Amps
[Top] [All Lists]

Re: [Amps] MALWARE ALERT FOR RECENT POST

Subject: Re: [Amps] MALWARE ALERT FOR RECENT POST
From: Roger <sub1@rogerhalstead.com>
Date: Tue, 02 Feb 2010 15:10:10 -0500
List-post: <amps@contesting.com">mailto:amps@contesting.com>

Jim Dawson wrote:
> Mike,
>
> I can assure you that I am aware of the various ways of getting malware. 
> Photobucket has
> ads that trigger various forms of malware.
>   
That doesn't mean there is really mall ware there.
> Which anti virus programs are you sure trigger these ghosts.
>
>   
It could be almost any of them as what they look at changes with updates.
And it doesn't have to be the AV programs. It could easily be the 
browser as well.
> My wife called me to look at the same thing on her computer (different anti 
> virus software than mine).
> Luckily, she stopped before any damage was done. Sure enough it was a 
> Photobucket page. That is
> three times tonight I've seen it.
>
>   
Rather than mall ware, or "scareware"(which does exist), it's more than 
likely what are called "false positives". Anti-spam programs are 
particularly bad on that.  Again it varies with the algorithm in each 
program and definition packages but the amount of false positives I get 
both here and at the ISP due to both financial magazines, and reflectors 
runs 50 to 75% out of about 75 to 100 e-mails per day.  I was losing 
enough legitimate e-mail that I had to change the settings on my 
accounts to quarantine the e-mail so I could personally check for false 
positives.  Even if I take the low % of 50 that is up to 1500 false 
positives per month. One cost me over $20,000 USD because of a lost 
business opportunity with no recourse.
Almost all pages drop cookies on your machines. Most are benign, they 
are necessary for many operations, but it depends on what they do with 
the information.  The cookie is nothing more than a text file that says 
"you were here" or "you were here and did this or that", and some such 
as "double-click work on many sites giving them the ability to track 
your browsing habits and it's almost impossible to get away from them as 
some sites will not load if you block their adds. News and some of the 
major sites do this. 

As many adds are not actually on the site you are visiting, the 
monitoring programs see them as a redirect. Browsers and other programs 
can block these and often misidentify them as mallware or worse.
I'm guessing that only some are seeing mall ware being identified, it is 
likely to be the browser, but what ever identifies it should tell you 
which one found it. IOW "SpeedBump Mallware detection has found such and 
such a site is trying to send potentially dangerous mallware to your 
computer, but due to our great efforts said attempt has been blocked 
saving you and future generations..."  welllll... you get the idea.  
Most of it is harmless, but you need to pay attention. The alarm may 
simply be due to the add, or what ever residing on a host (not 
necessarily the site you are visiting ) that is known to be lenient on 
spammers and other lowlifes.

73

Roger (K8RI)
Remember...Don't Panic! from the Restaurant at the end of the Universe.
> Feel free to trust Photobucket, I don't.
>
> Jim - K9DD
>
>
> ----- Original Message ----- 
> From: "Mike" <noddy1211@sbcglobal.net>
> To: <amps@contesting.com>
> Sent: Monday, February 01, 2010 7:47 PM
> Subject: Re: [Amps] MALWARE ALERT FOR RECENT POST
>
>
>   
>> There is no problem it works just fine. I am sure some of these virus
>> programs people install trigger on ghosts, makes people with a lack of
>> understanding think the program is actually doing something for the money.
>>
>> Mike
>>
>> -----Original Message-----
>>
>>
>> This is a standard photobucket page.  I have tested with IE, Chrome and
>> Firefox.  I see no problem.
>>
>>     
>>> From: wa3gin@comcast.net
>>> To: gpatterson53@hotmail.com; amps@contesting.com
>>> Subject: MALWARE ALERT FOR RECENT POST
>>> Date: Mon, 1 Feb 2010 20:18:04 -0500
>>>
>>> YIKES...
>>>
>>> The link below attempted to load a hijack anti-mal-ware service...almost
>>> worse than a real virus.
>>>
>>> Don't bother clicking on the "X" , just do a control alt delete, go to
>>> processes and end your browser session.
>>>
>>> Geez,
>>> dave
>>> wa3gin
>>>
>>> ----- Original Message ----- 
>>> From: "Gary Patterson" <gpatterson53@hotmail.com>
>>> To: <amps@contesting.com>
>>> Sent: Monday, February 01, 2010 8:11 PM
>>> Subject: [Amps] HB amps - what you can build with no tools
>>>
>>>
>>>       
>>>> http://s856.photobucket.com/albums/ab123/patterone/
>>>>
>>>> Hand-drill and cheap jigsaw all that was used.  Can't beat the single
>>>> 3-500z.
>>>> _________________________________________________________________
>>>> Hotmail: Trusted email with powerful SPAM protection.
>>>> http://clk.atdmt.com/GBL/go/201469227/direct/01/
>>>> _______________________________________________
>>>> Amps mailing list
>>>> Amps@contesting.com
>>>> http://lists.contesting.com/mailman/listinfo/amps
>>>>
>>>>         
>> _________________________________________________________________
>> Hotmail: Free, trusted and rich email service.
>> http://clk.atdmt.com/GBL/go/201469228/direct/01/
>> _______________________________________________
>> Amps mailing list
>> Amps@contesting.com
>> http://lists.contesting.com/mailman/listinfo/amps
>> No virus found in this incoming message.
>> Checked by AVG - www.avg.com
>> Version: 8.5.432 / Virus Database: 271.1.1/2662 - Release Date: 02/01/10
>> 12:37:00
>>
>> _______________________________________________
>> Amps mailing list
>> Amps@contesting.com
>> http://lists.contesting.com/mailman/listinfo/amps 
>>     
>
> _______________________________________________
> Amps mailing list
> Amps@contesting.com
> http://lists.contesting.com/mailman/listinfo/amps
>
>   
_______________________________________________
Amps mailing list
Amps@contesting.com
http://lists.contesting.com/mailman/listinfo/amps

<Prev in Thread] Current Thread [Next in Thread>