I went to read hpHosts blog just now and received this warning!
Sign of "JS:Redirector-H7 [Trj]" has been found in "hxxp://hphosts.blogspot.com/\{gzip}" file.
MalwareBytes.org was hit last week with a re-direct. They warned us from their front page and asked to keep directing traffic their way that it would be resolved quickly. I had to visit today and it must have been solved because my bookmarked links all worked again.
it could be possible that they have turned their attention to HpHost.
... tis the documentation on the Gumblar/Martuz infection that's triggering it. As I said last time, Avast is technically correct in flagging it as it is malicious code - the fact it's posted "safely" (i.e. it doesn't actually load) isn't checked by Avast.
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
Hi,allDose this mean that this only happens if i go to their forum or the hphosts program? Sorry if this is a stupid question but i dont understand the tech talk.
I have hphosts and Avast and Avast has'nt found anything........
Thanks for your time...........cheers........p...........
This is a blog like forum and heaven forbid that it became infected with the common Web site infection that is prevalent right now and avast! is doing an admirable job of detecting then avast! would alert me that I should not stay here.
A couple of forums that I use very occasionaly were infected and I contacted their owners and they quicky corrected the situation.
Wow, the sun is out after 4 days of cloud and rain.
Sat 30 May 2009 09:22:48 AM UTC — cod head (not verified)
Its if you go to hoHosts paul but it is perfectly safe to do so has it is a false positive.Meaning the av thinks its a virus but its not.(G.O.M.with Honours).
What's the mystery? (reading it, it seems pretty clear as far as the function of the script blocker, and it's hierarchy as far as internals usage is concerned (i.e. how far between the chain (Web > client) it is based))
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
Re: avast! reports virus on hpHosts blog
Fri 29 May 2009 12:43:00 PM UTC — SamiI'm sure it's a false positive. What's the "/\{gzip}" file? Does that mean this was detected from the compressed page sent by the web server?
MalwareBytes'
Fri 29 May 2009 12:52:58 PM UTC — AthloniteMalwareBytes.org was hit last week with a re-direct. They warned us from their front page and asked to keep directing traffic their way that it would be resolved quickly. I had to visit today and it must have been solved because my bookmarked links all worked again.
it could be possible that they have turned their attention to HpHost.
Athlonite
Your help is always needed.
False Positive
Fri 29 May 2009 02:08:00 PM UTC — cod head (not verified)All av,s make false positives occasionaly.Suppose its better than a negative positive.(G.O.M.with Honours).
I reported the false positive to avast!
Fri 29 May 2009 05:12:12 PM UTC — YoKennyNow I will wait to hear what they respond back to me.
It looks like the blog is showing an example of a virus
Sat 30 May 2009 01:17:56 AM UTC — YoKennyIt looks like the blog is showing an example of a virus triggering avast! with an infection warning.
Yep ....
Sat 30 May 2009 01:32:54 AM UTC — MysteryFCM... tis the documentation on the Gumblar/Martuz infection that's triggering it. As I said last time, Avast is technically correct in flagging it as it is malicious code - the fact it's posted "safely" (i.e. it doesn't actually load) isn't checked by Avast.
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
Keywords?
Sat 30 May 2009 01:43:23 AM UTC — evilfantasyCould Avast be hitting on keywords in the URL or is it the body of the web page....or both?
...
Sat 30 May 2009 02:31:56 AM UTC — MysteryFCMHopefully it's hitting on the code itself (I'd be very concerned if it was hitting on keywords)
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
I was hoping you would say that
Sat 30 May 2009 02:45:24 AM UTC — evilfantasyKeywords would be a bit too aggressive and possibly damaging.
FYI
Fri 29 May 2009 06:20:45 PM UTC — MysteryFCMIt's only a partial F/P. Chances are they're picking up on the code outlined in the following post;
http://hphosts.blogspot.com/2009/05/martuzcn-aka-g...
This isn't the first time this has happened and I doubt it'll be the last ;o)
http://forum.avast.com/index.php?topic=38715.0
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
Me too
Fri 29 May 2009 10:37:19 PM UTC — evilfantasySet mine off also.
http://hphosts.blogspot.com/2009/05/martuzcn-aka-gumblar-and-wordpress-does.html\{gzip}
dose this mean.
Sat 30 May 2009 09:18:05 AM UTC — paul gHi,allDose this mean that this only happens if i go to their forum or the hphosts program? Sorry if this is a stupid question but i dont understand the tech talk.
I have hphosts and Avast and Avast has'nt found anything........
Thanks for your time...........cheers........p...........
If You Dont Ask You Will Never Know..
Its on the hpHost blog
Sat 30 May 2009 10:30:08 AM UTC — YoKennyIts on the hpHost blog
This is a blog like forum and heaven forbid that it became infected with the common Web site infection that is prevalent right now and avast! is doing an admirable job of detecting then avast! would alert me that I should not stay here.
A couple of forums that I use very occasionaly were infected and I contacted their owners and they quicky corrected the situation.
Wow, the sun is out after 4 days of cloud and rain.
Perfectly Safe
Sat 30 May 2009 09:22:48 AM UTC — cod head (not verified)Its if you go to hoHosts paul but it is perfectly safe to do so has it is a false positive.Meaning the av thinks its a virus but its not.(G.O.M.with Honours).
Perfectly Safe.
Sat 30 May 2009 09:29:10 AM UTC — paul gHey, cod head.Thanks a lot for your quick reply and shedding some light on that for me.
Thanks for your time.........cheers...........p...........
If You Dont Ask You Will Never Know..
...
Sat 30 May 2009 01:37:51 PM UTC — MysteryFCMFor reference;
http://hphosts.blogspot.com/2008/09/avs-throwing-v...
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
There is a discussion about Script blocker in avast!
Sat 30 May 2009 04:02:48 PM UTC — YoKennyScript Blocker mystery
http://forum.avast.com/index.php?topic=45438.0
I know you like a Mystery Steven. :)
??
Sat 30 May 2009 06:35:59 PM UTC — MysteryFCMWhat's the mystery? (reading it, it seems pretty clear as far as the function of the script blocker, and it's hierarchy as far as internals usage is concerned (i.e. how far between the chain (Web > client) it is based))
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
The mistery
Sat 30 May 2009 08:07:39 PM UTC — YoKennyThe mystery is why dude2 does not understand about Script Blocker.
Or maybe I don't understand what he does not understand.
....
Sat 30 May 2009 08:18:10 PM UTC — MysteryFCMhehe that's an easy one ...... it's because he's not technically inclined, and the descriptions of it, aren't being presented in plain "newb" English.
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net