Life In 19x19

I signed up for the 1$ trial, and though 20$/month is still a lot more than the only thing I can even somewhat compare it to (KGS Plus), I think it's cheap enough. Besides, I think if western go players want more initiatives like these, we should support your efforts.

Though I was mainly interested in the becoming 5 kyu series, I was a bit surprised to find it's mainly variations on the same opening. But then I started enjoying looking at the same thing from all sorts of different angles, and I have learned quite a bit from them, actually. I love the game commentaries. The searching for exquisite games series is awesome (I loved the old Korean sports professor who talks about the Cho Hunhyun game: such absolute love for the game). Thanks to everyone involved in creating this.

edit2: Turned out to be a false positive.

My AntiVirus Software currently prevents me from entering the site, saying that there is a danger of malware.

Could be false alarm. Or another server where advertisement is stored got hacked, or someone hacked gogameguru (who would do that?).

I will send david an email right now.

edit: I didn't want to start another thread because I think this will be resolved quickly, and I don't want to damage gogamegurus reputation as much, because I like the service.

Thanks for letting me know. I'd rather hear about the occasional false positive than not find out if the site really is hacked.

That being said, I've just spent several hours checking everything out and I can't find any evidence of a hack or malware.

We have quite a lot of security measures in place and our (fairly expensive and security conscious) web host backs up everything and scans for viruses daily.

On top of that, we have another third party service that does daily backups, scans for viruses, and emails me a daily report listing any files that have been changed between backups.

I check that report almost every day and recently only jpg and sgf files have been created or modified on the server, which has been when we've added a new article or video.

I've scanned our files again, reviewed all the changes for the last couple of months and also done some manual checking of high value files and logs, and I can't find anything suspicious.

Which antivirus software are you using? And are you locked out of the whole site, or just specific pages? Does the software give an explanation of what it thinks is the problem?

Is anyone else seeing this problem with their antivirus software?

According to all these guys, the site is clean:

http://safebrowsing.clients.google.com/ ... meguru.com
http://safeweb.norton.com/report/show?u ... meguru.com
http://sitecheck.sucuri.net/results/gogameguru.com
http://www.yandex.com/infected?url=goga ... om&l10n=en
http://www.avgthreatlabs.com/sitereport ... avg.com.au

Also, there's nothing on PhishTank: http://www.phishtank.com/

And McAfee and TrendMicro hadn't scanned our site when I went and checked.
http://www.siteadvisor.com/sites/gogameguru.com
http://global.sitesafety.trendmicro.com/

Here are some possible theories:

The site really is hacked, but we don't know yet. If anyone is seeing a message about a problem, please let me know which antivirus software you're using and what it says is a problem and what specifically it's saying.

Websites these days are made up of various components from other sites (e.g. Facebook 'Like' buttons and so on). Maybe one of those sites has been hacked, but that seems unlikely. One time our mailing list provider had a false positive and people got a warning when they tried to subscribe to the newsletter for about a day.

One other thing I can think of is that there's a very small amount of obfuscated javascript on the Baduk TV Live page: http://gogameguru.com/baduk-tv-live/ - which is only visible to logged in subscribers. It's not really necessary, it's just there to frustrate script kiddies who want to try to jack the live stream. It might be raising an eyebrow with your virus checker, because malware is sometimes obfuscated too. I can remove it if it's causing an issue, so please let me know. This seems more plausible to me.

Maybe something could have happened with an IP address being flagged as malicious because of another site that uses the same CDN as us?

The only other thing I can think of is that someone has reported the site maliciously, which happened once before and it turned out that someone out there just didn't like us . This is also possible.

Does anyone have an update or any information about this either way?

As you can imagine, it's a matter of some urgency for us, so any information about whether or not people's antivirus software is flagging any problems on the site would really be appreciated. I still haven't found any problems from our end.

edit: Turned out to be a false positive.

After reading about what you go through to keep the site clean, I'm quite convinced it is a false positive.

I use Avira AntiVirus Premium 2012. Here is what I get when I surf to ggg.com (german message though):



If you follow the link, it describes malware as bad programs like Adware, Spyware, Trojans, Backdoors, Bootviruses, Exploits, Viruses (macro, polymorphic, script), etc. ...

No idea what triggers it.

Thanks, I'll contact them to see what they think the problem is.

I use avast! Antivirus. Nothing comes up.

I checked again just now and it is gone.

Ok thanks guys.

They still haven't replied to my email, but it seems that it was a false positive. Thanks for letting me know anyway.

I eventually got this reply from them, saying there's no problem.

Avira Support wrote:Dear David Ormerod,

Thank you for contacting Avira.

As base from our testing on our side, we doesn't find any detection sign from Avira on : http://gogameguru.com/

Thus, kindly perform an update of your Avira and check whether the issue persist.

If the reported issue persist, we would like to request for a copy of support collector for further analysis on the reported issue.

How to generate support collector report:
1. Please download the AntiVir Support Collector from the following URL and save to your computer e.g Desktop:
- http://professional.avira-update.com/pa ... tor_en.exe
2.Double-click on this file to run "Avira Support Collector".
3.Click on "Start" then fill in your name and email address.
4.Please make sure that under "Please Chooose a mode", the Value is set to "Default".
5.When done, the Support Collector will generate a ZIP file with the name "AVSUPINF.ZIP" on your desktop.
6.Please attach this file to your email and send it back to us.

After we finished analyzing your data, we will send you an email with further instructions.

Hope to hear from you soon.

Thank you.