Malware Warning Today

**Redbush54** · 27 October 2010, 8:37 am

I received the malware warning from my antivirus program today. Here's the info I have from Google:

Diagnostic page for affiliateguarddog.com/forums

What is the current listing status for affiliateguarddog.com/forums?
Site is listed as suspicious - visiting this web site may harm your computer.

Part of this site was listed for suspicious activity 1 time(s) over the past 90 days.

What happened when Google visited this site?
Of the 173 pages we tested on the site over the past 90 days, 6 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-10-27, and the last time suspicious content was found on this site was on 2010-10-27.
Malicious software includes 6 exploit(s). Successful infection resulted in an average of 2 new process(es) on the target machine.

Malicious software is hosted on 1 domain(s), including cazesem.co.cc/.

1 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including dofyxim.co.cc/.

This site was hosted on 2 network(s) including AS31708 (COREIX), AS32181 (ECOMD).

Has this site acted as an intermediary resulting in further distribution of malware?
Over the past 90 days, affiliateguarddog.com/forums did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?
No, this site has not hosted malicious software over the past 90 days.

How did this happen?
In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

**Webzcas** · 27 October 2010, 8:40 am

I can't get hold of Andy today yet, having just seen these reports this morning. However as I host AGD for him, I am going to roll back the site to last months backup. The database and forum posts will be unaffected by this.

This appears to be an injection attack utilising a hole in part of the code used on the site.

**Former Member 14** · 27 October 2010, 8:53 am

Hi Dave,

There's been an issue with the home page for the last few days. Seemed to be coming from the top banner on the home page.

Just now went to access the forum directly and got this, which I was not get via the forum 14 hours ago.

Cheers

Dave

**Webzcas** · 27 October 2010, 9:03 am

Ok, I have just restored the site from the end of Sept backup bar the databases. Can you check now.

Edited to add, the forum has been reported to google. So ideally I need to people to check the forum out now, who have sufficient AV software on their local machines.

Thanks

**Dominique** · 27 October 2010, 9:17 am

I am in and it looks to be fixed.

**TheCanadianGambler** · 27 October 2010, 9:25 am

I just browsed the forums quite a bit, went to the home page, haven't gotten any virus warnings, using Avast which did find two things yesterday.

**thepokerkeep** · 27 October 2010, 9:31 am

I'm still getting the warnings (probably because Google hasn't recrawled the site yet) but my scans are coming up clean so no spyware or malware is present.

**Webzcas** · 27 October 2010, 9:42 am

Originally Posted by thepokerkeep

I'm still getting the warnings (probably because Google hasn't recrawled the site yet) but my scans are coming up clean so no spyware or malware is present.

Yep google will still issue warnings. As they have to be requested to be removed.

**Anthony** · 27 October 2010, 9:45 am

Looks clean. Thanks Dave.

**Redbush54** · 27 October 2010, 10:32 am

I'm getting this now which is different from earlier.

Warning: Visiting this site may harm your computer!
The website at www.affiliateguarddog.com contains elements from the site mdma123.com

What is the current listing status for mdma123.com?
Site is listed as suspicious - visiting this web site may harm your computer.

Part of this site was listed for suspicious activity 2 time(s) over the past 90 days.

What happened when Google visited this site?
Of the 5 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-10-26, and the last time suspicious content was found on this site was on 2010-10-26.
Malicious software includes 66 exploit(s), 15 trojan(s).

This site was hosted on 1 network(s) including AS8342 (RTCOMM).

Has this site acted as an intermediary resulting in further distribution of malware?
Over the past 90 days, mdma123.com did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?
Yes, this site has hosted malicious software over the past 90 days. It infected 36 domain(s), including animedownloads.us/, porno-darom.ru/, tvoyapornuha.ru/.

**GFPC** · 27 October 2010, 4:36 pm

I am getting the same warning!

**Betpartners** · 27 October 2010, 4:44 pm

Same here, warning when i click through to forum

**Dominique** · 27 October 2010, 6:02 pm

Are these warnings generated by google or by your virus programs?

If they are generated by google, that will happen until Andy informs google that the issue is solved and google checks it again.

Andy wants to make sure the hole that let the malware in last time is plugged for good before he deals with the google warning.

**Betpartners** · 27 October 2010, 6:12 pm

In my case generated by Google and not my anti virus set up

**TheCanadianGambler** · 27 October 2010, 6:35 pm

All cleared up with google.

**Renee** · 27 October 2010, 7:53 pm

My virus program is still preventing me from getting to the forums, but I can get to the homepage:

Client/Server Security Agent

Page Blocked

URL: http://www.affiliateguarddog.com/forums/
Rating:
Dangerous

Threat details:

Verified fraudulent page or threat source.

To influence which pages are blocked:
# Contact your administrator about security settings on your network.
# Provide feedback to Trend Micro.

Copyright © 2003-2010. Trend Micro Incorporated. All rights reserved.

I'm also having trouble getting to Steve's GAP site. Anyone else having probs with that one?

**GFPC** · 28 October 2010, 4:17 am

Its now working for me!

**Redbush54** · 28 October 2010, 11:33 am

I'm ok now too and it was my virus proggie that stopped it not google.

**DaftDog** · 29 October 2010, 1:34 am

I'm using NOD32 anti virus and got this message when trying to access AGD's forum:

http://www.adservingmedia.org/exploi...gnedApplet.jar probably a variant of Java/TrojanDownloader.OpenStream.NAN trojan connection terminated - quarantined Threat was detected upon access to web by the application: C:\Program Files\Java\jre6\bin\java.exe.
http://www.adservingmedia.org/exploi...gnedApplet.jar » ZIP » SiteFormatHelper.class probably a variant of Java/TrojanDownloader.OpenStream.NAN trojan

**radicaldomains** · 30 October 2010, 5:58 pm

confirmed or false positive?

Thread: Malware Warning Today

LinkBack

Thread Tools

Search Thread

Display

Malware Warning Today

The Following User Says Thank You to Webzcas For This Useful Post:

The Following User Says Thank You to Former Member 14 For This Useful Post:

The Following User Says Thank You to Dominique For This Useful Post:

Virus Warnig

Posting Permissions