Antivirus 2009 / "windows-defense.com" redirect & alert popup - resolved.

[jwxr7]

I'm not sure if this is related.

I've had 2 high level attack warnings on my work computer, both times I was opening this website. I've never had notices like this until then. Once on the 25th and then again on the 30th of july.

I don't know if this info helps but the Norton details say;"risk level High"
"risk name HTTP fake scan webpage" and "attacking computer 84.16.252.73, 80" "traffic description TCP ,www-http"

the second one was identical except the attacking computer # ended in 138, 80.

hope this helps

[MetroMPG]

Thanks for posting the IP. The "attacking computer" is not EcoModder's IP address, but the address of the redirect target, which is in Norton's list.

[cfg83]

MetroMPG -

Originally Posted by MetroMPG

Note that the popup does not mean you're infected with anything. It's simply a javascript redirect to a website which causes the alert and displays the fake virus scan progress. Just close the browser window.

I'm sure everyone knows that if you actually download and install the product from that site, you WILL be infected with malware.

Our server admin has checked and assured us the problem isn't on EcoModder, but with one of the advertisers whose ads appear on the site. We've been in touch with the advertisers. Waiting to hear back.

I think it happened to me because I had temporarily turned off my third-party pop-up blocker. I had not been to any other websites before this. That it came from the advertiser makes a lot sense.

CarloSW2

[MetroMPG]

I've turned off all advertising in the forum and on the index page. It's still active on the blog.

We'll leave it off for 24 hours. Would each of you who has experienced the redirect and the javascript alert (I count 10, including myself... I've seen it twice in the last week) please let me know whether you see the redirect or not in the next 24h?

I fully expect this will clear things up. Then the next task will be determining which ad service is sending the javascript.

Thanks!

[cfg83]

MetroMPG -

I just tried to recreate the problem but I couldn't.

CarloSW2

[skyl4rk]

no more problems here, multiple log ins

[MetroMPG]

If nobody tells me they got the redirect/popup before tomorrow AM, I'm going to re-enable one of the ad providers and then watch for feedback for another day or so. Currently we've got two providers (just canned the third, and Ben thinks they were the most likely source of the problem).

[trikkonceptz]

No problems today .. so far, I have been logged in since 9am est

[Wonderboy]

I've been seeing a lot of this lately. A lot of my clients are getting it. No one knew how to get rid of it when it first came out, but aside from the links posted above (I haven't tried any of them), Malwarebytes is the only thing that can *easily* get rid of this trojan. Everyone's virus scanner is missing it because it's not technically a virus - it's malware. People think it's something they need or that it's legit, so they click on it... The best I can do is advise people to use firefox and not to open emails from sources they don't know, but even then, it's difficult to train people (especially OLDER people) to identify false popups. I can smell the bull**** in a split second, but a lot of people just click away happily and let the trojan in.

One guy got it from an actual fedex email, so caution there. It is advisable to install Linux or get an Apple ASAP - You'll never have problems like this again :-P. For now install Firefox and Thunderbird.

I get paid to deal with things like this, and as much as I like making easy money running Malwarebytes and virus scans, the world is a lot better off avoiding these problems to begin with.

[MetroMPG]

So? Anyone else seen a redirect/popup since Friday afternoon @ 3:30 ET?