Malicious Site Warnings

[NFR85]

Im still getting the malware at times

[Bujinkan]

Originally Posted by scnnr

I think your boss is standing behind you while you are surfing the web at work.. I see him

Yeah, he listens to my scanner Good eyesight to see him from Canada.

[xmo]

Still getting messages like this from our security software:

Access Blocked - Content Alert
(h) ttp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0543475854053093&output=html&h=250&slotname=810109 2646&w=300&lmt=1362087713&flash=11.6.602&url=http% 3A%2F%2Fforums.radioreference.com%2Fsystem-wide-administration%2F261360-malicious-

and this:

Access Blocked - Content Alert
(h) ttp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0543475854053093&output=html&h=90&slotname=2434878 762&w=728&lmt=1362087927&flash=11.6.602&url=http%3 A%2F%2Fforums.radioreference.com%2Fnewreply.php%3F do%3Dpostreply%26t%3D261360&dt=1362087928340&bpp=1 1&shv=r20130225&cbv=r20130206&correlator=136208792 8628&frm=20&adk=2045205846&ga_vid=165478679.126098 1864&ga_sid=1362087929&ga_hid=2054059186&ga_fc=1&u _tz=-360&u_his=10&u_java=0&u_h=1050&u_w=1680&u_ah=1020& u_aw=1680&u_cd=24&u_nplug=28&u_nmime=108&dff=ar was blocked.

[jfhtm350]

That google stuff is in most websites along with these:
http://www.google-analytics.com/ga.js
http://ajax.googleapis.com/ajax/libs.../jquery.min.js
http://ajax.googleapis.com/ajax/libs...n-min.js?v=387
http://ajax.googleapis.com/ajax/libs...event.js?v=387

I have admuncher installed so it rids most of the junk. It automatically removes doubleclick.net and .google-analytics.*.js, but no the above. There is free program called K9 web protection that I believe removes alot of useless tracking crap and ads.

[ridgescan]

Now I am curious-if I'm having no issues while others are, does that mean my MS Essentials is missing a bunch of stuff?

[k3cfc]

I am upset i have VIPRE and i didn't get to see any of the above. but my computer runs straight cool and narrow. a little note i have never had a problem with my computers sense i had VIPRE just wouldn't be without it.


K3CFC

[bear780ks]

Originally Posted by ridgescan

Now I am curious-if I'm having no issues while others are, does that mean my MS Essentials is missing a bunch of stuff?

Have a Look File Hippo.com M.S.E had a recent Update it will show for Vista but if you click on in on that area it will show for XP as well if your Computer use's XP or you can follow through this Link: Enjoy Ra


Download Microsoft Security Essentials - FileHippo.com

[ridgescan]

Originally Posted by bear780ks

Have a Look File Hippo.com M.S.E had a recent Update it will show for Vista but if you click on in on that area it will show for XP as well if your Computer use's XP or you can follow through this Link: Enjoy Ra


Download Microsoft Security Essentials - FileHippo.com

thanks for the link I'll check it out.

[bear780ks]

Originally Posted by ridgescan

thanks for the link I'll check it out.

Cool: hey like the pics especially the Hallicrafter i think my Uncle had one of those K0IEB i know he a few radios he loved the Hobby) and the 785 which i thought at first was a 780 i miss that old Girl one of the best Damn radios i ever Owned.. Ra

[ridgescan]

Thanks a lot sorry about the OT

[Bujinkan]

Originally Posted by jfhtm350

That google stuff is in most websites along with these:
http://www.google-analytics.com/ga.js
http://ajax.googleapis.com/ajax/libs.../jquery.min.js
http://ajax.googleapis.com/ajax/libs...n-min.js?v=387
http://ajax.googleapis.com/ajax/libs...event.js?v=387

I have admuncher installed so it rids most of the junk. It automatically removes doubleclick.net and .google-analytics.*.js, but no the above. There is free program called K9 web protection that I believe removes alot of useless tracking crap and ads.

I don't see most advertisements online. I edit the hosts file with a copy from http://winhelp2002.mvps.org/hosts.txt . Blocks doubleclick, google-analytics, etc

[QwKiE]

For the last 3 days when I come to the RR web page I have got a Norton message blocked a web attack attempt.
ISP aleart name Web Attack: Red Exploit Kit Website.
Risk High
This has used 3 different names.com
Are you aware of any bugs on this web site this has happened to me the last 3 days only on this web page.
Live Police, Fire, EMS, Aircraft, and Rail Scanners on RadioReference.com
This is for your information so you might look in to this my Norton blocks it everytime it happens and its just on entering this page in the (AM)
The 3 names are
mayberrytoyland.com
fonorosas.com/wqvc.htm
shz7.com/onzu.htm
They are the attackers names

[W9BU]

Two answers until Wayne has a chance to respond:

1. See this thread and read the posts from Lindsay:
Malicious Site Warnings

2. Make sure the virus definitions being used by your installation of Norton AV are up to date.

[Thunderknight]

I just received the Page you are viewing requires Java message on the RR homepage again this morning...

[NHdave]

I got a block alert from Norton, IP address of 50.62.65.1, domain of qdgllc.com/eueu.htm, which seems to belong to a grain distiller.

[RUSTY_SHACKAFORD]

I also have this problem:

[Thayne]

Looks like most Anti-virus programs are catching this latest thing that exploits the website cerificate system; main thing is if some program jumps up with an update or anything while you are on RR, Don't let it do whatever a popup might suggest.

I have had 3 different IP addys try to get in this morning; upon checking the IP's out, most have over 100 different spoofed domain names listed--this is a real threat if users are not vigilant.

[rubicon05]

i also got this hit twice this morning when i tried going to radioref. also using norton.

[QDP2012]

Like others, I received Norton warnings several times when visiting RR yesterday.

In case it helps admins with their troubleshooting, the following occured on 2013-03-08:

• Intrusion attempt by 173.192.192.2,80 blocked
  • attacking URL: facebookkapaklari.org/orvz.htm
  • Risk: high
  • IPS Alert Name: Web Attack: Red Exploit Kit Website
  • Traffic Description: TCP, www-http
  • date/time: 2013-03-08/12:10:25EST

• Intrusion attempt by 98.131.164.1,80 blocked
  • attacking URL: bill.bcrta.ca/wqvc.htm
  • Risk: high
  • IPS Alert Name: Web Attack: Red Exploit Kit Website
  • Traffic Description: TCP, www-http
  • date/time: 2013-03-08/19:44:57EST

Edit: So, far such warnings are not happening today.

Hope this helps,

[jfhtm350]

People that dont know, you can easily look up ip addresses to see who has registered it.
Whois-RWS (North America and Canda)
https://apps.db.ripe.net/search/query.html
APNIC - Query the APNIC Whois Database
Registration Services - Whois

I have noticed 9 out of 10 attacks come from China. The 1 out of 10 comes from RoadRunnerHold internet provider here in USA.