FAO NEAL: Reported Attack Site? Anyone else getting this too?

[joea]

That's exactly what I just got! I got a pop-up saying AVG blocked a trojan (forgot the name) when I got on here. Same .cc url. Didn't have the presence of mind to take a SS.

[Elder-Pirate]

Just happened to me, I've AVG and it said "Threat Blocked". Evidently it was as everything OK on my computer at moment.

We have some very screwed up people in this world whom just love doing things like that.

BTW Neal. I'm running IE8.

[Elder-Pirate]

OK I just tried to change pages and

Only here at Subsim, must be a cure.

[JScones]

Originally Posted by Seeadler

I'm strongly believe that the suspect codes are loaded through the add's on these pages, because with active AddBlocker Plus, KAV reports no trojans downloads.

Therefore the data center found no malware / spyware / trojans in the hosted data of Subsim.com because they are only loaded at execution time depending on how a browser and his installed browser addon's are configured.

Also no trojan downloads when I use the FF addon "NoScripts" and block all execution of scripts from the forum page.

That's been my suspicion too. I think there's no doubt that subsim.com itself is free from trojans.

I now only access this site through my 64-bit IE9 browser, no flash installed, and haven't had the warning since.

Notwithstanding different virus scanners/firewalls, I think the "appearance" certainly depends on what is installed on the client's PC, viz java, flash, ad blockers etc. A certain combination is what "sparks" the code, dropped into the third-party ads (or, perhaps possibly, some other feature/function that has been enabled on subsim that requires/uses java?), to start running on the client's machine.

[Reece]

All is working now, I did just update to the latest Ad-Aware that found a couple of items and had to reboot that ran a dos clean app, I then tried FF, re-ticked the "Block reported attack sites" and no problems!!
Now whether this is due to a Trojan (though I doubt it), or Subsim has been wiped off Googles attack site list I don't know!
Good news anyway.

[swamprat69er]

AVAST just warned me that this is malware. First time for me.

[swamprat69er]

malware name Win32:Bamital-AG [Drp]

that is what AVAST just told me

[Onkel Neal]

Ok, contracted rack911 to start working on this.

My first thought was ads, too, but I am still worried enough to keep plugging away at this (through IT experts).

If rack911 cannot find anything wrong, I don't know what.

[Reece]

Originally Posted by Neal Stevens

Ok, contracted rack911 to start working on this.

My first thought was ads, too, but I am still worried enough to keep plugging away at this (through IT experts).

If rack911 cannot find anything wrong, I don't know what.

I don't know much about this sort of thing but I'm 99% sure the problem, now gone, wasn't due to anything I did, are you sure the problem still exists?
Maybe they were in the ad links, now they have been taken off is it possible that Google has detected that your site is now clean and all is well again!
Just a thought!

[Onkel Neal]

You may be right, Reece, but some people are still reporting vague malware concerns.

[Reece]

Originally Posted by Neal Stevens

You may be right, Reece, but some people are still reporting vague malware concerns.

With all of this hype it has probably made a lot of people paranoid and after a lot of virus/malware updates done to their systems they are only finding what they already had but not detected before, might pay just to sit back and see what happens.
Maybe see if anyone is still getting the "Reported Attack Page" red banner now!

[SeaWolf U-57]

Why are people getting paranoid about the red warning messages produced by
Your browser these are just that warning messages nothing more the Trojan or
Redirectors depending on what type of attack you may receive will be shown by
Your own anti-virus software as show by the Elder-Pirate post above.
And as for the adverts producing the attacks this was said in some of the
first thread posts that had been left out in the merging of the threads

[Reece]

Originally Posted by SeaWolf U-57

Why are people getting paranoid about the red warning messages produced by
Your browser these are just that warning messages nothing more the Trojan or
Redirectors depending on what type of attack you may receive will be shown by
Your own anti-virus software as show by the Elder-Pirate post above.
And as for the adverts producing the attacks this was said in some of the
first thread posts that had been left out in the merging of the threads

Not everyone, some, like me are a little paranoid!! I updated both Ad-Aware and Avira, Ad-Aware then found 3 worms and Trojan, if I did others probably did as well, thing is it might all be over! Hopefully anyway!

[Oberon]

Originally Posted by Neal Stevens

Thanks, Jamie. I need to know:

Which exact page was he on when he got the warning?

I removed the Google ads from the forum and the main subsim.com page two weeks ago, was it another page on the website, such as one of the reviews or such?

That string does not exist in the forum database, other than the PM and this thread where you describe it.

Sorry Neal, didn't see this sooner, it was this page:
http://www.subsim.com/radioroom/show...37181&page=117

Although I actually linked him directly to my post on that page which was:
http://www.subsim.com/radioroom/show...postcount=1748

Which does not have any visible adverts on it...

[Oberon]

Originally Posted by Reece

With all of this hype it has probably made a lot of people paranoid and after a lot of virus/malware updates done to their systems they are only finding what they already had but not detected before, might pay just to sit back and see what happens.
Maybe see if anyone is still getting the "Reported Attack Page" red banner now!

I've reactivated my 'Reported Attack Page' alert thing on Firefox, so I'll let you know if it crops up again...so far though it's clean, I've been in the General Topics thread and here...I'll just go and check the Screenshot thread...no...no problems there.

Bizarre...