Malicious Software Warning

[RudieTheFoodie]

I just downloaded google chrome and installed new anti virus/ adware stuff (lavasoft ad-aware and Spy bot search and destroy)and tried to read another thai web board - would have assumed was above board. the antivirus software said the site was attempting to run malicious software and would not open it.<BR><BR>anyone else come across this?

[yabaaaa]

Get a hammer quick beat the computer until its smoking then throw it out the window pronto before it infects the whole of your house, then run for your life, do it NOW there's no time to lose!!

[JetsetBkk]

Post your question in the Computer forum and you might get a sensible reply.

Here:

http://www.thaivisa.com/forum/forum/17-internet-computers-communication-technology/

[7by7]

Moved

[craigt3365]

I get this from my anti-virus fairly often. A big red screen shows up and gives me a button to "get outta here" quickly. Several of the sites are fairly well known...so not sure what is going on.

Would be interested to here from some of our experts on this board...

[ignis]

Yes it is odd, get it from time to time with both Chrome and Firefox..

Now the other week wanted to visit Suzuki th site, The big red screen appeared, so tried Firefox, was the same, last resort I.E. opened no problem. Visited the Suzuki site again yesterday. again could only open in I.E. which I hate.

[sulasno]

post the site so that we can test[/color]

Edited July 17, 2010 by lopburi3
remove link

[lopburi3]

Do not post links to any page that is suspect on this forum - ever.

[welo]

Just post the name of the website, we can find the link on our own. Or send it as private message to those who requested it.

If we are talking about the Firefox message saying 'Reported Attack Site' it is worthy to point out that

• this does not necessarily imply that the owner of the website intends to distribute malware, rather that the website might have been hacked by a 3rd party and modified to distribute malware. This is the most common scenario.
  
• this is not a permanent warning/block. The service is powered by Google, and the website will be checked regularly whether the malicious code has been removed and the website is clean - after a certain period without any malicious activity on the website the blacklisting will be removed. Click 'Why was this site blocked' and you will get a detailed report if the website currently contains malware/malicious code, and for how many days is is clean. Based on this information you might decide to click 'ignore this warning' and browse the website.
  
• Ignoring the warning by switching to Internet Explorer is not a good idea - firstly the warning/block is not set without reason (see above), secondly, IE as the number one browser for the average user is number one target of malicious website attacks, switching to IE will even increase the risk of infecting your PC if the website is actually still infected. Just because IE doesn't give you a warning doesn't mean the website is SAFE.
  
• Thai websites are more often affected because the percentage of poorly maintained websites in Thailand is supposedly higher than in western countries, therefore infections/successful attacks more likely.
  

The warning message I'm talking about:

[JetsetBkk]

I use the Firefox extension called "WOT" - Web of Trust. Naff name, I know.

It's also a little sensitive, i.e. it greys ot the screen and displays a warning message for some popular free software download sites. I usually go to another site if that happens as there are usually lots to choose from.

Of course, you never know whether a competitor of one web site is reporting the other one bad, just to hurt their business! Couldn't be like that, could it?

Thaivisa's rating is "Excellent":

And this is what you get when attempting to go to a "bad" site:

Edited July 17, 2010 by JetsetBkk

[welo]

^^^

WOT is a good pick!

It is slightly different from other blacklisting services, especially Google's 'Attack Site' feature.

While Google only focuses on infected websites spreading malware, WOT allows its community to rate several aspects of the website resp. its owner. This allows 'blacklisting' companies that are known for fraudulent activities or spamming and such.

If you get a negative rating from WOT, I would avoid the site. You can access a more detailed report to find out what problems have been reported, users often provide a comment to their rating explaining further why the website is considered 'bad'. There are websites that are disputed whether they are unethical or not, the comment page will help you make your own judgement.

However, often a website will not be rated at all, which of course does NOT imply that the website is safe. The active WOT community is too small to cover the entire net. Fraudulent companies/groups/individuals often popup new domains and websites on a weekly basis to avoid blacklistings etc.

WOT offers plugins for all major browsers!

welo

[welo]

Btw, here is Google's report for Thaivisa

http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http://thaivisa.com

[RudieTheFoodie]

the site is a "Wooden Entrance" or almost a pine window... i went to a post about some westerners journal of being imprisoned in thailand. the thread was on the front page - it isnt now-and i dont remember what section it was in - helpful i know. several posters in the thread posted a link to another article about it (within this thread). when i tried to view that link - that was when the warning occured, and Lavasoft/google chrome would't allow it to open.strange, as a mate thinks my computers been hacked.any comments on that being paranoid or sensibly cautious?

[craigt3365]

Something like that happened to me also. Went to a site, a blog I think, about some guy living in Hua Hin. I was house hunting there at the time. Dang PC got hijacked. Took me 2 days to recover. But no warnings about anything from any of my antivirus programs until it was too late!

[welo]

the site is a "Wooden Entrance" or almost a pine window... i went to a post about some westerners journal of being imprisoned in thailand. the thread was on the front page - it isnt now-and i dont remember what section it was in - helpful i know. several posters in the thread posted a link to another article about it (within this thread). when i tried to view that link - that was when the warning occured, and Lavasoft/google chrome would't allow it to open.strange, as a mate thinks my computers been hacked.any comments on that being paranoid or sensibly cautious?

I would take any warning seriously. Better to be cautious, the mess you MIGHT get into is probably not worth it.

Of course false alarms (false positives) are possible and not uncommon no matter which antivirus/security solution you use.

Like I pointed out in a previous post, Google's system (built into Firefox by default) will block a malicious/hacked website for at least a view days AFTER the website has been cleaned of the hack/malicious code.

You could check Google's report to see for how many days the website is 'clean' (IF at all) and then decide whether it's worth the risk and ignore the warning. However, many times a website gets hacked AGAIN after it has been cleaned because the security hole that allowed the attacker to infiltrate the website has not been fixed yet.

You still didn't give more details on the reported warning. Was it the same warning as on the image that I posted in my previous comment? Or did the warning come from Lavasoft.

If reported by Lavasoft, the risk also depends on the threat level reported, but I guess Adaware would not block access to a website because of a simple tracking cookie or a similar low-risk threat.

Please note that the pro version of Adaware does not include the powerful Avira antivirus engine like its commercial versions.

welo