Malicious Software Warning

[drw]

Concern:

The last two times that I have logged onto the NC Woodworker site, my antivirus software (Trend Micro) has given me a warning about malicious software. Specifically, it points to the following:

http://webnetwork.servehttp.com/sdfg.jar

and

http://webnetwork.servehttp.com/q.jar

I have no idea what this is all about. I have been viewing this site for many months with no warning and no problem, so it may be worth checking out.

Donn

 

[James Anderson Jr]

Same thing happened to me as well; my antivirus (Kapersky) blocked access though.
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

 

[gazzer]

No virus alerts, but in the last few days my browser has closed suddenly upon entering NCWW (doesn't occur with other sites). I wonder if this is related?

-G
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8 (.NET CLR 3.5.30729)

 

[ErnieM]

Same thing here! I clicked on the first post (Finally square) and Avast spotted malware. (JSdfka-gen [Expl])

Ernie
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)

 

[froglips]

I've just made a change, could one of you wonderful fellas recheck to see if its gone?

Thanks,
Jim
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6

 

[drw]

Dave,
I rebooted, logged in and everything ran smoothly. Perhaps whatever you did, did the trick.

Thank you,
ccasion1
Donn
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8 (.NET CLR 3.5.30729)

 

[Glennbear]

The past few days the site has been "locking up" when attempting to load in IE 7.0, today that did not occur. :wsmile:
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; GTB6.4; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

 

[froglips]

Well, thats great, thanks for the reports.

At least confidence is high on the feature causing the problems.

I still have to work out why its happening. Right now, we are not running some very important behind the scenes stuff.

Thanks for everyones patience.

Jim
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6

 

[ErnieM]

Thanks Jim - everything's back to normal here.

Ernie
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)

 

[Dragon]

Seems to be working fine for me today. I posted in another "help desk" thread yesterday about having some sort of "exploit" virus being stopped by my Avast AV program. So far this afternoon though, ( and I've just logged in), things appear to be working normally. Thanks Jim.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8

 

[ptt49er]

Ah....one reason I love Ubuntu

I really need to check the AV software on my desktop though!

Thanks Jim, for ALL you do!
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.18) Gecko/2010021501 Ubuntu/9.04 (jaunty) Firefox/3.0.18

 

[TracyP]

We think this is all related to VBSEO plugin. This is what gets us on the search engines. Jim and others mostly Jim, are in the process of updating this software to prevent future problems.
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)

 

[Jim M.]

Jim,
Thanks for your hard work. You're one of the reasons this site rocks!!! Jim :XXcompute
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30729)

 

[Trent Mason]

Jim,
Thanks for your hard work. You're one of the reasons this site rocks!!! Jim :XXcompute
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30729)

+1 :thumbs_up:thumbs_up
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8 (.NET CLR 3.5.30729)

 

[froglips]

Fingers crossed, I think we are all upgraded and features are turned back on.

If anyone who has seen the issue could let us know its "still fixed", much appreciated!

Thanks to the Staff for working on this, we pulled together like a well danish oiled farm table top

Jim
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6

 

[ErnieM]

Jim - Yup! It's still fixed. Congrats on a great job.

Ernie
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)

 

[ehpoole]

The most probable cause of your AV warnings was likely a poorly chosen virus signature by either your chosen AV provider, or the central clearinghouse of AV signatures (a resource subscribed to by nearly all AV vendors).

Over the past couple of years I have witnessed a number of instances where AV signatures were generated against code snippets from the MSDN (Microsoft Developers Network) and related sources. These code snippets and sample routines are used by many software developers.
Unfortunately, they are more likely to appear in legitimate code than illegitmate. But, since exploit developers also have access to these same resources, they occassionaly cut and paste these code samples into their exploits.

Then someone reports the exploit to an antivirus vendor, who then incorrectly latches onto the sample code when they create their AV signature and ... presto ... legitimate software starts getting flagged as a virus or other exploit.

In recent years I have had my accounting software partially wiped out by antivirus software for the same reason. I have also had a number of Microsoft Resource Kit utilities wrongfully flagged as exploits by AV software as well -- all due to poorly chosen AV signatures... even Yahoo Messenger is actively flagged as a keylogger by some AV vendors.

Sometimes these issues will resolve themselves if the AV vendors catch onto the mistake and rescind the signature, other times the only action you can take is to exempt that particular item from AV scanning by using your AV softwares provisions for user-defined exceptions.

Good luck!

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET CLR 1.1.4322; OfficeLiveConnector.1.4; OfficeLivePatch.1.3)

 

[froglips]

Whew, glad we got this fixed.

Ethan, in this case we had a legit problem. Its always a a trade off.

Luckily, we are safe... for now....

[YOUTUBE]y8Kyi0WNg40[/YOUTUBE]

Jim
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6

 

[RayH]

Probably not related, but this morning I find that when I attempt to go to page 2 of this thread, it switches momentarily, then jumps back to page 1. Only way I can get to page 2 is to select one of the items from the thread diagram.

Related??:icon_scra
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10

 

[drw]

Jim,
All is well! This morning when I logged onto the site there were no warnings. Great job, thank you!

Donn
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8 (.NET CLR 3.5.30729)