Java shows as malware (1 Viewer)

Register Today to see less ads! It's Free!
Status

Deaver

Thread Starter
SatelliteGuys Family
I'm using my work computer at home, since they've up the virus scan settings everytime I come to this forum, I get 'malware' warnings. These messages get sent back to the home office and then they call me and tell me i'm 'infected'. I'm going to have to resort to only coming by on weekends, when I have my home computer (I spend the week on the road).

I'll have to catch up with the site on the weekends, thanks guys.
 
Register Today to see less ads! It's Free!

SatinKzo

Supporting Founder
Supporting Founder
May 22, 2004
6,232
83
Louisiana
yep, I'm getting crazy alerts all of a sudden too

here's the alerts

Connections aborted JS:pDFKA-YD exploit detected in iexplore.exe process
also detecting as JS:pDFKA-WK exploit
 
Last edited:
Register Today to see less ads! It's Free!

Scott Greczkowski

Welcome HOME to SatelliteGuys!
Staff member
HERE TO HELP YOU!
Sep 7, 2003
99,668
17,654
Newington, CT
Interesting...

The only Java on the homepage was the Blogtalk Radio player (which I am sure is not malware) but to be safe I disabled it.

Let me know if you get any warnings.
 

SatinKzo

Supporting Founder
Supporting Founder
May 22, 2004
6,232
83
Louisiana
I'm sure it's not malware, just a false positive, but all of a sudden it's causing my AV to trip up.
 

azgreg

SatelliteGuys Guru
Oct 21, 2009
131
0
AZ
MalwareBytes is blocking the following IP

17:50:55 Greg IP-BLOCK 217.23.13.45

Happens each time I navigate to this site.

Looks to be a website in the Netherlands....


According to DSL Reports =-===========

OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: P.O. Box 10096
City: Amsterdam
StateProv:
PostalCode: 1001EB
Country: NL
 

SatinKzo

Supporting Founder
Supporting Founder
May 22, 2004
6,232
83
Louisiana
damn, it's back for me. 2 alerts for different exploits every time I load a page. Happening on 2 different PCs.

Here's my log for today since it started. Other PC is showing same stuff, these were from loading the main forum page and the home page and a couple times loading the pub members forum

2/24/2010 6:16:24 PM http://koren.in/x/pdfnew.php?src=tb&id=766 [L] JS:pdfka-YD [Expl] (0)
2/24/2010 6:16:25 PM http://koren.in/x/pdf.php?src=tb&id=766 [L] JS:pdfka-WK [Expl] (0)
2/24/2010 6:16:46 PM http://koren.in/x/pdf.php?src=marcos&id=bomba [L] JS:pdfka-WK [Expl] (0)
2/24/2010 6:16:46 PM http://koren.in/x/pdfnew.php?src=marcos&id=bomba [L] JS:pdfka-YD [Expl] (0)
2/24/2010 6:16:47 PM http://koren.in/x/pdf.php?src=marcos&id=bomba [L] JS:pdfka-WK [Expl] (0)
2/24/2010 7:36:26 PM http://koren.in/x/pdfnew.php?src=tb&id=766 [L] JS:pdfka-YD [Expl] (0)
2/24/2010 7:36:27 PM http://koren.in/x/pdf.php?src=tb&id=766 [L] JS:pdfka-WK [Expl] (0)
2/24/2010 8:19:44 PM http://koren.in/x/pdfnew.php?src=tb&id=766 [L] JS:pdfka-YD [Expl] (0)
2/24/2010 8:19:45 PM http://koren.in/x/pdf.php?src=tb&id=766 [L] JS:pdfka-WK [Expl] (0)
2/24/2010 9:18:38 PM http://koren.in/x/pdfnew.php?src=tb&id=766 [L] JS:pdfka-YD [Expl] (0)
2/24/2010 9:18:39 PM http://koren.in/x/pdf.php?src=tb&id=766 [L] JS:pdfka-WK [Expl] (0)
 

Scott Greczkowski

Welcome HOME to SatelliteGuys!
Staff member
HERE TO HELP YOU!
Sep 7, 2003
99,668
17,654
Newington, CT
I think I got it. I have gone through the source code on two machines loged in as different test users accounts.

There was an update to an ad display program that I installed last night, but after I installed it I realized that we were no longer using that one and didn't do more with it. (It was installed but not turned on) It has now been uninstalled.

Lets hope that it as that and the blog talk radio are the only two changes made to the system over the past few weeks. :)
 

SatinKzo

Supporting Founder
Supporting Founder
May 22, 2004
6,232
83
Louisiana
yep, looks like it went away hopefully for good. Both of the PC's I'm using right now aren't showing any issues.
 

Scott Greczkowski

Welcome HOME to SatelliteGuys!
Staff member
HERE TO HELP YOU!
Sep 7, 2003
99,668
17,654
Newington, CT
Thank god!

Well at least I know what rouge program has been giving us these issues the past few months. (This has happened a few times)

I am sorry guys. Thanks for helping me kill it.
 

Deaver

Thread Starter
SatelliteGuys Family
Hi Scott, glad I wasn't the only one, I just had to stop by and look up some info and saw everyone else was posting. I didnt' get any message when I loaded up this time.

THANKS!! now i can surf the forum again.
 

Scott Greczkowski

Welcome HOME to SatelliteGuys!
Staff member
HERE TO HELP YOU!
Sep 7, 2003
99,668
17,654
Newington, CT
What pisses me off about this one is the code was smart so its not seen by any of the staff accounts. While I do check the site once a day from a non staff account, normally he only way I find out about these is from your reports.

Again my apologies. :(

I am going to stay up for a few more minutes and make sure we are good.
 
Register Today to see less ads! It's Free!
Status

Users who are viewing this thread

Users Who Are Viewing This Thread (Total: 0, Members: 0, Guests: 0)

Latest posts

Top