Virus Alert?

[Springheel]

Is anyone else getting odd virus alerts after visiting the forums? It could just be a coincidence, but every time I go onto the forums from one of the computers here at work, I start getting a "generic dropper.va.al virus warning.

[Bikerdude]

I've been on them all day, so as you suggested a coincidence. Did a search, that virus is a trojan - contact your internet IT bods as it looks like yer infected.

 

- info

[7upMan]

I did catch a Trojan on Monday, which installed "Windows 7 Repair", a scareware. I don't know how I got it, I suspect a drive-by download. However, I have no idea of where it came from.

[Johannes Burock]

7upMan got a second trojan today directly after visiting the forum today (with the internet explorer).

W32/Kryptik (or something like this).

also his laptop is infected now too...

Edited June 30, 2011 by Johannes Burock

[Bikerdude]

Im running kaspesky and it hasent popped uyp with anything, so I myself dont think its this forum but rather that they have been infected prior to visiting..

[Johannes Burock]

the forum was the only one which 7up visited... when he got into the forum a popup came which want to install javaw.exe and after this (WITHOUT installing this) it was to late...i also havent any problems with my system...but 7upMan had this prob two times on two different pcs...

[Springheel]

I haven't had any problems at home either. Could it be an IE issue? I don't use IE except at work.

[Johannes Burock]

I haven't had any problems at home either. Could it be an IE issue? I don't use IE except at work.

 

maybe, i also use another browser. and all other ones without problems also do...i wont test it

Edited July 1, 2011 by Johannes Burock

[Serpentine]

I checked out all the javascript and such last night, but didn't see anything. If anyone gets a warning, could they give me the complete URL of the page? It could be something in a sig etc. Don't have any boxes running windows with working IE, so a bit tricky to test if was to be something more than simply looking for an IE user-agent, hmmm.

[Johannes Burock]

It's most probably an IE problem. 7upMan had this attack on a Windows 7/IE 8 and a Windows XP/IE 7 system. Both had no other firewall but the Windows Firewall enabled. Also, both systems were running the ESET NOD32 anti-virus.

[stumpy]

if your using internet explorer then it might have installed via activex as its solely used by internet explorer, firefox doesn't use it, it uses something like flash or an applet, you might have got it following offsite links to youtube, youtube is full of google adverts since they brought the site and most of the scareware, malware, spyware usually gets delivered via a activex or flash google advert as these autorun as soon as you visit a site with them. there was a recent update to flash its now something like 10.3.181.26 security update.

 

according to the traffic log in my firewall, being on this site also says am getting information from youtube.com, gravatar.com, google-analytics.com, msnbc.msn.com, msnbc.rd.llnwd.net, msnbcmedia.msn.com, msnbc.jump-time.net, modetwo.net, mindplaces.com

 

and the firewall is blocking something trying to come to my computer via remote port 1900

 

packet logs says its blocking gravatar.com packets.

Edited July 1, 2011 by stumpy

[Tels]

packet logs says its blocking gravatar.com packets.

 

Oh, yeah, blocking gravatar.com (via AdBlock or whatever) is a good idea. Especially their "blank_avatar.gif" with 1x1 pixels. It is just used to track visitors, and I don't like to be tracked by random third-party websites...