Why/how does Antivirus 2009 malware popup attach itself to certain links?

Article View: microsoft.public.security

Article #29

Back to microsoft.public.security Previous Next

#29

From: Doc
Date: Sat, 03 Jan 2009 15:48

19 lines
2066 bytes

There's a website for a couple of famous jazz trumpeters, the late
Candoli brothers.

http://www.candoli.com

It's a legitimate site, these guys were icons. There's a photo in
their gallery of Pete playing wearing a Superman suit. I posted the
direct link to it in a trumpet forum.

http://www.candoli.com/pic28.htm

Several people reported that clicking the link brought up that
Antivirus 2009 malware bogus alert. I tried it and got the same
thing.

How does that Antivirus 2009 page hijack attempts to go to other sites
like that? How does it get attached to certain ones?

How is it these people haven't been shut down?

Technical Details

Message-ID: <6a82feef-8a3a-4042-bfd0-684ce1e56ad3@l39g2000yqn.googlegroups.com>

Path: arc1-ca.pugleaf.net!g2news1.google.com!postnews.google.com!l39g2000yqn.googlegroups.com!not-for-mail

Show Full Headers

Complete Article Headers

X-Google-Thread: f9855,76f4f8cd2b965afc,start
X-Google-Thread: fe5ee,76f4f8cd2b965afc,start
X-Google-Thread: faa3c,76f4f8cd2b965afc,start
X-Google-Thread: fcd68,76f4f8cd2b965afc,start
X-Google-Attributes: gidf9855,gidfe5ee,gidfaa3c,gidfcd68,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!postnews.google.com!l39g2000yqn.googlegroups.com!not-for-mail
From: Doc <docsavage20@yahoo.com>
Newsgroups: microsoft.public.security,alt.windows-xp,24hoursupport.helpdesk,alt.comp.virus
Subject: Why/how does Antivirus 2009 malware popup attach itself to certain 
 links?
Date: Sat, 3 Jan 2009 07:48:54 -0800 (PST)
Organization: http://groups.google.com
Lines: 19
Message-ID: <6a82feef-8a3a-4042-bfd0-684ce1e56ad3@l39g2000yqn.googlegroups.com>
NNTP-Posting-Host: 71.54.184.244
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Trace: posting.google.com 1230997734 20318 127.0.0.1 (3 Jan 2009 15:48:54 GMT)
X-Complaints-To: groups-abuse@google.com
NNTP-Posting-Date: Sat, 3 Jan 2009 15:48:54 +0000 (UTC)
Complaints-To: groups-abuse@google.com
Injection-Info: l39g2000yqn.googlegroups.com; posting-host=71.54.184.244; 
 posting-account=xzBihwkAAACajTfd3pf3MoQRZWZd4Mhm
User-Agent: G2/1.0
X-HTTP-UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.5) 
 Gecko/2008120122 Firefox/3.0.5,gzip(gfe),gzip(gfe)