Receiving a virus warning.

[SVTKen]

Every time I visit this sub-forum, my Norton Anti-Virus software tells me that it has been attacked by "Web Attack: Mass Injection Website 5". Has anyone else seen this virus activity?

The attacking computer is d1.openx.org/ajs.php and the severity is shown as "High". The source address is shown as 173.241.250.2.

I couldn't find an appropriate place to post this message anywhere on the forum, so I posted it here.

An administrator should investigate this before any computers are infected. My Norton software blocks the attacks.

 

[SNCBOOM]

I flagged your post so that maybe they'll see it sooner.

 

[BossAnaki]

Same thing happened to me.

 

[09Troublemaker]

same thing happened to me.

+1

 

[DRAGUL]

Same here

 

[BossAnaki]

I'll use my phone until I know all is clear.

 

[STAMPEDE3]

Is it happening in one thread or 1 section only?

Most of us see nothing.

Give me links to the thread where it is happening.

 

[BossAnaki]

It seems to be the 2013 section.

 

[SID297]

It's most likely not a virus and def not originating from SVTP. It's likely either a sig pic or google ad. Post links and screen caps of the pages where you get the warning.

I changed the title of the thread to something more appropriate.

 

[mustangcobratim]

Re: This Site Has Been Hijacked with Virus!

I have eset on my computer . It is some kind of Trojan virus it said. It started after I was looking in the. Gt500 cars for sale if that helps

Sent from my Galaxy Nexus using Tapatalk 2

 

[NEBSTA]

My Norton also still advising that it blocked an attack by Web Attack: Mass Injecton Website 5.

 

[SID297]

My Norton also still advising that it blocked an attack by Web Attack: Mass Injecton Website 5.

Post a link and screen shot of the page where you get a warning each time it happens. I'm working on my phone right now so I'm not seeing any warnings. I need more info in order to fix anything.

 

[Admin]

Looks like it's coming through the google Adsense tags.

A screenshot would be helpful to pinpoint it and report to google.

 

[mustangcobratim]

2/3/2013 5:59:06 PM HTTP filter file http://d1.openx.org/ajs.php?campaig.../profile.php?do=doaddlist&list=&userid=130586 JS/Kryptik.AFY trojan connection terminated - quarantined TimBrewster-PC\Tim Brewster Threat was detected upon access to web by the application: C:\Program Files\Internet Explorer\iexplore.exe.

 

[mustangcobratim]

that is one of the threats that it logged. i hope this helps

 

[Red Turtle]

This was sent to me from a user

 

[SVTKen]

It's still happening every time I visit the 2013 Shelby GT500 sub-forum. I'm not sure if it happens anywhere else. Like others have said, it's probably not coming directly from this site, but loading this site or one of the ads/banners/links on it can infect computers.

 

[SVTKen]

This info is directly from the Symantec website:

Web Attack: Mass Injection Website 5

Severity: High

This attack could pose a serious security threat. You should take immediate action to stop any damage or prevent further damage from happening.

Description

This signature detects hidden iframe injected in websites, which upon visiting redirects the user to exploit kit hosted sites.

Additional Information

Attackers inject iframes into website that redirect users to exploit kit hosted sites when visited. These exploit kit sites hosts several different exploits that exploit different client-side vulnerabilities one by one.

Affected
Various browsers

Source: Web Attack: Mass Injection Website 5: Attack Signature - Symantec Corp.

 

[Tob]

Kaspersky never said boo on my end.

 

[ChiSVT]

I'm getting the warning as well.