Compromised Websites - Anyone else affected yet?

[somabc]

If you want to learn more about how malware actually works and what you can do about it I highly recommend Malware Analysts Cookbook and DVD: Tools and Techniques for Fighting Malicious Code: Amazon.co.uk

[SpuffMonkey]

Just had it here too - doesn't seem to live through a mandatory profile reboot - thankfully!

[difinity]

Just had one here, blue background red writing. Came through an outdated version of Java. The user said he was on mymaths.co.uk, but looking at the history it's either aol, jerseyplantsdirect.com, bbc.co.uk, bargaincrazy.com, reevoo.com or suitsmen.co.uk.

[mthomas08]

[ATTACH=CONFIG]9691[/ATTACH]We've had a laptop in this morning with another one.

 

Interesting, last week I was on youTube and while looking for a video on how to make something for Cubs when the browser screen went compleletly white and then this page showed up.

 

Must have kicked in from an advert on the page. It does this fake scan and then you get an official looking dialogue box up something along the lines of 'do you want to remove this infection' and the innocent user click yes; job done machine is bu**ered!

 

Note the address people; I've added *.freello.ce.ms* to our blocklist.

 

Pete

 

Had this on 4 member of staffs laptops today, told them just to close it - Mcafee picked and removed two files on one laptop. No hassle there, another two staff members used Google images to search and got one got infected. Removed her profile to fix the issue and the other one just got the website.

 

I must say... this is getting a bit insane really.

 

I am currently making sure all V Scans are updated etc (which thank god they are) also installing windows Essentials which seems to work with zero trouble along side mcafee...

[CAM]

Check our security forum,we have a nice FakeAV discussion going on about attacks from these domains.

 

http://www.edugeek.net/forums/security/73516-fake-virus-websites.html

[difinity]

I'm finding that with the machines i'm seeing that are compromised, they have older versions of Java installed. Even if the latest is installed, the older version is there and that is what is being compromised. The old versions need uninstalling.

[kevbaz]

 

Just today sent out a email to all staff regarding these fake virus result, smt asked why the firewall (im sure they think its an actual wall of fire..) isnt stopping them..

 

and a staff member dropped in their personal laptop earlier which had a hijacker on it, which looked like a pretty kosher MS program, which would also run in safemode! had to do a system restore in the end to get rid.

[tech_guy]

If you want to learn more about how malware actually works and what you can do about it I highly recommend Malware Analysts Cookbook and DVD: Tools and Techniques for Fighting Malicious Code: Amazon.co.uk

 

Just downloaded this now to Kindle on my iPad - looks like an excellent read, thanks!

[somabc]

Just downloaded this now to Kindle on my iPad - looks like an excellent read, thanks!

 

If you purchased a Kindle version of the book from Amazon and didn’t receive the companion DVD, send an email: malwarecookbook at gmail dot com. Neither Wiley nor Amazon have a way to distribute CDs or DVDs with electronic books.

[m25man]

Got to say it guy's but where we run behind Sonicwalls with IPS we never have a problem, so much so I have dumped the Draytek and installed an NSA240 now at home...

 

Without a decent IPS system nowadays your firewall is about as much use as a chocolate fireguard, with home users running their PC's with full adminstrator rights it's only a matter of time before they will come across a website or social networking page that has a malware infected jpeg or iframe exploit.

 

There is a lot to be said for running a walled garden nowadays (all outbound ports are blocked apart from those approved by the administrator)