Forum full of viruses

**ozzyman** · 02-23-2012, 11:28 AM

Sometimes when I visit this forum or sometimes if I find an old thread on this forum from a google search I am redirected to a site or prompted with a message to download some virus. I just visited the main site now (straight from the address bar: Java Programming Forum - The Front Page) and Avast detected a threat and blocked it:

Infection: JS:Downloader-gen@bhv [Expl]

Straight after that Internet Explorer prompted me with a message to say Unsafe download, Continue or Cancel.

**Fubarable** · 02-23-2012, 02:44 PM

I will forward this to the moderator's forum. Thanks for the information!

**j2me64** · 03-02-2012, 10:25 AM

Since a few days each time i come to this site my antivirus avast give me this warning

freely translated: avast has blocked a malicious site.

The malicious site is listed after Objekt:

Is something wrong with avast and why is this url listed?

**Eranga** · 03-02-2012, 11:05 AM

Is this happen when you are logged in or before that. My concern is Google add cause this. I experienced the same with different stuff.

**Fabken** · 03-02-2012, 07:55 PM

I'm experiencing the same warning message.

**Eranga** · 03-03-2012, 01:23 PM

Did you get that warning message when you are logged into the forum or not? Is that your page full with Google adds at that time?

**Fabken** · 03-03-2012, 09:45 PM

When I'm logged in.
But I stopped my network shield and today I restarted it again and my problem is solved, I think it might have something to do with the avast anti virus program.

**ozzyman** · 03-03-2012, 11:09 PM

Originally Posted by Fabken

When I'm logged in.
But I stopped my network shield and today I restarted it again and my problem is solved, I think it might have something to do with the avast anti virus program.

It doesnt happen always its quite random, its usually from the adservers, usually one ad will try to connect to a bad url and avast will block it. its not a problem with avast because i was even prompted by internet explorer to download/install some weird program, i had to end IE process to stop it.

**Eranga** · 03-04-2012, 03:50 AM

Originally Posted by Fabken

When I'm logged in.
But I stopped my network shield and today I restarted it again and my problem is solved, I think it might have something to do with the avast anti virus program.

I am using Kaspersky and I cannot tell anything about avast.

However, few weeks back I came up with the same issue on some other CMSs with Google adds. Some of the adds contain phishing URLs and Kaspersky pick them and warn. Reason why as that you are logged in or not is that when you are not logged into the forum you can see more Google adds than at the time of logged in. So the chances are very high to come up with the issue we are talking about.

**JavaForums** · 03-08-2012, 11:24 AM

This problem is fixed now. Thanks for reporting.

**Eranga** · 03-08-2012, 01:57 PM

Originally Posted by JavaForums

This problem is fixed now. Thanks for reporting.

Thanks a lot. Is there any possibility to get to know the reason...

**JavaForums** · 03-08-2012, 03:31 PM

The forum software (vbulletin) was hacked. Probably, they have used an RFI bug in the vbulletin to randomly redirect users to pages filled with ads. Identification of the problem was the main problem due to randomness.

We upgraded vbulletin and cleared backdoors.
We were not upgrading forum software regularly. Now we will upgrade it regularly ;)

**Eranga** · 03-09-2012, 03:21 PM

Nice to hear that we are on track.

So ads make a difference as I expect.

**ozzyman** · 03-17-2012, 12:38 PM

hi, i just logged in on my android phone, clicked somewhere on the page (maybe the Forum button) and was redirected to this site:
kpandian.htmlt

it didnt affect my phone but its probably malware for a pc