32 replies to this topic

[Heartburn]

Since the move to the new server, on AE7, my virus/spyware scanner repeatedly quarantines something after I log in. It states, "Mal/Iframe-X detected. The item exhibits a behavior or characteristic commonly associated with spyware or other malware." Anyone else getting the same?

[Mr Tree]

My avast once told me it had blocked a virus, but it hasn't happened since.

[Superman]

I knew AE have virus cause yesterday when I logged Norton said it have blocked a virus that was trying to get on my computer

[Heartburn]

Anti-Virus continues to stop threats from Airline Empires site ever since the move to the new server. Most common is Mal/Iframe-X. Latest has been Troj/CycBotCn-A. I'm starting to have less faith in this site. July 31, 2011

Airline Empires malware trojan virus

[bolli]

AE does not have a virus
I can assure you of that.

[Superman]

Most Active New Threats
Name Type Discovered
Trojan.FakeAV!gen65 Trojan 07/29/2011
Trojan.Multifaker Trojan 07/28/2011
Android.Nickispy Trojan 07/27/2011
PremiumSMSScam!gen4 Potentially Unwanted App 07/27/2011
Trojan.Zefarch!gen9 Trojan 07/25/2011
Backdoor.Sheedash!gen1 Trojan Virus 07/25/2011
Trojan.Zefarch!gen8 Trojan 07/22/2011
Infostealer.Mailfast Trojan 07/22/2011
Downloader.Malscript Trojan 07/21/2011
Trojan.FakeAV!gen64 Trojan 07/20/2011

look

[bolli]

That is just a list of the latest threats norton has found on the whole internet.
It is impossible for a virus to manifest itself in the php code.

[Superman]

well i dont know

[adityapratama]

i smell a conspiracy here

[Yuxi]

The two possible sources are 1) infected ad banners and 2) existing infections on user computers. I am in the process of switching to a different ad network to see if that helps.

In the meantime you can try using AdBlock and see if the problem goes away. It's hard to troubleshoot on my end because I've never experienced this problem, even when using a WinXP VM running IE6.

[Yuxi]

Most Active New Threats
Name Type Discovered
Trojan.FakeAV!gen65 Trojan 07/29/2011
Trojan.Multifaker Trojan 07/28/2011
Android.Nickispy Trojan 07/27/2011
PremiumSMSScam!gen4 Potentially Unwanted App 07/27/2011
Trojan.Zefarch!gen9 Trojan 07/25/2011
Backdoor.Sheedash!gen1 Trojan Virus 07/25/2011
Trojan.Zefarch!gen8 Trojan 07/22/2011
Infostealer.Mailfast Trojan 07/22/2011
Downloader.Malscript Trojan 07/21/2011
Trojan.FakeAV!gen64 Trojan 07/20/2011

look

Are those all from AE? and do you have URLs for the threat sources so we can track down the offending banners?

[Superman]

i dont know

[bolli]

Are those all from AE? and do you have URLs for the threat sources so we can track down the offending banners?

Thats nortons list of current threats:http://www.symantec....ing/threats.jsp

Superman, i suggest downloading this -> http://www.malwarebytes.org/
then disconnect your computer from the internet and shut down norton.
Then run the program and see whether it finds anything

[Heartburn]

The two possible sources are 1) infected ad banners and 2) existing infections on user computers. I am in the process of switching to a different ad network to see if that helps.

In the meantime you can try using AdBlock and see if the problem goes away. It's hard to troubleshoot on my end because I've never experienced this problem, even when using a WinXP VM running IE6.

Once again, my antivirus only started to quarantine Mal/Iframe-X after the server move. It stops it upon login. It hasn't detected Troj/CycBotCn-A since my last post. Another new dilemma is the other day when I tried to log on mobile, it said "Untrusted Certificate" & I couldn't get it to load for anything. I had been getting it on mobile the week before. I just wanted to reiterate that this only began after the move to the new server. Prior to the new server move I had no problems whatsoever (between April 2011 & the move).

[bolli]

Once again, my antivirus only started to quarantine Mal/Iframe-X after the server move. It stops it upon login. It hasn't detected Troj/CycBotCn-A since my last post. Another new dilemma is the other day when I tried to log on mobile, it said "Untrusted Certificate" & I couldn't get it to load for anything. I had been getting it on mobile the week before. I just wanted to reiterate that this only began after the move to the new server. Prior to the new server move I had no problems whatsoever (between April 2011 & the move).

You don't use Sophos do you?

There are reports of lots of False-Positives at the moment about Mal/Iframe-X

[Heartburn]

You don't use Sophos do you?

There are reports of lots of False-Positives at the moment about Mal/Iframe-X

I did look up Mal/Iframe-X when I first began having the issues & saw there were a lot of false alarms reported, but I found it odd that my quarantines started after the switch to the new server. Prior to that there was no problem.

[Stan11]

In the past 2 days I deleted 2 nasty malware viruses, they were definitely from this site

[bolli]

In the past 2 days I deleted 2 nasty malware viruses, they were definitely from this site

Oh per-lease....
I seriously doubt they were from this site.... as nobody else has had any problem with viruses....

[Stan11]

They were because I clicked on my routes page and then next thing I know I have "Vista Home Security Center" trojan on my computer. But its a drag to go into safe mode and use my powerful malware remover software to move this crap off

[Yuxi]

I have switched the ads to a different network. That should settle things down for a bit