I couldn't download anything from there from my Amiga using either iBrowse or AWeb.

I poked my laptop at it, and Avast AV said it stopped a bad program....
I couldn't download from there either.
(Every thing I tried to DL actually downloads a script that's encoded, that sounds bad...)

(Note: don't go running there if you have Windows just to see if it's safe!  :-)

desiv

I got similar too for Symantec.. Probably a real threat since other Virus Scanners are picking it up..

Slightly off topic but Norton 360 always shreds Hollywood on my PC before I can use it.

Yes, aminet is infected. It attempts a drive-by attacks against windows systems via java vulnerability, at least. It likely attempts to use several attack vectors depending on the targets system: java, flash, pdf, and vulnerabilities in the browsers themselves.

Here's how you can see the initial javascript payload regardless of the platform:

curl --user-agent 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)' http://aminet.net/util/arc/lha.run | less
Modifying e(s) the end of the code to document.write(s) we can see the actual payload decoded. It opens an iframe with URL "http://.ibiz.cc/?go=2" that'll perform the actual drive-by attack:

I hope it can be sorted out, Where would we be without Aminet? :-(

Don't fear, you don't need the web for everything... yet.

Unfortunately you cannot trust anything coming from aminet at this stage. The FTP could be distributing malware as well, though luckily windows binaries are in the minority...

Thanks for pointing out the problem. Unfortunately, I'm on my way out, and I won't be back in civilisation until Sunday. I alarmed the server admin (nicomen), I hope he sees my mail asap and has the time to investigate and fix the problem.

From your post March 30, 2012 on AW, I notice:

our hoster decided to make some changes for the sake of security

Perhaps a connection?

#6

I'd like to hear an explanation for this however. Unless if the method of original penetration can be figured out and blocked it could happen again and again (as has happened with certain other amiga related sites). Also, it seems that the domain name used to distribute the malware expired (or was changed deliberately).

Some official word from aminet would be in order I'd say.