malware?

Carolin · Post by **Carolin** » September 24th, 2015, 1:48 am

This just came in via the thank you mails.

Dear Sir/Madam.

I'm sure this may be the wrong forum for this message, but I wanted to let you know, that when I tried to listen to a short Science Fiction collection, with the story 'A filbert is a nut', I was warned that the site was corrupted with malware. Maybe you need to investigate.

Yours sincerely.

Michael.

I am asking for further details, but posting already just in case.

Carolin · Post by **Carolin** » September 27th, 2015, 11:44 am

this is the page: http://ia800309.us.archive.org/35/items/ssf_collection046_1208_librivox/ssf046_thenewaccelerator_wells_al.mp3 (part of http://archive.org/details/ssf_collection046_1208_librivox/)
i also get a warning.

Post by **TriciaG** » September 27th, 2015, 12:00 pm

viewtopic.php?f=23&t=58212

RuthieG · Post by **RuthieG** » September 27th, 2015, 12:15 pm

Yes, but surely that warning comes up when one opens LibriVox.org in the first place. The way I read it, this apparently relates to one file only.

What is the warning that you are getting? Is it a warning from your browser, your anti-virus software or a malware scanner? Which browser/AV software/malware scanner are you using?

I have scanned this file with Bullguard and Spybot Search and Destroy (both up-to-date) and neither found any problem.

Ruth

Post by **TriciaG** » September 27th, 2015, 12:24 pm

Oh, okay.

I wonder if it is still related to the security certificate. Could us having one and Archive (the source of the file) having another make any difference?

Carolin · Post by **Carolin** » September 27th, 2015, 12:30 pm

i use firefox. the warning is non-specific, and in german (as my browser is in german), but it warns me that there is malware reported for this page. the more information link on the warning brings me to the general info page: https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work

if you go on the project page on archive, the recording plays fine without any warning. only if you follow that link it doesnt work. is there anything wrong with that link - i dont see anything?

edit: chrome also blocks that page and warns that an attempt is being made to install software.

Post by **TriciaG** » September 27th, 2015, 12:36 pm

I'm on Firefox 36.0 and do not get any warnings when playing "A Filbert is a Nut" on that collection, nor when playing "The New Accelerator" from the LV catalog page. (The original post spoke of the first story; the subsequent link was to the second.)

RuthieG · Post by **RuthieG** » September 27th, 2015, 1:47 pm

I have downloaded it from the LV catalogue page, the IA catalogue page, and the direct server link, and scanned them all. On Firefox 35.0.1 I get no warnings.

Google Safe Browsing reports no issues.

Can you ask them if they can download any other LV files without problems?

The archive page was checked for viruses/malware in March 2014. The only changes noted in the history since then are from our info@ login or from IA itself.

Code: Select all

<--------------- BookOp VirusCheck (v58268 Mar19 19:30) Starting  PDT: 2014-03-19 19:30:20 ------------------


no malware found

Updating meta.xml with curation = "[curator]malware@archive.org[/curator][date]20140320023021[/date][comment]checked for malware[/comment]"

checking and formatting new meta.xml with xmllint:
[ PDT: 2014-03-19 19:30:21 ] Executing: /usr/bin/xmllint --format '/t/bookops/ssf_collection046_1208_librivox/ssf_collection046_1208_librivox_tmp.xml' > '/t/bookops/ssf_collection046_1208_librivox/ssf_collection046_1208_librivox_fmt.xml'

--------------- BookOp VirusCheck Finished  PDT: 2014-03-19 19:30:21 (Took 1.0 second) ------------------->

Carolin · Post by **Carolin** » September 28th, 2015, 1:07 am

this is the warning: http://asset-2.soupcdn.com/asset/13798/8776_2f0f_960.png

i only get the warning when clicking on the link provided by the listener. if i go to the archive page of the collection and then click on that story to stream, there is no problem.

ill advise that for now.

RuthieG · Post by **RuthieG** » September 28th, 2015, 1:23 am

Is that a Chrome or Firefox warning, Carolin? Does it happen on other files from that project - or any other LV projects? I think we should ask archive.org if they know why it is happening. May I use your image to do that, please?

ETA Which browser version no. are you using?

Also, I see an exclamation point ! on the left-hand side of the address bar. When you click on that, what does it say?

Ruth

Post by **annise** » September 28th, 2015, 2:50 am

Archive is giving a number of "scheduled maintainence" messages at the moment so maybe wait a bit ?

Anne

Carolin · Post by **Carolin** » September 28th, 2015, 3:04 am

this is a screenshot received from the listener.

all other stories play fine for me, including this one, if i stream it from the general archive projects page. as i said, i only get the warning when following the link provided by the listener. all other projects i checked so far are fine.

RuthieG · Post by **RuthieG** » September 28th, 2015, 3:27 am

I really don't understand this. That is clearly the Google Safe Browsing logo on the warning, but an image search does not find any other example with that particular text.

The message includes the words "this page has been blocked based on your security preferences". I begin to think it is related to Chrome's dislike of certain security certificates (not ours, for once, as this is an archive.org URL).

Ruth

Carolin · Post by **Carolin** » September 28th, 2015, 5:33 am

this is firefox.

am i really the only one getting this warning when clicking on the link provided by the listener (the one in my second post)? i am at work at the moment and am getting it here too.

it mentions my security settings, and i have them user defined and on a high standard, but not extraordinary (i use a different browser for anonymity and encryption). plus the listener evidently has the same settings, and he writes that he is not a computer expert.

Post by **annise** » September 28th, 2015, 5:54 am

no I get it when I click on any of the files in the "show all" list but can play and download the same files without any warning.

Anne
Using FF 41.0 Windows XP proffesional