Re: Why/how does Antivirus 2009 malware popup attach itself to certain links?

Article View: microsoft.public.security

Article #28

Back to microsoft.public.security Previous Next

#28

From: Rube Bumpkin
Date: Sat, 03 Jan 2009 23:39

21 lines
2234 bytes

Doc wrote:
> On Jan 3, 2:32 pm, "Fix it" <inva...@nothing.dil> wrote:
> 
>> It seems a number of established security vendors have listed
>> the links you posted as very naughty in the same way as blockyell.
>> But thats why you posted them isn't it, you're spreading malware.
> 
> 
> Um, no. As stated I'm trying to understand the how and why.
> 
> Did I not state exactly what behavior I was observing thereby giving
> you complete "click at your own risk" warning?  
<SNIP>

It's generally considered good form to obfuscate suspect links, by, for 
instance, changing the first part to hxxp://

That way nobody could accidentally click on it and end up in a bad 
place. Not everyone reads posts completely before clicking.

RB

Technical Details

Message-ID: <LGS7l.30345$mE3.3562@newsfe14.iad>

Path:

arc1-ca.pugleaf.net!g2news2.google.com!news1.google.com!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!post02.iad.highwinds-media.com!newsfe14.iad.POSTED!7564ea0f!not-for-mail

References:

<6a82feef-8a3a-4042-bfd0-684ce1e56ad3@l39g2000yqn.googlegroups.com>  <R8adnYiOKP7TIMLUnZ2dnUVZ8qDinZ2d@bt.com> <7c3866b8-643b-4513-938b-700350c7bb4d@i20g2000prf.googlegroups.com>

Show Full Headers

Complete Article Headers

X-Google-Thread: f9855,76f4f8cd2b965afc
X-Google-Thread: fe5ee,76f4f8cd2b965afc
X-Google-Thread: faa3c,76f4f8cd2b965afc
X-Google-Thread: fcd68,76f4f8cd2b965afc
X-Google-Attributes: gidf9855,gidfe5ee,gidfaa3c,gidfcd68,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news2.google.com!news1.google.com!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!post02.iad.highwinds-media.com!newsfe14.iad.POSTED!7564ea0f!not-for-mail
From: Rube Bumpkin <Someone@somewhere.world>
Organization: OCD/HFA/AS
User-Agent: Thunderbird 2.0.0.19 (Windows/20081209)
MIME-Version: 1.0
Newsgroups: microsoft.public.security,alt.windows-xp,24hoursupport.helpdesk,alt.comp.virus
Subject: Re: Why/how does Antivirus 2009 malware popup attach itself to  certain
 links?
References: <6a82feef-8a3a-4042-bfd0-684ce1e56ad3@l39g2000yqn.googlegroups.com>  <R8adnYiOKP7TIMLUnZ2dnUVZ8qDinZ2d@bt.com> <7c3866b8-643b-4513-938b-700350c7bb4d@i20g2000prf.googlegroups.com>
In-Reply-To: <7c3866b8-643b-4513-938b-700350c7bb4d@i20g2000prf.googlegroups.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Lines: 21
Message-ID: <LGS7l.30345$mE3.3562@newsfe14.iad>
NNTP-Posting-Host: 72.209.16.135
X-Complaints-To: newsmaster@cox.net
X-Trace: newsfe14.iad 1231025963 72.209.16.135 (Sat, 03 Jan 2009 23:39:23 UTC)
NNTP-Posting-Date: Sat, 03 Jan 2009 23:39:23 UTC
Date: Sat, 03 Jan 2009 18:39:22 -0500

Reply to Parent Message