Malware on Okshooters?

[Hobbes]

Sophos reports nada, zip

Also, google scanned the site last on 6-24 and found no malware at all.



http://www.google.com/safebrowsing/diagnostic?site=okshooters.com


HOWEVER

The host for this site is not so lucky.

http://www.google.com/safebrowsing/diagnostic?site=AS:29854

 

[poopgiggle]

I was able to replicate the warning. It's still there as of like an hour ago.

It's trying to run some windows console commands so, being that I have a mac, I'm hard-pressed to care very much.

 

[dru]

Windows Security Essentials detected VirTool:JS/Obfuscator and cleaned it off my machine. That bit of code is designed to hide another piece of malware. There's definitely some bad juju that's infected the forum software.

I just had the same issue. Windows SE claims it was successfully removed but still concerning to me

 

[Shadowrider]

My MSSE didn't find anything?

Guess I didn't hit the offending link...

 

[poopgiggle]

My MSSE didn't find anything?

Guess I didn't hit the offending link...

It seems like if you're already cookied then it doesn't trigger, from me playing with it all half-assed.

 

[waltham41]

I invited some friends over to check out the CCW shooting in Ohio thread..... one of my friends said his AV triggered when he came here.....

 

[BReeves]

It's trying to download and install Windows Security 2010 or 2011 which is nothing but a scam to get your credit card number. I don't run any resident AV software and was able to shut it down before it completed, then ran Malwarebytes to clean up what got through. I discovered if I went to the OKSHOOTERS home page then to the forum via the link it didn't try to install it. I deleted my shortcut in Favorites, created a new one after accessing the forum via the home page and that seemed to solve the problem.

 

[elwoodtrix]

this is what I get... second time...

http://www.microsoft.com/security/p...=VirTool:JS/Obfuscator.BN&threatid=2147646584

 

[Kelly Drown]

I'm checking into this but at the moment I'm unable to reproduce it and I'm not getting any warnings or anything. (Chrome or IE)

Looks like this is a new pattern file just released so there's a small chance it could be hitting on legitimate code erroneously. I've seen this quite a number of times over the years. The worst was when McAfee accidentally quarantined a legitimate core system file for windows and shutdown a few hundred systems for us.

I'll see if I can trace it down.

 

[poopgiggle]

so there's a small chance it could be hitting on legitimate code erroneously.

This isn't the case.

Try using a private browsing window in FF or Chrome. That trips it every time for me.

It's trying to download and install Windows Security 2010 or 2011 which is nothing but a scam to get your credit card number. I don't run any resident AV software and was able to shut it down before it completed, then ran Malwarebytes to clean up what got through. I discovered if I went to the OKSHOOTERS home page then to the forum via the link it didn't try to install it. I deleted my shortcut in Favorites, created a new one after accessing the forum via the home page and that seemed to solve the problem.

I have been trying to get it to infect a VM since last night but it won't do it. Which version of IE are you using?