Topic: Lumion website does NOT contain malware.

[Remko]

For some reason Chrome started blocking Lumion3d.com. When you click on advanced options you can see that Lumion3D.com has not spreaded and is currently not spreading malware.

Using scanners for malware you can verify that Lumion3d.com is not spreading malware.

Google Report

http://sitecheck.sucuri.net/results/lumion3d.com

http://safeweb.norton.com/report/show?url=lumion3d.com

We asked google to verify the site again so the warning should disappear soon.

[TJS]

I too was blocked by Chrome. I checked the testing sites that all said Lumion site was fine and safe. I bypassed the warning and when the Lumion page loaded, my virus/network protection freaked out and blocked all traffic. So, it may be too recent for testing sites to know there is an attack. I'm using my phone to post this just in case.

If there is truley is no concern please keep us posted.

Thanks.

[TJS]

I tried it again and Symamtec Endpoint Protection came up with a Web Attack: Mass Injection Website detected. Traffic has been blocked from this application. (Chrome). Then it blocked traffic from an IP.

I don't know if this is helpful or not, but it seems something out of the norm is going on.

[RAD]

Came up through Mozilla as well.

[Daman-Lechtenberger,PC]

It was also blocked using Internet Explorer 9 with using a google search. I just typed in the website address.

[Remko]

Apparently some of the js files were modified. We rolled back an older version of the web code and locked down all files so they cannot be modified anymore. The site is clean but apparently these systems take some time to update.

We'll tighten the security on the website even more in the coming days to prevent any future issues.

[Nico RVArq.com]

Remko, I think we need to remove the Aaron Profile. In case they are looking for him.

[Remko]

Everything back to normal. The web server has been secured and all malware databases are update too so everyone should be able to visit the Lumion site as usual.

Status of the latest badware review for this site: A review for this site has finished. The site was found clean. The badware warnings from web search are being removed. Please note that it can take some time for this change to propagate.

[byzantium1200]

AVG found a trojan EXE file at my C root. I did not do anything suspicious, could this be related? Is it possible that they are trying to get our Lumion login info?

[Remko]

AVG found a trojan EXE file at my C root. I did not do anything suspicious, could this be related? Is it possible that they are trying to get our Lumion login info?

It's unlikely the two issues are related. The malicious script was on the website for a very short while and if you only visited the forum you would probably not encounter it. We did some tests and it does not look like the script actually modified the system when you visited the web site. Right now security on the website is locked down as tightly as possible so I don't think this will happen again.

[Gaieus]

My default browser is Chrome (24.0.1312.45 beta-m) but I have not encountered this issue (yet)

[RAD]

Still getting it reported as an attack site.  This time it popped up as I was trying to reply.

[speed777777]

hi remko, hope you well. kaspersky is still picking this up, this is 2nd time now.
cheers shaun.

HEUR:Trojan.Script.Iframer   Inactive   2012/12/29 07:52:43 AM   http://lumion3d.com/wp-includes/js/admin-bar.js?ver=20111130//   admin-bar   

[Gaieus]

The admin bar in WordPress is not a malware so it's apparently a false positive. Interestingly, although Lumion is a WP site and we can log in, we are not directed to the "traditional" WP back-end nor the WP admin bar is displayed for us

[Aaron]

Worked fine during most of yesterday but today Chrome is off again.