Trojan virus?

Flintlocker · #1 07-23-2012, 11:14 AM

Whenever I check in my software blocks a virus here. Today was the second time it happend. Idon't know if it's on my end or yours. BTW, I use norton. Has anyone else had this problem??

Mainspring · #2 07-23-2012, 11:32 AM

No, I have not had a problem. Microsoft Security Essentials and Firefox.

MikeG · #3 07-23-2012, 12:35 PM

It's a false positive.

By the way, I'd recommend practically any other product than what you have. See all kinds of issues with it. Sorry.....

fred243 · #4 07-23-2012, 12:36 PM

I too use Microsoft Security Essentials and Firefox, also use the paid premium version of Malwarebytes. Malware has been blocking things for several weeks now on this site, malicious pages. It's every single time I come to this site ! I've never had this problem with any other site nor have I had problems with Malwarebytes. I mentioned it a couple of weeks ago on here but no one responded.

MikeG · #5 07-23-2012, 12:38 PM

False positives happen with all brands of security software. If you can identify the actual page / source, I'll send it on to the developers. It's probably flagging an ad for some sort of perceived bad behavior.

Send whatever info/logs you have, via the "Contact us" link at the bottom of every page.

Flintlocker · #6 07-23-2012, 01:27 PM

Microsoft safety scanner id's it as Trojan Gen 891t.tmp. And it just came up again! ****...

UnCruel · #7 07-23-2012, 01:50 PM

I'm not sure it's a false positive. I've been thinking this site is infected with something. I was on a thread discussing scopes, and the first appearance of the word "nikon" was a link to some ebay auction. After checking the same thread a few times, I noticed that the word was not a link, and then a few seconds later, it became a link. Then, I posted a reply, which also contained the word "nikon", and later when I read my reply, it contained a link -- one that I didn't put there. I scanned my computer and found nothing. I visited the page from another computer, and the same thing occurred. I checked from a text-only browser, and it did not happen. My best guess is that it is implemented through some javascript delivered from the web server. I didn't mention it, because I thought it might have been intentional, a source of advertising revenue along with the ads. But seeing this conversation makes me wonder.

UnCruel · #8 07-23-2012, 01:51 PM

There you go. Do the words "nikon" and "ebay" show up as links for you? I didn't create any links.

Edit: A little digging shows that this comes from viglink.com. I'll assume this is intended functionality for the forum. Anyway, I wouldn't be surprised if scanners intended to block adware might judge it to be undesirable.

MikeG · #9 07-23-2012, 04:33 PM

Yes, links appearing are normal. It's called slipware (?) I think that common on many forums, not just this one and not just shooting forums.

Can you get any info or logs at all from your security software that would indicate a particular page, or ad?

MikeG · #10 07-24-2012, 06:29 AM

Just received this from the developer:

Quote:

Hey guys - I just spent the last two hours doing an intense security audit of both shootersforum and SB, and found no issues. Additionally, google is not indicating any security issues, either.

Mike - Please post a notice to those users who are having issues and have them capture the source code of the page and email it to me next time they get a virus warning (Right click on the page, view source). That is the only way for me to see what code is potentially causing the issue.

We'll get this pinned down eventually. The only real thing that matters is that google isn't seeing anything, which means our SERPs are unaffected by this.

kyew · #11 07-24-2012, 01:43 PM

Quote:

Originally Posted by MikeG

It's a false positive.

By the way, I'd recommend practically any other product than what you have. See all kinds of issues with it. Sorry.....

I concur. I've never used Norton, but I've worked on many people's PCs that use it, and I've got nothing good to say about it.

kyew · #12 07-24-2012, 01:51 PM

Quote:

Originally Posted by UnCruel

I'm not sure it's a false positive. I've been thinking this site is infected with something. I was on a thread discussing scopes, and the first appearance of the word "nikon" was a link to some ebay auction. After checking the same thread a few times, I noticed that the word was not a link, and then a few seconds later, it became a link. Then, I posted a reply, which also contained the word "nikon", and later when I read my reply, it contained a link -- one that I didn't put there. I scanned my computer and found nothing. I visited the page from another computer, and the same thing occurred. I checked from a text-only browser, and it did not happen. My best guess is that it is implemented through some javascript delivered from the web server. I didn't mention it, because I thought it might have been intentional, a source of advertising revenue along with the ads. But seeing this conversation makes me wonder.

What you've mentioned is common with the various "toolbars" that certain borderline reputable programs require to be installed to use their software. Not saying that's what it is specifically, but if you remember adding any programs lately, or if you have any new toolbars in your browser tab space, that may be the cause.

They're basically innocuous, but can send up red flags on a lot of anti spy-/mal-ware programs. The worst of them track your cookies (like Facebook does) and use the information to design ads for you specifically.

Cheezywan · #13 07-24-2012, 04:32 PM

Mike - Please post a notice to those users who are having issues and have them capture the source code of the page and email it to me next time they get a virus warning (Right click on the page, view source). That is the only way for me to see what code is potentially causing the issue.

That part is clear enough. Not sure who to e-mail it too though?

I have seen trouble like this before. Is in some other thread by member Davers I think? I have no trouble right now though!

Cheezywan

MikeG · #14 07-24-2012, 05:40 PM

Use the "contact us" link at the bottom of every page and it will get where it needs to go. Good question Cheezy!

kyew · #15 07-24-2012, 06:50 PM

Quote:

Originally Posted by cvc944

Norton is an industry giant, and as such, the people who wreak havoc writing malicious code go gunning for. I use Panda.

Yep, same as MicroSoft. That's the main reason I switched to Firefox from Internet Explorer. I wish I could make as easy a switch to another operating system like Linux.

As for PC protection, I use Spybot S&D. If you have it set right and know how to use it, it's really all you need. It's all I've used for the past ten years or so.

Cheezywan · #16 07-26-2012, 04:28 PM

Here is what I can offer right now. I have two pages up and am logged in as me on both.

McAfee header at the top of the pages says, "We tested this page and blocked content that comes from potentially dangerous sites. Allow this content only if your sure it come from safe sites."

Choice is between "X" and " View all blocked content".

I see no option to view what the "blocked content" might be? Allow or ignore is a tough choice!

For now, I have chosen to NOT view all blocked content. Don't care to be a "crash dummy" .

I really enjoy reading this board though. Not sure how to help?

Cheezywan

Cheezywan · #17 07-26-2012, 04:49 PM

Playing around a bit. Might be the banner at the top of each thread? Some are not displayed here and I get no warning from McAfee when they don't show up.

Don't know. Just posting what I see.

I really should be be making ammunition right now. Need food and sleep too!

Shower done. Cases primed.

Food and sleep on the menu.

I have ammunition and reloads can wait!

Cheezywan

fred243 · #18 07-26-2012, 07:39 PM

I received another warning when I clicked and entered the general discussion area again. It had the same website number that I gave already the 64.34. whatever the rest is, can't remember off hand. They always have a different port number though.

MikeG · #19 07-26-2012, 07:44 PM

If you can make a note of the complete IP address and any ports, that would be much appreciated.

Note that some security software will give warnings based on perceived behaviors of web pages, not confirmation that there is an actual problem.

Davers · #20 07-27-2012, 02:17 AM

Quote:

Originally Posted by Cheezywan

Here is what I can offer right now. I have two pages up and am logged in as me on both.

McAfee header at the top of the pages says, "We tested this page and blocked content that comes from potentially dangerous sites. Allow this content only if your sure it come from safe sites."
Choice is between "X" and " View all blocked content".

I see no option to view what the "blocked content" might be? Allow or ignore is a tough choice!

For now, I have chosen to NOT view all blocked content. Don't care to be a "crash dummy" .

I really enjoy reading this board though. Not sure how to help?

Cheezywan

I've seen this pop-up here on numerous occasions. I just don't "click" on those sites.