Virus on site?

[Mr Bean]

I started getting this warning from AVG on every page of the forum. Does it happen to anyone else? Is there a virus?

30665

[Brandon]

I haven't had any problems. Could be your your computer or the avg settings. Im not sure. Im no computer expert

[86VickyLX]

I notice when I make posts sometimes it asks if I want to leave the editor. idk.

[1987cp]

Methinks your computer might be sick. Run Spybot and Malaware and see if they find anything.

[79lincolnlover]

No issues with my computer.

[DuceAnAHalf]

i was getting some pop ups from opera about malicious software from this site also about 15 minutes ago, nothing now.

[tjltd]

+2 on the AVG alert, its the only site where im getting this...

[miamibob]

Quick Scan with MALWAREBYTES came up clean so who knows.....

[mcninetyone]

I'm getting the samething, the AVG warning of a virus on the site, this is also the first time I've seen this.

And this is the only site I'm getting this on, every other site I've gone to is clear.

I don't like it one bit:2down:

[tjc78]

I'm getting it too..... same message as the OP.

[Grand Marquis GT]

I also get the error. Someone may have posted a bad link in the shoutbox, who knows?

[1987cp]

Is it something that the Adblocker blacklist might be filtering for me?

[slymer]

+1 bum ad. I run adblock and noscript and never see any of that crap. Only the main sponsors that are not typical ads.

[tjc78]

Whatever it was appears to be gone (hopefully)

[1987cp]

+1 bum ad. I run adblock and noscript and never see any of that crap. Only the main sponsors that are not typical ads.

I was confused at first when someone told me another message board had a huge banner ad at the top of each page. I said "What banner ad?", then realized that my adblock stuff was blocking it for me! :2up: That was with the AdblockPlus add-on for Firefox, but I've switched to Opera with its native content-blocker and update the blacklist manually.

[85crownHPP]

There should be absolutely no advertising as of now on GMN except the two rockauto and ADTR banners at the bottom. Hopefully it will stay that way, if people will start making donations.... *hint hint*
If anyone is getting pop-ups or anything else we need to have a talk with our hosting agent!
Any one who spots suspicious links and lets us know gets a cookie!

[Mr Bean]

I am also running Adblock Plus with Firefox and don't see any ads but that AVG alert still popped up. It appears to be gone now though.

[1990LTD]

i got it too

[1990LTD]

http://www.grandmarq.net/vb/showthread.php?45356-Sometimes-Can-t-Use-quot-Back-quot-Button....&goto=newpost

[slymer]

ok... using IE I get Internal Server Error 500 and Database Error when I can't use the back button. The page still displays and all... but the back and forward buttons have those as the mouse-over links.

So that's the back button issue. Have to press back twice during those times. Still haven't run across the gaming site though.

[GM_Guy]

Please see my post in the 'I cant use my back button'. Something has been compromised.

Alex.

[Grand Marquis GT]

http://www.avast.com/en-us/lp-security-information-fp?p_ext=0&utm_campaign=Virus_alert&utm_source=prg_fav_60_0&utm_medium=prg_systray&utm_content=.%2Ffa%2Fen-us%2Fvirus-alert-default2&p_vir=html:Iframe-inf&p_prc=file://D:\Program%20Files\Mozilla%20Firefox\firefox.exe&p_obj=http://superbesttraf.orge.pl/iframe.php?id=406x8gaw3trjcn1wx4kmv41roybsmal|%3E{ gzip}&p_var=.%2Ffa%2Fen-us%2Fvirus-alert-default2&p_pro=0&p_vep=6&p_ves=0&p_lqa=0&p_lsu=24&p_lst=0&p_lex=170&p_lng=en&p_lid=en-us&p_elm=7&p_vbd=1289

[slymer]

I've got noscript blocking best-videogames.com, nbadimensions.net and cookaround.com

we already know the first one is a bad one.

The second is some NBA forum.

The third is some non-english cooking site.

This all popped up after I logged in on my no script blocked list. It is not on the front page.

I think we're falling victim to an iFrame or SQL injection hack. Updating the forum software won't do much if the host provider is not keeping the base operating system updated.

[85crownHPP]

I've got noscript blocking best-videogames.com, nbadimensions.net and cookaround.com



Found 'em and zapped 'em. Thanks for shining the light on this and keep it up!!!!

I'm wondering if I dare go to these websites and see what's up. Im running Linux and they say that's less vulnerable to dirty sites...

[slymer]

firefox with noscript pretty much makes you immune to bad sites as... go figure... the scripts won't run.

[85crownHPP]

hhmm. evidently I just made correspondence with an admin of nbadimensions.net. the plot thickens... I suspect this has something to do with crooked internet advertisers getting crooked hit counts up for their client sites... and hopefully is harmless... HOPEFULLY...

[85crownHPP]

Well, it seems his site got some bad granola a week or so ago and Google put them in a quarantine of sorts... Google doesn't flag us as "potentially compromised" so thats good.
I'll keep yous' posted on developments...

[85crownHPP]

Well, it seems his site got some bad granola a week or so ago and Google put them in a quarantine of sorts... Google doesn't flag us as "potentially compromised" so thats good.
I'll keep yous' posted on developments...

[slymer]

getting bij.pl and best-videogames.com today. the bij.pl was locking up firefox earlier (of course it hung on yimg.com too - yahoo's media servers - so take it for what it's worth)

[GM_Guy]

http://www.feedurbrain.com/forum/vb/item/config.php

Never noticed this one before in my adblock list. (also an iframe).

Alex.

[slymer]

divakreation.osa.pl in my virus scanner list

noscript is blocking these sites:
bee.pl and best-videogames.com

[1987cp]

I've been getting "Hey, I just blocked a malicious site for you" popups from Avast lately whilst browsing GMN. Just the past week or so, and not on every page. IIRC, it was always a different site that it blocked, though the three entries in the Web-block the log are all


http://minimalka10baksov.bee.pl/iframe.php?id=510|>{gzip}

Though I can't really tell whether it's "iframe" or "lframe", so it may be


http://minimalka10baksov.bee.pl/lframe.php?id=510|>{gzip}


It notes:

Severity: High
Thread: HTML:lframe.inf (or is it Iframe.inf?)
Action: Blocked

[tjc78]

AVG is popping up on every page here telling me threat blocked. Happening on two different computers.

[miamibob]

Same here! Pop-ups keep coming up asking to allow a program to run, supposedly from Microsoft. If it keeps happening I'm out of here for a while.....

[MattDoscher]

Yesterday I was getting the same attempted attacks to my computer while logged in under my profile. Thankfully my anti-virus program has been blocking the attempted attacks.

[marquisman]

yup, im gone until this shit is gone. every time it pops up, a java icon apears on the right, of my task bar. my virus software blocks it but, annoying as shit, cause it keeps poping up.

[85crownHPP]

I just nuked some of them, can't seem to find the bee.pl...

[slymer]

ecodomain.osa.pl

avast is going nuts over this one on EVERY SINGLE PAGE I load this evening.

[1987cp]

Same here, seems to be hard at it again this evening.

[slymer]

now I'm getting azzazaudi.osa.pl
lots of osa.pl tonight.

[slymer]

freaksonline.wannapornherbs.com

bah. more crap.

[tjc78]

I'm not getting anything today. I wonder if the firewalls are blocking it? When it was acting up last time I would get the Java icon in the tray.

[1987cp]

I'm having a few things.

[85crownHPP]

I believe we have found the source of the problem... please be patient while we clean up, GMN claims no liability for any computers that now have the AIDS.

[slymer]

W00T!
hurray for server anti-STD

[slymer]

feedurbrain.com > gzip iframe

[marquisman]

mmMMMmMmMMmmMMmmmm...brainnnssss....must feed.....

[slymer]

idayv.osa.pl
only on the successfully logged in page