CineForm website unsafe?? at DVinfo.net

Harry Simpson · May 1st, 2010, 11:13 PM

I've tried to get onto the Cineform website several times tonight - on my laptop it just froze up and I had to turn the laptop off. On the desktop my virus protection immediately blocked the site as unsafe.

Any idea what's going on?

Harry

David Newman · May 1st, 2010, 11:27 PM

I'm seeing it too. Investigating.

Chris Soucy · May 1st, 2010, 11:55 PM

It appears that something on the site is initiating an immediate Java upgrade install which, dependant on the security level set on you're system, may trigger an alarm.

Whether the Java update is cosher is another question entirely, Nortons didn't flag it, but I kyboshed it anyway.

Think you may have added some new graphics which require the latest update is all.

CS

David Newman · May 2nd, 2010, 12:13 AM

Thanks Chris,

That is useful info. I have downloads the whole website and scanned it locally and found nothing.

Rich Perry · May 2nd, 2010, 02:20 AM

The cineform website has a virus,
On loading if allowed it downloads a PDF which contains the following content:

"Abvolt spit abortively abongo puneet. Playboy abhorrently phone dawn elizabeth abashedness abyssinian. Topography lisa playboy abhorrently phone dawn elizabeth abashedness abyssinian abhorrently. "

Oh, this happened while using google chrome and the PDF downloaded was called
3bbb9d.pdf

Rich Perry · May 2nd, 2010, 02:41 AM

I did not get any issues on iexplorer or google chrome the second time I went to the site today or even when clearing cookies (but I had already approved the unsafe site) perhaps it's something akin to the described article below:

Virus spreading via PDF | OIT Website

David Taylor · May 2nd, 2010, 07:49 AM

Network Solutions is our host. Apparently they have other sites they host that have also been targeted. They have escalated it and are working on a solution. I'll post again when they've resolved it.

Harry, thank you for first reporting it, and to others who have chimed in....

David Dwyer · May 3rd, 2010, 02:39 AM

This website has been reported as unsafe
techblog.cineform.com

We recommend that you do not continue to this website.
Go to my home page instead

This website has been reported to Microsoft for containing threats to your computer that might reveal personal or financial information.

More information

This website has been reported to contain the following threats:

Malicious software threat: This site contains links to viruses or other software programs that can reveal personal information stored or typed on your computer to malicious persons.

Learn more about phishing
Learn more about malicious software
Report that this site does not contain threats
Disregard and continue (not recommended)

Yeah I was trying to download the latest update and I got the above - Nice of Windows 7! Atleast I know it works

Martin Guitar · May 3rd, 2010, 11:33 AM

It happened to my company's website as well maybe 3 months ago.

Basically it attacked every HTML files and XML files on our website. Our IT guy wrote a script to remove those javascript code snippet from all infected files. There was a lot of infections.

We cleaned it with the script and changed all our passwords and everything was ok...then it came back 2 weeks after so we had to do a re-provisioning of our server. (backing up and formatting the whole thing, re-installing os)

It really sucks.

Steve Pesenti · May 3rd, 2010, 04:02 PM

After reaching the Cineform site I noticed the suspicious Java install message pop up too. Did not click on it and Norton also flagged it had resolved an attack. However, despite this I then appeared to get a redirect virus in my browser. Ran a scan with Malwarebytes' Anti-Malware found at Malwarebytes and it seems to have fixed the problem.

Burk Wagner · May 6th, 2010, 07:55 PM

Still virus-ridden May 6 10 pm EST

David Newman · May 6th, 2010, 10:35 PM

I think I might be finally fixed. Please report.

Trond Saetre · May 7th, 2010, 12:52 AM

No error message, no java update pop-up, no antivirus messages when visiting cineform website May 7, 06:50UTC

Website appears to be as it is supposed to be.

Tim Hall · May 7th, 2010, 01:52 AM

Quote:

Originally Posted by Rich Perry

I did not get any issues on iexplorer or google chrome the second time I went to the site today or even when clearing cookies (but I had already approved the unsafe site) perhaps it's something akin to the described article below:

Virus spreading via PDF | OIT Website

I also approved the site after it was reported unsafe by my AV, now I'm worried :/ It didn't seem to try and download any PDFs, so it should be fine right?!

Robert Young · May 7th, 2010, 01:53 AM

Confirmed!
Both the Tech Blog page and the CF site seem squeeky clean now.
I never did approve the site when it was misbehaving, and now I don't get the unsafe site screen.
What a nusiance for you guys...

May 1st, 2010, 11:13 PM	#1
Harry Simpson Major Player Join Date: Aug 2009 Location: Nashville, TN. Posts: 581	CineForm website unsafe?? I've tried to get onto the Cineform website several times tonight - on my laptop it just froze up and I had to turn the laptop off. On the desktop my virus protection immediately blocked the site as unsafe. Any idea what's going on? Harry __________________ Nashville TN using Canon 5D MK3, Canon 550D, RODE SVM mic, 70-200 f2.8L II IS, 24-105 f4L IS, 50 and 85 f/1.8, Vegas Pro 11, Zoom H4n, Blackbird, Lilliput Monitor, Lightroom

May 1st, 2010, 11:27 PM	#2
David Newman CTO, CineForm Inc. Join Date: Jul 2003 Location: Cardiff-by-the-Sea, California Posts: 8,095	I'm seeing it too. Investigating. __________________ David Newman -- web: www.gopro.com blog: cineform.blogspot.com -- twitter: twitter.com/David_Newman

May 1st, 2010, 11:55 PM	#3
Chris Soucy Inner Circle Join Date: Feb 2007 Location: Fairfield, Dunedin, New Zealand Posts: 3,682 Images: 18	Hi............. It appears that something on the site is initiating an immediate Java upgrade install which, dependant on the security level set on you're system, may trigger an alarm. Whether the Java update is cosher is another question entirely, Nortons didn't flag it, but I kyboshed it anyway. Think you may have added some new graphics which require the latest update is all. CS

May 2nd, 2010, 12:13 AM	#4
David Newman CTO, CineForm Inc. Join Date: Jul 2003 Location: Cardiff-by-the-Sea, California Posts: 8,095	Thanks Chris, That is useful info. I have downloads the whole website and scanned it locally and found nothing. __________________ David Newman -- web: www.gopro.com blog: cineform.blogspot.com -- twitter: twitter.com/David_Newman

May 6th, 2010, 07:55 PM	#11
Burk Wagner New Boot Join Date: Apr 2007 Location: Highland Park, NJ USA Posts: 6	Still virus-ridden May 6 10 pm EST Last edited by Burk Wagner; May 6th, 2010 at 07:55 PM. Reason: spelling

May 2nd, 2010, 02:20 AM	#5
Rich Perry Major Player Join Date: Aug 2007 Location: Nashua NH Posts: 278	The cineform website has a virus, On loading if allowed it downloads a PDF which contains the following content: "Abvolt spit abortively abongo puneet. Playboy abhorrently phone dawn elizabeth abashedness abyssinian. Topography lisa playboy abhorrently phone dawn elizabeth abashedness abyssinian abhorrently. " Oh, this happened while using google chrome and the PDF downloaded was called 3bbb9d.pdf

May 2nd, 2010, 02:41 AM	#6
Rich Perry Major Player Join Date: Aug 2007 Location: Nashua NH Posts: 278	I did not get any issues on iexplorer or google chrome the second time I went to the site today or even when clearing cookies (but I had already approved the unsafe site) perhaps it's something akin to the described article below: Virus spreading via PDF \| OIT Website

May 2nd, 2010, 07:49 AM	#7
David Taylor Major Player Join Date: Sep 2003 Location: Solana Beach, CA Posts: 853	Network Solutions is our host. Apparently they have other sites they host that have also been targeted. They have escalated it and are working on a solution. I'll post again when they've resolved it. Harry, thank you for first reporting it, and to others who have chimed in....

May 3rd, 2010, 02:39 AM	#8
David Dwyer Major Player Join Date: Jan 2006 Location: Chester, North West Posts: 565	This website has been reported as unsafe techblog.cineform.com We recommend that you do not continue to this website. Go to my home page instead This website has been reported to Microsoft for containing threats to your computer that might reveal personal or financial information. More information This website has been reported to contain the following threats: Malicious software threat: This site contains links to viruses or other software programs that can reveal personal information stored or typed on your computer to malicious persons. Learn more about phishing Learn more about malicious software Report that this site does not contain threats Disregard and continue (not recommended) Yeah I was trying to download the latest update and I got the above - Nice of Windows 7! Atleast I know it works

May 3rd, 2010, 11:33 AM	#9
Martin Guitar Regular Crew Join Date: Mar 2007 Location: Los Angeles, CA Posts: 115	It happened to my company's website as well maybe 3 months ago. Basically it attacked every HTML files and XML files on our website. Our IT guy wrote a script to remove those javascript code snippet from all infected files. There was a lot of infections. We cleaned it with the script and changed all our passwords and everything was ok...then it came back 2 weeks after so we had to do a re-provisioning of our server. (backing up and formatting the whole thing, re-installing os) It really sucks.

May 3rd, 2010, 04:02 PM	#10
Steve Pesenti Regular Crew Join Date: Mar 2009 Location: London, UK Posts: 60	After reaching the Cineform site I noticed the suspicious Java install message pop up too. Did not click on it and Norton also flagged it had resolved an attack. However, despite this I then appeared to get a redirect virus in my browser. Ran a scan with Malwarebytes' Anti-Malware found at Malwarebytes and it seems to have fixed the problem.

May 6th, 2010, 10:35 PM	#12
David Newman CTO, CineForm Inc. Join Date: Jul 2003 Location: Cardiff-by-the-Sea, California Posts: 8,095	I think I might be finally fixed. Please report. __________________ David Newman -- web: www.gopro.com blog: cineform.blogspot.com -- twitter: twitter.com/David_Newman

May 7th, 2010, 12:52 AM	#13
Trond Saetre Inner Circle Join Date: Jun 2003 Location: Bergen, Norway Posts: 3,375	No error message, no java update pop-up, no antivirus messages when visiting cineform website May 7, 06:50UTC Website appears to be as it is supposed to be.

May 7th, 2010, 01:53 AM	#15
Robert Young Trustee Join Date: Mar 2005 Location: Coronado Island Posts: 1,472	Confirmed! Both the Tech Blog page and the CF site seem squeeky clean now. I never did approve the site when it was misbehaving, and now I don't get the unsafe site screen. What a nusiance for you guys... __________________ Bob