Virus blocked by my antivirus software twice in two days when accessing this site

[Mac]

I don't know what the deal is but last night and then this morning my antivirus stopped me from opening ecf and said a virus was blocked.

AVG calls it "exploit blackhole exploit kit"

Closed everything logged in again and now ecf works fine. This makes me nervous. Any idea what's causing it? ecf was the only page open and I was not running any other software.

 

[carpedebass]

I don't know what the deal is but last night and then this morning my antivirus stopped me from opening ecf and said a virus was blocked.

AVG calls it "exploit blackhole exploit kit"

Closed everything logged in again and now ecf works fine. This makes me nervous. Any idea what's causing it? ecf was the only page open and I was not running any other software.

Same thing happened on my work machine running Windoze. I figured it's probably benign, but annoying none the less.

 

[Mac]

Yeah, that's what I was hoping too. Something fooling the antivirus.

 

[progg]

Do a search for "exploit blackhole exploit kit". It is not benign.

 

[rolygate]

We think there might have been an issue with the previous software version, we've just upgraded everything and things seem to be OK now. Also we have recently changed advert supply channels to one managed by Google, this seems to have some issues with tracking cookies which are being reported as a virus or as spyware.

So things are a bit complicated right now, but hopefully in a couple of days will have settled down so that we can tell what the situation is. Thanks for the heads-up, let's see what happens.

Note to others: normally, you will only experience any issue even on an infected website if:

1. You are using Internet Explorer
2. Your antivirus is not very good
3. You have outdated software on your PC

Macs and Linux are not normally targeted as there are not enough of them to make it worthwhile.

You MUST keep your apps updated - out of date Java, Flash, Adobe PDF Reader etc WILL make you vulnerable and IT IS YOUR FAULT if malware can lodge on your PC due to the obsolete software versions you are using.

Update Java using the JavaRa app, it's by far the best way.
Update Flash and see if you can remove any old versions or installers.
Don't use Adobe PDF Reader. Just don't. Use something like PDF-Xchange Viewer, it's 10 times faster and 10 times less vulnerable.
And if you use IE you know you are asking for trouble - so everything else MUST be 100% right.

 

[Mac]

Do a search for "exploit blackhole exploit kit". It is not benign.

I understand that. I mean that I am hoping it's a false trigger and not the actual exploit.

 

[carpedebass]

I understand that. I mean that I am hoping it's a false trigger and not the actual exploit.

AVG blocked it anyway for me. I know that's not 100%, but I don't think there's too much to worry about.

 

[progg]

I understand that. I mean that I am hoping it's a false trigger and not the actual exploit.

Gotcha. Thanks for the clarification.

 

[Mac]

We think there might have been an issue with the previous software version, we've just upgraded everything and things seem to be OK now. Also we have recently changed advert supply channels to one managed by Google, this seems to have some issues with tracking cookies which are being reported as a virus or as spyware.

So things are a bit complicated right now, but hopefully in a couple of days will have settled down so that we can tell what the situation is. Thanks for the heads-up, let's see what happens.

Note to others: normally, you will only experience any issue even on an infected website if:

1. You are using Internet Explorer
2. Your antivirus is not very good
3. You have outdated software on your PC

Macs and Linux are not normally targeted as there are not enough of them to make it worthwhile.

You MUST keep your apps updated - out of date Java, Flash, Adobe PDF Reader etc WILL make you vulnerable and IT IS YOUR FAULT if malware can lodge on your PC due to the obsolete software versions you are using.

Update Java using the JavaRa app, it's by far the best way.
Update Flash and see if you can remove any old versions or installers.
Don't use Adobe PDF Reader. Just don't. Use something like PDF-Xchange Viewer, it's 10 times faster and 10 times less vulnerable.
And if you use IE you know you are asking for trouble - so everything else MUST be 100% right.

Thank you Roly, for the quick response. Yes my antivirus snagged it and shut it down before it happened. AVG is really not bad at all to be free software. But alone it's not enough to use ie imo. I am far from an expert but have been pretty lucky using their free software and their (paid for) pc analyzer. I run other programs and do other maintanence and have so far avoided the majority of spyware and pretty much any viruses the web has to offer. But I am careful. My concern of course was seeing it pop up here as that is new for me. I will let you know if I run across anything else like this.

 

[Mac]

AVG blocked it anyway for me. I know that's not 100%, but I don't think there's too much to worry about.

Let's hope so...

 

[carpedebass]

I'm noticing another oddity. When I click to read the first unread message, I get some kind of message asking me if I'm sure I want to navigate away from the current page. Doesn't happen every time, but some editor script is running or something.

EDIT....and suddenly I can't type worth a dang!

 

[tiburonfirst]

while the forum was being worked on ms security essentials blocked swf/blacole.d and js/blacole.a for me; not had a problem since earlier today.
but the above-mentioned editor script has popped up a few times when i hit the 'post reply' button ......



spoke too soon - swf/blacole.d was just blocked ......

 

[Mac]

Wow microsoft isn't even listing sfw/blacole.d yet.

Encyclopedia Search Results: sfw/blacole.d - Learn more about malware - Microsoft Malware Protection Center

 

[tiburonfirst]

Exploit:SWF/Blacole.D(?)
Encyclopedia entry
Published: Oct 27, 2011

Aliases
Not available

Alert Level (?)
Severe

Antimalware protection details
Microsoft recommends that you download the latest definitions to get protected.
Detection initially created:
Definition: 1.115.678.0
Released: Oct 27, 2011

 

[rolygate]

We did find an exploit and removed it. It looks as if one of our admin accounts is compromised so we're fixing that.

We have a new forum support admin and he is sorting this out.

 

[tiburonfirst]

looks as if all is proceeding pretty smoothly with the upgrade - all seems well this morning!

just one question

how did i manage to avoid the fb connect button????? didn't know i could be this lucky

 

[carpedebass]

Gosh I love Linux!!

 

[rolygate]

Yeah

As far as i can see you only get problems if you have outdated software on a PC, and maybe if you use IE as well.

If you have a software update manager, and block IE in your firewall (ex: Online Armor), then it is unlikely you will have any problem. A good AV like Avast will probably stop any issues even if you use IE and have old software versions.

 

[warlike36]

IMHO "Avast" is the best........... But then again, who the ... am I...LoL

 

[NeoGills]

Same thing is happening to me man, but thanks all other members who suggest us in easy way.
thanks to all!