Article View: microsoft.public.security
Article #24Re: Why/how does Antivirus 2009 malware popup attach itself to certain links?
From: David H. Lipman
Date: Sat, 03 Jan 2009 22:39
Date: Sat, 03 Jan 2009 22:39
40 lines
3809 bytes
3809 bytes
From: "Fix it" <invalid@nothing.dil> | "Doc" <docsavage20@yahoo.com> wrote in message news:9757ee95-c1d6-472b-b86f- | OK, anyone still got the link that the above thicko posted, | and if you have uptodate firewall, and use FF, | I tried it for the last time at 2209pm (UK) and got this: | Karspersky security alerted that URL redirects to Phishing site | ip identified as h**p://78.110.175.21/cp/?N | Security suite logged that site attempted 2 network attacks | and in the few of minutes with FF blocking but still listing the candoli's | site, the redirect phishing site - Karpersky alerting that the site | attempted | a staggering 1251 scans! | Then I typed that IP address into google, here is the result and it's | notoriety: | http://www.google.co.uk/search?source=ig&hl=en&rlz=1G1GGLQ_ENUK288&q=http%3A%2F%2F78. | 110.175.21%2Fcp%2F%3FN&btnG=Google+Search&meta=lr%3D | Anyone who clicked on the link in the original post to this thread | and you didn't get an alert, you need to update your security software. | Type into google "free online anti-virus scan" | or go to Trend Micro's site or Karspersky's, and click the free scan option. | Good luck, also I suggest as many as possible post a complaint to | google about the link being x-posted to so many groups by "Doc". Please do NOT post, live, malicious links unobfuscated ! And it is not a phishing site. It is a vulnerability exploitation site. http://isc.sans.org/diary.html?storyid=5440 -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
Technical Details
Message-ID:
<ce6dnXMTpvijdMLUnZ2dnUVZ_oPinZ2d@giganews.com>Path:
arc1-ca.pugleaf.net!g2news2.google.com!news1.google.com!Xl.tags.giganews.com!border1.nntp.dca.giganews.com!nntp.giganews.com!local02.nntp.dca.giganews.com!news.giganews.com.POSTED!not-for-mailReferences:
<6a82feef-8a3a-4042-bfd0-684ce1e56ad3@l39g2000yqn.googlegroups.com> <gjof84$d01$1@news.motzarella.org> <5ead3fa6-f549-4c31-83ff-7f96681daafd@f13g2000yqj.googlegroups.com> <83d7c6f7-d0c1-41c5-a963-536d6ed033db@z6g2000pre.googlegroups.com> <VtednVOwcfiBW8LUnZ2dnUVZ8tXinZ2d@bt.com> <9757ee95-c1d6-472b-b86f-af461f331e09@s37g2000vbp.googlegroups.com> <ifKdnS7d356sdcLUnZ2dnUVZ8i-dnZ2d@bt.com>Show Full Headers
Complete Article Headers
X-Google-Thread: f9855,76f4f8cd2b965afc
X-Google-Thread: fe5ee,76f4f8cd2b965afc
X-Google-Thread: faa3c,76f4f8cd2b965afc
X-Google-Thread: fcd68,76f4f8cd2b965afc
X-Google-Attributes: gidf9855,gidfe5ee,gidfaa3c,gidfcd68,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news2.google.com!news1.google.com!Xl.tags.giganews.com!border1.nntp.dca.giganews.com!nntp.giganews.com!local02.nntp.dca.giganews.com!news.giganews.com.POSTED!not-for-mail
NNTP-Posting-Date: Sat, 03 Jan 2009 16:39:58 -0600
From: "David H. Lipman" <DLipman~nospam~@Verizon.Net>
Newsgroups: microsoft.public.security,alt.windows-xp,24hoursupport.helpdesk,alt.comp.virus
References: <6a82feef-8a3a-4042-bfd0-684ce1e56ad3@l39g2000yqn.googlegroups.com> <gjof84$d01$1@news.motzarella.org> <5ead3fa6-f549-4c31-83ff-7f96681daafd@f13g2000yqj.googlegroups.com> <83d7c6f7-d0c1-41c5-a963-536d6ed033db@z6g2000pre.googlegroups.com> <VtednVOwcfiBW8LUnZ2dnUVZ8tXinZ2d@bt.com> <9757ee95-c1d6-472b-b86f-af461f331e09@s37g2000vbp.googlegroups.com> <ifKdnS7d356sdcLUnZ2dnUVZ8i-dnZ2d@bt.com>
Subject: Re: Why/how does Antivirus 2009 malware popup attach itself to certain links?
Date: Sat, 3 Jan 2009 17:39:57 -0500
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579
X-Comment-To: Fix it
X-Face: #!*YlHW<3BNQH,W(*HlLHp!!3C^o,W53`lH?w!P/BI9U&X#l41]a]{(_lFi9uvKIhejF;N7"3{((o^}#4TsAASuyib+4gO;T`p'iU-gC?0Lj'1MyYrhAWCVxHKD~0Jqt9=du~_{E+uqoYt4O$L?M:a>s4@)NMgJjld$%3QOzA[8
FL-Build: Fidolook 2007 (HV) 6.0.6000.97 - 24/12/2008 20:32:05
Message-ID: <ce6dnXMTpvijdMLUnZ2dnUVZ_oPinZ2d@giganews.com>
Lines: 42
X-Usenet-Provider: http://www.giganews.com
X-Trace: sv3-IMLtjTJonhnAZ+j9kJZccjNnHV8StVECiKPw7Ll21/UZCJskt+j6PC2SmpIeP9GFbXMbiPTx/jQlePN!PaMukxg/NSCvyG1z6e/mBfbim0M1kLyY4ahONyiipLCcsqNnLRiaXaUQzMd2fOeMKnKSxr208m/d
X-Complaints-To: abuse@giganews.com
X-DMCA-Notifications: http://www.giganews.com/info/dmca.html
X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers
X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly
X-Postfilter: 1.3.39