I went to read hpHosts blog just now and received this warning!
Sign of "JS:Redirector-H7 [Trj]" has been found in "hxxp://hphosts.blogspot.com/\{gzip}" file.
MalwareBytes.org was hit last week with a re-direct. They warned us from their front page and asked to keep directing traffic their way that it would be resolved quickly. I had to visit today and it must have been solved because my bookmarked links all worked again.
it could be possible that they have turned their attention to HpHost.
... tis the documentation on the Gumblar/Martuz infection that's triggering it. As I said last time, Avast is technically correct in flagging it as it is malicious code - the fact it's posted "safely" (i.e. it doesn't actually load) isn't checked by Avast.
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
Hi,allDose this mean that this only happens if i go to their forum or the hphosts program? Sorry if this is a stupid question but i dont understand the tech talk.
I have hphosts and Avast and Avast has'nt found anything........
Thanks for your time...........cheers........p...........
This is a blog like forum and heaven forbid that it became infected with the common Web site infection that is prevalent right now and avast! is doing an admirable job of detecting then avast! would alert me that I should not stay here.
A couple of forums that I use very occasionaly were infected and I contacted their owners and they quicky corrected the situation.
Wow, the sun is out after 4 days of cloud and rain.
Its if you go to hoHosts paul but it is perfectly safe to do so has it is a false positive.Meaning the av thinks its a virus but its not.(G.O.M.with Honours).
What's the mystery? (reading it, it seems pretty clear as far as the function of the script blocker, and it's hierarchy as far as internals usage is concerned (i.e. how far between the chain (Web > client) it is based))
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
Re: avast! reports virus on hpHosts blog
Fri May 29 12:43:00 2009 — SamiI'm sure it's a false positive. What's the "/\{gzip}" file? Does that mean this was detected from the compressed page sent by the web server?
MalwareBytes'
Fri May 29 12:52:58 2009 — AthloniteMalwareBytes.org was hit last week with a re-direct. They warned us from their front page and asked to keep directing traffic their way that it would be resolved quickly. I had to visit today and it must have been solved because my bookmarked links all worked again.
it could be possible that they have turned their attention to HpHost.
Athlonite
Your help is always needed.
False Positive
Fri May 29 14:08:00 2009 — cod head (未認証ユーザ)All av,s make false positives occasionaly.Suppose its better than a negative positive.(G.O.M.with Honours).
I reported the false positive to avast!
Fri May 29 17:12:12 2009 — YoKennyNow I will wait to hear what they respond back to me.
It looks like the blog is showing an example of a virus
Sat May 30 01:17:56 2009 — YoKennyIt looks like the blog is showing an example of a virus triggering avast! with an infection warning.
Yep ....
Sat May 30 01:32:54 2009 — MysteryFCM... tis the documentation on the Gumblar/Martuz infection that's triggering it. As I said last time, Avast is technically correct in flagging it as it is malicious code - the fact it's posted "safely" (i.e. it doesn't actually load) isn't checked by Avast.
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
Keywords?
Sat May 30 01:43:23 2009 — evilfantasyCould Avast be hitting on keywords in the URL or is it the body of the web page....or both?
...
Sat May 30 02:31:56 2009 — MysteryFCMHopefully it's hitting on the code itself (I'd be very concerned if it was hitting on keywords)
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
I was hoping you would say that
Sat May 30 02:45:24 2009 — evilfantasyKeywords would be a bit too aggressive and possibly damaging.
FYI
Fri May 29 18:20:45 2009 — MysteryFCMIt's only a partial F/P. Chances are they're picking up on the code outlined in the following post;
http://hphosts.blogspot.com/2009/05/martuzcn-aka-g...
This isn't the first time this has happened and I doubt it'll be the last ;o)
http://forum.avast.com/index.php?topic=38715.0
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
Me too
Fri May 29 22:37:19 2009 — evilfantasySet mine off also.
http://hphosts.blogspot.com/2009/05/martuzcn-aka-gumblar-and-wordpress-does.html\{gzip}
dose this mean.
Sat May 30 09:18:05 2009 — paul gHi,allDose this mean that this only happens if i go to their forum or the hphosts program? Sorry if this is a stupid question but i dont understand the tech talk.
I have hphosts and Avast and Avast has'nt found anything........
Thanks for your time...........cheers........p...........
If You Dont Ask You Will Never Know..
Its on the hpHost blog
Sat May 30 10:30:08 2009 — YoKennyIts on the hpHost blog
This is a blog like forum and heaven forbid that it became infected with the common Web site infection that is prevalent right now and avast! is doing an admirable job of detecting then avast! would alert me that I should not stay here.
A couple of forums that I use very occasionaly were infected and I contacted their owners and they quicky corrected the situation.
Wow, the sun is out after 4 days of cloud and rain.
Perfectly Safe
Sat May 30 09:22:48 2009 — cod head (未認証ユーザ)Its if you go to hoHosts paul but it is perfectly safe to do so has it is a false positive.Meaning the av thinks its a virus but its not.(G.O.M.with Honours).
Perfectly Safe.
Sat May 30 09:29:10 2009 — paul gHey, cod head.Thanks a lot for your quick reply and shedding some light on that for me.
Thanks for your time.........cheers...........p...........
If You Dont Ask You Will Never Know..
...
Sat May 30 13:37:51 2009 — MysteryFCMFor reference;
http://hphosts.blogspot.com/2008/09/avs-throwing-v...
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
There is a discussion about Script blocker in avast!
Sat May 30 16:02:48 2009 — YoKennyScript Blocker mystery
http://forum.avast.com/index.php?topic=45438.0
I know you like a Mystery Steven. :)
??
Sat May 30 18:35:59 2009 — MysteryFCMWhat's the mystery? (reading it, it seems pretty clear as far as the function of the script blocker, and it's hierarchy as far as internals usage is concerned (i.e. how far between the chain (Web > client) it is based))
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
The mistery
Sat May 30 20:07:39 2009 — YoKennyThe mystery is why dude2 does not understand about Script Blocker.
Or maybe I don't understand what he does not understand.
....
Sat May 30 20:18:10 2009 — MysteryFCMhehe that's an easy one ...... it's because he's not technically inclined, and the descriptions of it, aren't being presented in plain "newb" English.
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net