WARNING! Sega Everdrive website on Google

EDIT: Going to the site by typing it in manually does not do this, its only from Google Search

It seems if you search for the Sega Everdrive or Krikzz on Google, and click the link you get redirected to a website that downloads a virus. I have tested this on 2 computers using 3 different browsers. If you have a sandboxed or VM setup and want to test it and be a third-party confirmer, go ahead, otherwise, stay away from clicking on those links from a Google Search result.

I stumbled upon this problem by accident. See here for reference:
http://www.assemblergames.com/forums...forum-down-%28

Also I put this thread in this forum for views as it might be important.

havent read the assembler games thread, but does krikzz.com redirect to this?

I tried to go there a few hours ago and nothing came up.

Quote:

---

Originally Posted by Lastcallhall

havent read the assembler games thread, but does krikzz.com redirect to this?

---

Sorry I updated my post. If you have it bookmarked or go there by typing it in manually, it is fine. The problem only is if you try to go there from a Google Search result.

It's not fine if you try to go to the forums by bookmark. It's down. Probably related, though.

I just used accessed Krikzz.com and shop.retrogate.com websites successfully using my bookmarks with no problems. I'm not about to google it though, lol.

Yup, I just went to krikzz.com earlier as well, I didn't type the whole URL in just used it from memory and it went to the correct site. I don't use google anymore so that shouldn't be a problem. Thanks for the warning.

Wow I downloaded that thing and tried to install it many times. Maybe I'm infected?

Quote:

---

Originally Posted by Drakon

Wow I downloaded that thing and tried to install it many times. Maybe I'm infected?

---

It was a Flash player from the filename. I tested a download on a PC with MSSE installed and it picked it up right away. I didn't try to figure out what it does. Maybe if I am bored later and it still isn't fixed. :)

I just finished re-installing windows, that virus nuked my machine good. I guess I was stupid to automatically trust something linked from google to krikzz.

Wow, I was unaware that viruses could be coded to only go off when visited through a Google link...

Makes no sense why they wouldn't want to virus to infect as many people as possible though, but anyone who makes a virus is a fucking idiot anyway...

It's back up to normal now.

Quote:

---

Originally Posted by Metalwario64

Wow, I was unaware that viruses could be coded to only go off when visited through a Google link...

Makes no sense why they wouldn't want to virus to infect as many people as possible though, but anyone who makes a virus is a fucking idiot anyway...

---

Not really coded to go off, it's more likely that they hiacked the google result. So you aren't going to the page you want, you are clicking on a link you THINK is going to the proper page but instead going somewhere else (at least partially) that has an infected payload attached to it.

It's easier to do it that way because all they need to do is get some bogus google search results up and basically have a short redirect to a page they own already... why bother trying to pwn an actual site if you don't need to?
And it's easy enough to simply pass the user onto the proper page while the payload is already initiated.

Quote:

---

Originally Posted by Drakon

I just finished re-installing windows, that virus nuked my machine good. I guess I was stupid to automatically trust something linked from google to krikzz.

---

When you end up at a place you didn't expect, check the URL. That fake Adobe page had neither a Krikzz or Adobe URL. And all the hover links pointed to an even different site, some sort of Russian Email host.

Quote:

---

Originally Posted by Da_Shocker

It's back up to normal now.

---

I just checked and confirmed. That's good!

Quote:

---

Originally Posted by Tripredacus

When you end up at a place you didn't expect, check the URL. That fake Adobe page had neither a Krikzz or Adobe URL. And all the hover links pointed to an even different site, some sort of Russian Email host.



I just checked and confirmed. That's good!

---

Yeah it was dumb of me. I really just didn't expect that sort of thing with google. whoops.