Malware in the Download button?

[deepstrasz]

It's what I get when pressing the DOWNLOAD button in the maps section since today. I've tried downloading other maps I've did before. The same... I've also not updated anything since yesterday so, I don't get what's happening.

 

[PurgeandFire]

I'd suggest ignoring the warning, or adding this site as a whitelist to your browser/anti-virus suite.

Afaik, all of this traces back to JassNewGenPack, which will inject itself into the editor in a hacky way that *seems* like a virus. But it is harmless.

 

[Emm-A-]

If you search the downloads with your antivirus software, which I would suggest to do anyway for most downloads from time to time, it finds nothing. I use avira antivir.

 

[Ralle]

Ah well. That always happens. JNGP is being marked as a virus by security software which makes a broad statement about this whole website. The thing is, JNGP latches itself onto World Editor to provide its advanced features. Often times when doing this, it's shady, but JNGP has pure intentions. No need to be afraid.

 

[Zwiebelchen]

Geez. Anti-Virus software developers suck giant hairy balls.

To be honest, I'm not even sure we still need Anti-Virus in 2016. I haven't had a virus in years. Modern OS are pretty secure.


I'm not sure there's something that Ralle can do about it. I'd say slap a message on the download button that tells people that this site does not contain viruses and every download is legit and leave it to the responsibility of the users to fix their weird browsers.

 

[Ralle]

Yeah. I'm not sure people would trust such a disclaimer. I'd believe the opposite of whatever was written.

 

[fladdermasken]

Yeah. I'm not sure people would trust such a disclaimer. I'd believe the opposite of whatever was written.

Yeah sure, but would you feel better if there was no disclaimer at all?

 

[Emm-A-]

If the disclaimer simply stated, that the warning most certainly occured because of JNGP getting the site tagged as harmful, then I think everybody would be happy.

 

[pyf]

To be honest, I'm not even sure we still need Anti-Virus in 2016. I haven't had a virus in years.

Depends on what kind of user, surfer and downloader one is.
As for me, no need for resident antivirus, nor whatever third-party firewall.

At the very least, I would recommend using an anti-exploit. Also, have your PC and browser properly configured, with a few good extensions. Lastly, I suggest to use a few passive defenses which use little to no memory (hostfile(s) + browser "vaccination" + resident ad blocker at OS level, not at browser level).

Doing P2P stuff would require other, additional protection.

Oh, I was about to forget: happily surfing as Admin on XP.

Modern OS are pretty secure.

Out-of-the-box, I seriously doubt it. Fortunately, they can be hardened afterwards, at little to no cost.

Yeah. I'm not sure people would trust such a disclaimer. I'd believe the opposite of whatever was written.

With computers, one only has to know and understand what he is doing / what is happening.
It only requires having a bit of common sense, as well as being logical. Reading a little helps, too. Nothing big, really...

 

[Manipulation]

So what do we do? is it safe? (newbie here )

 

[Zwiebelchen]

So what do we do? is it safe? (newbie here )

No! Don't trust Hiveworkshop! Ralle has sadistic tendencies to infect your system with moose-ware.

 

[Manipulation]

No! Don't trust Hiveworkshop! Ralle has sadistic tendencies to infect your system with moose-ware.

I KNEW IT !

 

[deepstrasz]

No! Don't trust Hiveworkshop! Ralle has sadistic tendencies to infect your system with moose-ware.

Should that be amoosing? But, it might be true since NSA can't trust people anymore.

 

[Zwiebelchen]

Also, he is a mooseanthrope.

 

[StoPCampinGn00b]

This happens to me for every map now too. Here's the google explanation: Safe Browsing Site Status – Transparency Report – Google

Hopefully we can find a way of clearance for this.

Also, EpicWar.com's download doesn't have the warning page show up.

 

[Ralle]

So what do we do? is it safe? (newbie here )

JGNP is not malware. There are no malicious maps, spells, models, icons, skins, spells. I am confident that most tools are without malware, but I cannot really guarantee anything, especially in "Submissions".

 

[pyf]

I point out, the download progress bar has been half-broken since a long time now.
http://www.hiveworkshop.com/threads...known-file-size-no-progress-bar-again.278813/

Might be worth investigating once again.

 

[PurgeandFire]

Yeah sure, but would you feel better if there was no disclaimer at all?

I would. If there is a disclaimer, I always get suspicious that something is up. Kinda like those sites that say "you're computre haz been infected by virus! cilkc here to fix it!". I think the internet has trained us to be skeptical, and rightfully so.

Although, if enough people get this warning then yeah it is probably worth it to set up a warning.

 

[Yours Truly]

Well,it's just that everytime I want to download resources,I keep getting this:

Ehm

I dunno if this is either my laptop's doings,but some opinions from others would be appreciated.

 

[fladdermasken]

Moved xYours Trulyx's post here.

In broad terms, JNGP may look like the bad guy who shoves your head down the toilet, but he's actually doing it to help you wash out your dirty face.

JNGP is the hero society needs, but not the one it wants.

 

[StoPCampinGn00b]

It's not JNGP in the maps causing it. I tested a bunch of map downloads and I'm certain many of the ones I tested don't use JNGP because of how simple / old they are. It's every map.

But here's the catch, I think it's Chrome. I used internet explorer (for once!) and it's all fine. Even my Norton security anti-virus (free version) doesn't detect anything.

 

[Emm-A-]

It's not JNGP in the maps causing it.

I think, the whole site gets tagged as dangerous once a certain amount of files was found to be possibly malware ... as far as I understood, this was, what Ralle and Co. meant.

it is not only chrome as far as I can say. I use firefox, and it happens from time to time as well.

 

[pyf]

Both Chrome and Firefox use Google Safe Browsing, I think
https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work
https://wiki.mozilla.org/Security/Safe_Browsing


Detection ratio on VirusTotal was 0 on 07/12/2016, and for some reason it is still the same today:
THW url scan on VirusTotal

 

[Mister_Haudrauf]

JNGP is the hero society needs, but not the one it wants.

Like in the Anime "Naruto". You need Naruto (and the other Jinchuuriki) , but you don't want him here (Because of Kyuubi), because you think he is the Kyuubi just reincarnated into a Human. (Sounds dumb to me, if you ask me.)

 

[StoPCampinGn00b]

https://developers.google.com/webmasters/hacked/docs/request_review
Apparently you must request a malware review to google to get it removed.

 

[Ralle]

I have been in touch with Google now, it should be fixed.

 

[MogulKahn]

It is not fixed. I am getting this warning every time I try to download a map!

 

[Ralle]

Alright. Time to contact Google...

 

[deepstrasz]

Just to emphasize:

 

[Sclammerz]

Yes, this happens to me too several times by downloading some textures.

 

[Shar Dundred]

Too, just downloaded my very own campaign.

 

[Ralle]

I am working on it...

 

[Emm-A-]

these false-positives are quite common throughout all modding communities though, so no need to worry too much, I guess ...

 

[Ralle]

Oh I worry. I would hope that everyone take it seriously as it usually is a bad thing. Just not here.

 

[Stefan.K]

Same with the models section, I tried to download my yesterday uploaded model and get the same warning.

 

[Ralle]

A few days ago we were marked as safe by Google yet again.

 

[Emm-A-]

good job Ralle!

 

[Kazeon]

A few days ago we were marked as safe by Google yet again.

The red page is appearing again :/ I can't download anything from resource section.

 

[Emm-A-]

It is the same for me. I tried it right now when I saw Quilnez' message.

Is there the possibility that someone hacked hive or the rating processing by google to sabotage hive?

 

[Ralle]

Yep it's back as of today. Google is sabotaging us 2-3 times per week with this malware warning. I appeal it the same day and they remove the mark the day after.

 

[Ralle]

And it's gone again as of last night.

 

[Mister_Haudrauf]

Hmm.... I have a hunch that it won't last and appear again.......

 

[Ralle]

I am making some experiments to make it keep. I will continue to appeal when it happens though.

 

[Kazeon]

Holy moly. It's back guys! Hold on tight!

 

[GhostWolf]

At worst, you can split the JNGP zip into 2+ parts and zip that. It will be slightly annoying for users, but that was always my strategy of avoiding detection when sending executables with any Google service.

 

[deepstrasz]

Holy moly. It's back guys! Hold on tight!

There is clearly a conspiracy in the midst. The Warcraft community is being targeted for some reason.
Joking of course. It's just that programs are not competent on fragile situations but usually on mass scale problems.

 

[Ralle]

And it's gone.

 

[deepstrasz]

And it's gone.

Hey Chief, is the site flooded from time to time? I've been having slight latency connecting to it for some weeks now.

 

[Ralle]

Flooded? Please make a new thread instead of going off topic