Forum

  1. User picture

    immigration bureau thailand

    Google gives a warning for this side that it may harm my computer.
    Wot gives the all clear green sign.
    Which one am I to believe.
    This is important to me because my website siam-info.com has a link to this site for obvious reasons.
    Plse clarify
    best regards
    onzestan

Comments:

  2. User picture
    • Anonymized (Platinum) on Fri 18 Dec 2009
    • 06:20:12 AM UTC

    Info on immigration.go.th domain

    Nothing terrible is listed for this domain by robtex; however, google states:

    Of the 1528 pages we tested on the site over the past 90 days, 191 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-12-17, and the last time suspicious content was found on this site was on 2009-12-17. Malicious software includes 110 exploit(s), 40 scripting exploit(s), 32 trojan(s). Successful infection resulted in an average of 1 new process(es) on the target machine.

    So, some degree of caution is probably warranted.

  3. User picture
    • Ringman (Silver) on Fri 18 Dec 2009
    • 09:47:52 AM UTC

    It's looks like to be a

    It's looks like to be a false positive.

  4. User picture
    • cconniejean (Platinum) on Fri 18 Dec 2009
    • 10:24:57 AM UTC

    It's not a false positive.

    It's not a false positive. Various page have been comprised. If you look at the source code on some of the pages you can see the code and redirects.

    bangkok.immigration.go.th/
    Detected virus name is Trojan-Downloader.JS.Gumblar.x

    nai.immigration.go.th/
    Detected virus name is Trojan-Downloader.JS.Agent.etr

    Some pages are clean, some are not.

    • User picture
      • onzestan (Rookie) on Fri 18 Dec 2009
      • 11:30:26 AM UTC

      thank you all.

      Thank you all very much.
      Have noticed that the Wot sign is now yellow.
      Can now adapt my website to this situation.
      Thanks again

      onzestan

  5. User picture
    • g7w (Platinum) on Sat 19 Dec 2009
    • 03:19:46 PM UTC

    re: immigration.go.th

    I use FireFox browser.
    When I load the page, I get this:

    Which earns my rating and comment linking back to Google Diagnostics.

    -------
    WOT Services Ltd. - gives us safety through Web of Trust.
    WOT Community - gives us security through unity.
    Thank you all
    - G7W

  6. User picture
    • onzestan (Rookie) on Tue 29 Dec 2009
    • 03:29:25 AM UTC

    immigration bureau thailand.

    Well now Google has lifted its warning regarding this site, and WOT still gives a red sign.
    Situation reversed from before.
    Kindly advise what am I to tell our readers>
    Thanks beforehand

    onzestan

    • User picture
      • g7w (Platinum) on Wed 30 Dec 2009
      • 02:08:59 AM UTC

      re: immigration bureau thailand

      Well now Google has lifted its warning regarding this site, and WOT still gives a red sign.

      Correct, but be honest...
      http://google.com/safebrowsing/diagnostic?site=immigration.go.th/
      What is the current listing status for immigration.go.th?

      This site is not currently listed as suspicious.

      Part of this site was listed for suspicious activity 11 time(s) over the past 90 days.

      What happened when Google visited this site?

      Of the 2541 pages we tested on the site over the past 90 days, 197 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-12-29, and the last time suspicious content was found on this site was on 2009-12-26.

      Malicious software includes 115 exploit(s), 39 scripting exploit(s), 32 trojan(s). Successful infection resulted in an average of 1 new process(es) on the target machine.

      Malicious software is hosted on 50 domain(s), including electro-tex.in/, usg-medbazar.pl/, asitsoft-jo.com/.

      22 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including usg-medbazar.pl/, furniture-style.info/, little-bitty.cn/.

      This site was hosted on 1 network(s) including AS4750 (CSLOXINFO).

      Has this site acted as an intermediary resulting in further distribution of malware?

      Over the past 90 days, immigration.go.th appeared to function as an intermediary for the infection of 3 site(s) including samui-immigration.com/, tkc.go.th/, police.go.th/.

      When you get to a point that Google Diagnostics states 0 listings for 90 days...
      PM me and link to the Google Diagnostics page and this reply, then I shall remove my comment and delete my low ratings. If the site can not stay clean for 90 days... ratings remain as they are.

      -------
      WOT Services Ltd. - gives us safety through Web of Trust.
      WOT Community - gives us security through unity.
      Thank you all
      - G7W

      • User picture
        • onzestan (Rookie) on Wed 30 Dec 2009
        • 04:14:11 AM UTC

        immigration bureau thailand.

        Good heavens are you accusing me of not being honnest?
        Excuse me for not being very computer knowledgeable, and one site giving warnings and another not makes me confused, therefore my request for clarification.

        Anyway thanks for the update and have a happy new-year.

        onzestan

        • User picture
          • g7w (Platinum) on Wed 30 Dec 2009
          • 04:29:22 AM UTC

          re: "honesty"

          My apologies.. you took that the wrong way.
          By "being honest" I meant display the findings - which I did.

          As we (All) now can see...
          Google listed this domain 11 times in the past 90 days. (approximately once every 8.182 days)

          It has been 3 days since Google noticed anything suspicious.. not very long in my opinion, anything can happen within another 5 to 15 days...

          As I stated... 0 malicious results for 90 concurrent days... I might consider this site "clean."

          -------
          WOT Services Ltd. - gives us safety through Web of Trust.
          WOT Community - gives us security through unity.
          Thank you all
          - G7W

  7. User picture
    • cconniejean (Platinum) on Tue 29 Dec 2009
    • 04:23:03 AM UTC

    For me, scanning with Finjan

    For me, scanning with Finjan I no longer get the original warnings, but Avira blocks for the following:
    Requested URL: 'hxxp://nai.immigration.go.th/'
    Category/categories: Malware

    Requested URL: 'hxxp://bangkok.immigration.go.th/'
    Category/categories: Malware

    Requested URL: 'hxxp://www.immigration.go.th/'
    Category/categories: Malware