Article View: microsoft.public.security
Article #12Re: Why/how does Antivirus 2009 malware popup attach itself to certain links?
From: John Mason Jr
Date: Sat, 03 Jan 2009 19:44
Date: Sat, 03 Jan 2009 19:44
42 lines
2764 bytes
2764 bytes
Doc wrote: > There's a website for a couple of famous jazz trumpeters, the late > Candoli brothers. > > hxxp://www.candoli.com > > It's a legitimate site, these guys were icons. There's a photo in > their gallery of Pete playing wearing a Superman suit. I posted the > direct link to it in a trumpet forum. > > hxxp://www.candoli.com/pic28.htm > > Several people reported that clicking the link brought up that > Antivirus 2009 malware bogus alert. I tried it and got the same > thing. > > How does that Antivirus 2009 page hijack attempts to go to other sites > like that? How does it get attached to certain ones? > > How is it these people haven't been shut down? Modified the links There are really two options 1. The owners of the website are part of the group making money from sales of rogue software 2. Most likely the owners of the site don't know how to properly secure their site and it is vulnerable to exploits that allow a third party to modify the content. You can find more info at <http://badwarebusters.org/> If you put the url into http://unmaskparasites.com/ you can see that it is redirecting traffic to malicious sites John
Technical Details
Message-ID:
<gjof84$d01$1@news.motzarella.org>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!news.germany.com!news.motzarella.org!motzarella.org!news.motzarella.org!not-for-mailReferences:
<6a82feef-8a3a-4042-bfd0-684ce1e56ad3@l39g2000yqn.googlegroups.com>Show Full Headers
Complete Article Headers
X-Google-Thread: f9855,76f4f8cd2b965afc X-Google-Thread: fe5ee,76f4f8cd2b965afc X-Google-Thread: faa3c,76f4f8cd2b965afc X-Google-Thread: fcd68,76f4f8cd2b965afc X-Google-Attributes: gidf9855,gidfe5ee,gidfaa3c,gidfcd68,domainid0,public,usenet X-Google-Language: ENGLISH,ASCII-7-bit Path: arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!news.germany.com!news.motzarella.org!motzarella.org!news.motzarella.org!not-for-mail From: John Mason Jr <notvalid@cox.net.invalid> Newsgroups: microsoft.public.security,alt.windows-xp,24hoursupport.helpdesk,alt.comp.virus Subject: Re: Why/how does Antivirus 2009 malware popup attach itself to certain links? Date: Sat, 03 Jan 2009 14:44:49 -0500 Organization: A noiseless patient Spider Lines: 42 Message-ID: <gjof84$d01$1@news.motzarella.org> References: <6a82feef-8a3a-4042-bfd0-684ce1e56ad3@l39g2000yqn.googlegroups.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Trace: news.eternal-september.org U2FsdGVkX19BQ7RivnrTe7DVDF1YxEZy/y9eA0lLVQwzmTGkc2yPfRiM7MqCA0S4qe8/g1D80/3RlExVB8UHHoUjP6P4pYpZ5hMB5WiETmF27TdBIHHM2Bgw18zb1yNH7kOe6JmU9bY= X-Complaints-To: Please send complaints to abuse@motzarella.org with full headers NNTP-Posting-Date: Sat, 3 Jan 2009 19:45:08 +0000 (UTC) In-Reply-To: <6a82feef-8a3a-4042-bfd0-684ce1e56ad3@l39g2000yqn.googlegroups.com> X-Auth-Sender: U2FsdGVkX1/o7s8lZ8Vl3X4+qVaex78zUFe4Jdt+S8htFk5sHbeBLg== Cancel-Lock: sha1:zH28KdJBzBSP8m0pMhvMivzWovM= User-Agent: Thunderbird 2.0.0.19 (Windows/20081209)