Need help: People getting Virus alert on site....

[froglips]

I'm consolidating the issues into this single thread.

These are the prior reports from the help desk:
http://www.ncwoodworker.net/forums/...-first-going-north-carolina-woodworker-34590/
http://www.ncwoodworker.net/forums/f86/bug-34591/
http://www.ncwoodworker.net/forums/f86/toolkit-payload-detected-12-34am-9-18-a-34584/

We've disabled our Google Ad's to try to narrow down the reported problems.

We need to hear from those who have been getting warnings if they have stopped.

As long as we leave the Ad's off, we are losing revenue, so I'm hoping to hear back soon.

Thanks,
Jim

 

[ErnieM]

Had a problem yesterday - today everything seems back to normal.

Ernie

 

[farmerbw]

I didn't get any AV alerts before or since you turned off Google ads and I've been sitting in front of my PC at work for almost 12 hrs and refreshing fairly often.

hth,
Brian.

 

[Bill Clemmons]

Had a problem yesterday - today everything seems back to normal.

Ernie

Ditto. I've logged in twice today and no warning either time.

Bill

 

[zapdafish]

i just logged into site and had the following warning from avg

okelkas.co.cc/okelkas5/trafflit.php

exploit SEO Exploit Kit (type 1337)

 

[gazzer]

I had an issue just now, but I am not sure if it is related to the virus thing. Basically, I tried twice to connect, got the forum start page, and then got a message that plugins were needed. I was prompted to click to download some *.asx file, but the browser crashed before I could do anything. Happened twice, but the third time (current session) seems to be ok. Using Firefox 3.6.

Hope this helps.

-G

 

[Sealeveler]

I had a virus blocked with avg ff yesterday and a Trojan blocked this morning with avast IE on a different computer,so far this evening no problems.Thanks for the help on this.
Tony

 

[fergy]

I just got a popup media player file when clicking new posts on the homepage. God knows what it just tried to load, or if it made it. Kaspersky AV is having trouble updating the database today as well.

 

[WoodWrangler]

I've been getting it up to about 10 minutes ago ...

 

[TedAS]

Get it with IE not with Chrome

 

[bitbight]

Jim,

Just tried opening the LogOn page with Firefox Ver. 3.6.10 and had no problem, did not Log In. Closed the page and re-opened LogOn again using Internet Explorer Ver.8.0.6001.18702 This time I got a Virus hit on Norton. Same virus that hit me earlier this evening, still not logged in. After login, some Ads on the right panel but I do not see any scrolling in the header.

Hope this helps,

Ray

 

[sawduster]

I just got it again ....same scenario , not logging in , just opening my browser

 

[JimmyC]

Got it just once on 9/18 at around 3:50pm and not since.

 

[scsmith42]

I just got it again (10:20 am on Sunday 9/19) when I typed in www.ncwoodworker.net. I had not yet logged in, the hack occured as the NCWW page was loading (but not fully loaded) on my PC.

Norton blocked it.

 

[froglips]

I've run another full scan of our server, to no avail.

I've also got Google Webtools scanning us for Malware, but nothing has been found so far.

If you encounter this error, please try to save off the source code of our webpage.

You can send me a copy via PM or to my external email froglips111302@yahoo.com

Thanks,
Jim

 

[red]

I've run another full scan of our server, to no avail.

I've also got Google Webtools scanning us for Malware, but nothing has been found so far.

If you encounter this error, please try to save off the source code of our webpage.

You can send me a copy via PM or to my external email froglips111302@yahoo.com

Thanks,
Jim

My AVG blocked it on Friday morning then blocked my access to this site because of it. I took a print screen of the block to show my son. Today all seems well so far.

How do I find this source code you are looking for? Thanks for your work trying to make this site safe. I appreciate it!

Red

 

[scsmith42]

Jim, it just happened to me again. The attack occurs as soon as I type in ncwoodworker.net and hit enter, and before the site has fully loaded on my screen.

It's almost as if the problem is resident on the domain name server...

 

[HMH]

Jim,

Same as Scott, it just happened again while the page was loading. According to Webroot, there are (9) multiple threats: (2)-malware, (3)-trojans, (4)-misc adware.

 

[RickC]

I just got a hit, too. Unfortunately the screen print chopped off the full location, but did give the file name that was infected. Look in lower lefthand corner. I do not know how to open the source in this case.

NOTE: I got the same message from a different computer just now (19:30). The rest of the file name is:
okelkas.co.cc/okelkas5/trafflit.php

I am using latest Firefox 3.6.10

 

[junquecol]

Yesterday, and this morning, opening page wouldn't open completely. Was instructed to install missing plug ins, which I didn't. Only way to get out of opening page was to manually shut down my PC. Seems OK this afternoon though. Bruce