AVG Virus warning on this Website

[wulf109]

My AVG antivirus program is now warning of active threats on videohelp.com

[budz]

strange....because another member said he's getting scripts....my avast isn't alerting me at all...

[lordsmurf]

Yeah, there's some shit file that it wanted me to download 30 minutes ago -- some sort of ASX crap. I use Firefox, so it doesn't autorun like IE would have probably done.

I know that's a MS stream, but I think it can come with malware payloads. (Not 100% on that, so don't quote me.)

[wulf109]

I'm using Firefox

file name it's warning of :
URL: php.opensourcecms.com/include/e.php
Name: Microsoft Help & Support (type 1302)
[IMG]chrome://searchshield/content/box_bottom_red.gif[/IMG]

[Ai Haibara]

ASF/WMA/WMV videos can force a call to a webpage link, I believe. It wouldn't surprise me if someone was using that for an exploit.

[davidsama]

I am glad i use Firefox 3.6.4 with ad block plus then when i download from here with JavaScript turned off.

[wulf109]

I'm using 3.6.3 and Firefox says no updates available? Turning off Java script solved the problem.

[hech54]

Something called opensourcecms.com is bugging NoScript....never noticed it before.

[budz]

I am glad i use Firefox 3.6.4 with ad block plus then when i download from here with JavaScript turned off.

I use the same firefox version as you along with ad block plus. Odd that I still haven't had any virus/spyware/malware warnings...well not yet anyway. But I don't run AVG on any of my pc's, just use AVAST.

[Slowburn]

I got this popup: Your input can't be opened: VLC is unable to open the MRL 'http://lock.cmpxchg8b.com/b10a58b75029f79b5f93f4add3ddf992/bug-vs-feature.jpg'. Check the log for details. It also caused the right-click function to shut down. I could not even log in here without shutting javascript off in Firefox 3.6.3 Further attempts to connect caused Windows Media Player to attempt to open something.

[DarrellS]

Can you post with scripting off? Hell, I would've turned scripting off a long time ago if I would've known that. I only use scripting on sites I can trust like my bank. Looks like I can't trust videohelp anymore.Hey the webpage finally fills the screen with scripting turned off

[Baldrick]

Where? On all pages? I have not added anything. I just use google adsense banners as external source.

[Baldrick]

It's just vbulletin that has been hacked....I thought vbulletin was safe...

[lordsmurf]

It was the homepage for me.

[Baldrick]

Yep. Looks like a php or apache exploit or something on my servers.

[Baldrick]

I found it. It's the banner rotation system(OPenx) that has a bug/exploit.


Upgrading it to latest version and it should hopefully be fixed.

[wulf109]

I'm still getting a virus warning from AVG unless I turn off Java.

[Baldrick]

It will take some hours to clean up and update.

[Baldrick]

test

[Noahtuck]

I surf through here a quite few times a day & i have not had anything weird happen or a warning pop up.
I am using firefox 3.6.3 with java script on & the latest avast internet security.

Never even knew there was a problem until i just saw this and another thread.

[Nelson37]

Did not get any warning yesterday or last night but just got it twice.

[Nelson37]

warning message pops up with every screen change

[Baldrick]

Updating openx didn't help. Crapware.

[hech54]

I'm running Avast and Firefox with NoScript...no more problems and never had a virus warning of any kind...just that
new NoScript warning about opensourcecms.

[Noahtuck]

I still have not got anything ?
And i have been surfing and reloading the main page, ect.
Huh...

I wonder why some people are getting it and others are not.

[bendixG15]

I got the warning 15 minutes ago but not now ..........

[Baldrick]

It's a bug/exploit in openx so anyone can add html code to the banners that are stored in the database. Newest version doesn't seem fixed so I'm trying another solution now.

[aedipuss]

make sure this malware plugin wasn't installed - "mergedDeliveryFunctions.php.”

[aedipuss]

keep an eye on this - some new php tools coming hopefully.

http://www.darkreading.com/database_security/security/app-security/showArticle.jhtml?a...leID=225700088

[Baldrick]

http://openx.jp/modules/openads/index.php?page=clipping&clipping_id=11300

looks like i'm not alone with similar sql injections.