  Attacked IP: EARTH(192.168.1.100).  Attacked Port: 3353."

Morpheus011

Jul 21, 2006 at 11:11 PM

have you looked into the possibility that your browser itself may be hijacked? It seems odd that you alone out of all the people who visit this site are having this problem. I would recommend downloading the program HijackThis and using that to see if your browser is being hijacked.

Also, make sure you use Spybot S&D and Adaware frequently. This sounds more like a client side issue to me than anything else.

superpig

Jul 22, 2006 at 3:41 AM

Quote:
Original post by Pixel Tamer
The log won't give you any more information than I already provided above via my screenshots.

I'm just following their requests. Could you email me the log file directly? richard@gamedev.net...

Pixel Tamer

Jul 22, 2006 at 9:32 PM

Quote:
Original post by Morpheus011
have you looked into the possibility that your browser itself may be hijacked? It seems odd that you alone out of all the people who visit this site are having this problem. I would recommend downloading the program HijackThis and using that to see if your browser is being hijacked.

Also, make sure you use Spybot S&D and Adaware frequently. This sounds more like a client side issue to me than anything else.

First, no, it's not spyware, a virus, or a trojan on my end. Second, perhaps you missed DevLiquidKnight's post above. I am not alone here.

Pixel Tamer

Jul 22, 2006 at 9:33 PM

Quote:
Original post by superpig
Quote:
Original post by Pixel Tamer
The log won't give you any more information than I already provided above via my screenshots.
I'm just following their requests. Could you email me the log file directly? richard@gamedev.net...

Sure. No problem.

smart_idiot

Aug 9, 2006 at 3:55 AM

The port number that seems to be getting attacked is most likely the port your browser used to connect to the website, which will be more or less random. Your AV software probably doesn't like the HTML that one of the ad banners generated.

According to their website, the cause of this error is a website setting a 'src' or 'name' value too large, which can cause a buffer overflow in IE. I'm going to guess that a 'src' value gets set to a really long url, causing Norton to panic.

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.