# Kaspersky (security software) report when browsing site. **URL:** \ **Category:** About This Message Board\ **Created:** [December 24, 2011, 3:25pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283 "2011-12-24T15:25:38Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![robert\_columbia](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@robert\_columbia](https://boards.straightdope.com/u/robert_columbia)\ **Post date:** [December 24, 2011, 3:25pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/1 "2011-12-24T15:25:38Z")
I got the following from Kaspersky when attempting to navigate away from the purring thread ([What does the term "purring" refer to? - In My Humble Opinion - Straight Dope Message Board](http://boards.straightdope.com/sdmb/showthread.php?t=636032)) to General Questions. 12/24/2011 10:17:48 AM Firefox Denied: http: [//knalds.com/news](https://knalds.com/news) (analysis using the database of suspicious URLs) http ://knalds.com/news URL found in the database ---
**Author:** ![robert\_columbia](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@robert\_columbia](https://boards.straightdope.com/u/robert_columbia)\ **Post date:** [December 24, 2011, 3:41pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/2 "2011-12-24T15:41:01Z")
Windows 7 SP1 Firefox 8.0.1 Virginia (thus, Eastern Standard Time) I was logged in at the time, I believe. ---
**Author:** ![Dallas\_Jones](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dallas_jones/32/3277_2.png) [@Dallas\_Jones](https://boards.straightdope.com/u/Dallas_Jones)\ **Post date:** [December 24, 2011, 5:16pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/3 "2011-12-24T17:16:16Z")
Yeah, I just got that one too, and I wasn’t logged in. Norton has been catching these on a daily basis. I no longer bother to say anything about them. Yesterday it was [myrese.com/news](http://myrese.com/news), on the 22nd it was [voctit.com/news](http://voctit.com/news), on the 20th it was [remnas.com](http://remnas.com). My history is cleared before that time but this is almost a daily occurance. I just vew the SDMB as a hostile environment and rely upon Norton for protection. I once a year or more ago, said I would sign up as a paying member if this problem were solved for 6 months but the Dope continues to loose that wager. The subject of security on this web site, and on NONE of the others that I visit has been beaten to death here. The people in charge here to not seem to have the ability to identify or correct this recurring problem. You will soon be told that this is _your problem_,\*\* robert\_columbia \*\*because you are using the wrong browser, or are not using ad blocking software, or are not a paying member, or picked up the problem somewhere else and various other reasons why no one here cares to address this continual issue. ---
**Author:** ![Cleophus](https://avatars.discourse-cdn.com/v4/letter/c/a88e57/32.png) [@Cleophus](https://boards.straightdope.com/u/Cleophus)\ **Post date:** [December 24, 2011, 5:46pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/4 "2011-12-24T17:46:31Z")
Note that the link in the OP’s post leads to an currently active exploit site and _should not be visited_. I reported the post so the link can be broken. It contains a Java exploit that infected a test VM running Windows XP and Java 1.6.0\_26 with XP Internet Security 2012. ---
**Author:** ![TubaDiva](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tubadiva/32/507_2.png) [@TubaDiva](https://boards.straightdope.com/u/TubaDiva)\ **Post date:** [December 24, 2011, 5:52pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/5 "2011-12-24T17:52:55Z")
> [@Dallas\_Jones](#): > > Yeah, I just got that one too, and I wasn’t logged in. Norton has been catching these on a daily basis. I no longer bother to say anything about them. > > Yesterday it was [myrese.com/news](http://myrese.com/news), on the 22nd it was [voctit.com/news](http://voctit.com/news), on the 20th it was [remnas.com](http://remnas.com). > > My history is cleared before that time but this is almost a daily occurance. I just vew the SDMB as a hostile environment and rely upon Norton for protection. I once a year or more ago, said I would sign up as a paying member if this problem were solved for 6 months but the Dope continues to loose that wager. > > The subject of security on this web site, and on NONE of the others that I visit has been beaten to death here. The people in charge here to not seem to have the ability to identify or correct this recurring problem. > > You will soon be told that this is _your problem_,\*\* robert\_columbia \*\*because you are using the wrong browser, or are not using ad blocking software, or are not a paying member, or picked up the problem somewhere else and various other reasons why no one here cares to address this continual issue. Actually no, you won’t be told that it’s your problem. It’s everybody’s problem and we want to know about it, want to stop it as soon as possible. > **[If you get hit by malware on the SDMB](https://boards.straightdope.com/sdmb/showthread.php?t=635028)** > > If you believe you have been victimized by malware while visiting the SDMB, please post a report to About This Message Board so we can investigate. For best results, malware reports should include the following: Tell us specifically what happened,... Thank you for reporting this. We need your information when you encounter these situations and we do take steps against this sort of thing when it happens as we find it based on the information we have. When this happens the site is victimized as well as our users. ---
**Author:** ![Dallas\_Jones](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dallas_jones/32/3277_2.png) [@Dallas\_Jones](https://boards.straightdope.com/u/Dallas_Jones)\ **Post date:** [December 24, 2011, 9:21pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/6 "2011-12-24T21:21:28Z")
> [@TubaDiva](#): > > Actually no, you won’t be told that it’s your problem. It’s everybody’s problem and we want to know about it, want to stop it as soon as possible. > > [If you get hit by malware on the SDMB - About This Message Board - Straight Dope Message Board](http://boards.straightdope.com/sdmb/showthread.php?t=635028) > > Thank you for reporting this. We need your information when you encounter these situations and we do take steps against this sort of thing when it happens as we find it based on the information we have. When this happens the site is victimized as well as our users. I’m sorry, what information would be useful to help the board combat this problem? The particular thread that is being viewed when the anti-virus alert goes off is not really useful because the ad that I might be viewing is not the same as the ad someone else may see while viewing at the same time. It is just tail chasing. The attacking computer address’ at least today are 178.17.163.189 or 178.17.163.115 or some variant of those. And they change, and the .com address’ are spoofed. You won’t find anything to help. The problem resides with the ad provider of the SDMB and Ed has stated that he is not going to change ad providers. That is why I no longer bother to report these things, and why you, **TubaDiva** , are wasting your time if you cannot convice Ed to change to a more reliable ad source. Everything else is just pissing into the wind. ---
**Author:** ![Dallas\_Jones](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dallas_jones/32/3277_2.png) [@Dallas\_Jones](https://boards.straightdope.com/u/Dallas_Jones)\ **Post date:** [December 24, 2011, 9:37pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/7 "2011-12-24T21:37:45Z")
And just now it is [pemarx.com/news](http://pemarx.com/news), 178.17.163.189,80 same attack with at different fake .com address that doesn’t exist. Labeled Malicious Tool Kit Website 9 by Norton. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [December 24, 2011, 9:42pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/8 "2011-12-24T21:42:47Z")
> [@Dallas\_Jones](#): > > The attacking computer address’ at least today are 178.17.163.189 or 178.17.163.115 or some variant of those. And they change, and the .com address’ are spoofed. You won’t find anything to help. Well, for a short-term fix, SDMB could block 178.17.163.\*, since they seem to be coming from that block, and I doubt that we have many members in the Republic of Moldova. ---
**Author:** ![TubaDiva](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tubadiva/32/507_2.png) [@TubaDiva](https://boards.straightdope.com/u/TubaDiva)\ **Post date:** [December 24, 2011, 10:10pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/9 "2011-12-24T22:10:46Z")
> [@Dallas\_Jones](#): > > And just now it is [pemarx.com/news](http://pemarx.com/news), 178.17.163.189,80 same attack with at different fake .com address that doesn’t exist. > > Labeled Malicious Tool Kit Website 9 by Norton. Actually this is VERY helpful. I have IP blocked 178.17 from the board. So yes, you did us a big favor here, and we thank you. ETA: Thank you very much, Musicat, for pointing this out as well. Every contribution is appreciated. ---
**Author:** ![Giraffe](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/giraffe/32/129_2.png) [@Giraffe](https://boards.straightdope.com/u/Giraffe)\ **Post date:** [December 24, 2011, 10:19pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/10 "2011-12-24T22:19:40Z")
Just an FYI, I’m pretty sure blocking the IP within vbulletin isn’t going to do anything. All that does is prevent people from that IP from viewing or making posts. It won’t stop malware-filled ads from redirecting people to those addresses. Someone more network-savvy would have to speak to whether it’s possible to prevent that and if so, how. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [December 24, 2011, 10:29pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/11 "2011-12-24T22:29:14Z")
> [@TubaDiva](#): > > I have IP blocked 178.17 from the board. I wonder if that is too heavy-handed? (I haven’t looked up that IP block in whois, but maybe it should be 178.17.163.\*?) And **Giraffe** might be right. My knowledge doesn’t go far enough to agree or disagree. ---
**Author:** ![TubaDiva](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tubadiva/32/507_2.png) [@TubaDiva](https://boards.straightdope.com/u/TubaDiva)\ **Post date:** [December 24, 2011, 10:47pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/12 "2011-12-24T22:47:26Z")
I don’t know either but as you see I’m willing to try it. The IP ban list does keep anyone from that IP from accessing the message board, not sure if it would do anything for the rest of the site, not sure if it will block this malicious threat. In any event, no harm in trying. ---
**Author:** ![Dallas\_Jones](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dallas_jones/32/3277_2.png) [@Dallas\_Jones](https://boards.straightdope.com/u/Dallas_Jones)\ **Post date:** [December 26, 2011, 4:38am UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/13 "2011-12-26T04:38:12Z")
Today’s threat comes from [hedlio.com](http://hedlio.com) 178.18.243.189 just a minute ago while reading Great Debates, this thread; [It is not necessary to reject a Creator in order to accept evolution - Great Debates - Straight Dope Message Board](http://boards.straightdope.com/sdmb/showthread.php?t=636181) So banning 178.17 didn’t solve the problem, they have just moved the address slightly. ---
**Author:** ![AnalogSignal](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/analogsignal/32/1085_2.png) [@AnalogSignal](https://boards.straightdope.com/u/AnalogSignal)\ **Post date:** [December 27, 2011, 6:40pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/14 "2011-12-27T18:40:54Z")
> [@Giraffe](#): > > Just an FYI, I’m pretty sure blocking the IP within vbulletin isn’t going to do anything. All that does is prevent people from that IP from viewing or making posts. It won’t stop malware-filled ads from redirecting people to those addresses. Yes, this is correct. The ad is launching malware when it runs on users’ computers. Blocking IPs from vBulletin is useless. ---
**Author:** ![AnalogSignal](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/analogsignal/32/1085_2.png) [@AnalogSignal](https://boards.straightdope.com/u/AnalogSignal)\ **Post date:** [December 27, 2011, 7:04pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/15 "2011-12-27T19:04:18Z")
> [@Dallas\_Jones](#): > > And just now it is [pemarx.com/news](http://pemarx.com/news), 178.17.163.189,80 same attack with at different fake .com address that doesn’t exist. Yes, this is the same pattern I saw when I captured a Fiddler trace of a malware attack on Dec 17. In that particular attack, Doubleclick (owned by Google) served an ad from a smaller ad platform [zedo.com](http://zedo.com) which rotates ads. Zedo choose an ad from a malicious site ([spheredintparted.com](http://spheredintparted.com)) which in turn redirected to [ashaph.com/news](http://ashaph.com/news) (in Moldova) which served the Java malware. These attacks are tricky to prevent because they are changing servers and using nested ad networks to hide their malware. ---
**Author:** ![Qadgop\_the\_Mercotan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/qadgop_the_mercotan/32/83_2.png) [@Qadgop\_the\_Mercotan](https://boards.straightdope.com/u/Qadgop_the_Mercotan)\ **Post date:** [December 27, 2011, 7:24pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/16 "2011-12-27T19:24:02Z")
> [@AnalogSignal](#): > > These attacks are tricky to prevent because they are changing servers and using nested ad networks to hide their malware. So, is there anything cost-effective that a low-budget website can do to effectively protect against malware? I could be way off base, but it seems to me that expecting Creative Loafing to solve this is like expecting Costa Rica to solve the Global Warming situation. ---
**Author:** ![GIGObuster](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/gigobuster/32/421_2.png) [@GIGObuster](https://boards.straightdope.com/u/GIGObuster)\ **Post date:** [December 27, 2011, 7:37pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/17 "2011-12-27T19:37:20Z")
> [@Qadgop\_the\_Mercotan](#): > > So, is there anything cost-effective that a low-budget website can do to effectively protect against malware? > > I could be way off base, but it seems to me that expecting Creative Loafing to solve this is like expecting Costa Rica to solve the Global Warming situation. Yeah, hard to do when their president is a chinchilla. 😉 > **[Laura Chinchilla](https://en.wikipedia.org/wiki/Laura_Chinchilla)** > > Laura Chinchilla Miranda (.mw-parser-output .IPA-label-small{font-size:85%}.mw-parser-output .references .IPA-label-small,.mw-parser-output .infobox .IPA-label-small,.mw-parser-output .navbox .IPA-label-small{font-size:100%}Spanish: \[ˈlawɾa tʃinˈtʃiʝa miˈɾanda\]; born 28 March 1959) is a Costa Rican political scientist and politician who served as President of Costa Rica from 2010 to 2014. She was one of Óscar Arias Sánchez's two Vice-Presidents and his administration's Minister of Justice. Aft... ---
**Author:** ![AnalogSignal](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/analogsignal/32/1085_2.png) [@AnalogSignal](https://boards.straightdope.com/u/AnalogSignal)\ **Post date:** [December 27, 2011, 8:13pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/18 "2011-12-27T20:13:14Z")
> [@Qadgop\_the\_Mercotan](#): > > So, is there anything cost-effective that a low-budget website can do to effectively protect against malware? There are not a lot of good options. They can: 1. Complain vigorously to DoubleClick/Google and wait for them to eliminate the malware. 2. Stop using ad networks and host the ads themselves. This would eliminate the malware but it would take time, resources, and technical expertise they probably don’t have. ---
**Author:** ![Dallas\_Jones](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dallas_jones/32/3277_2.png) [@Dallas\_Jones](https://boards.straightdope.com/u/Dallas_Jones)\ **Post date:** [December 27, 2011, 9:44pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/19 "2011-12-27T21:44:06Z")
1. Use your protection! This is the only way to stay safe while visiting the SDMB. Though I have received many attack/alerts, I have never actually been troubled by anything getting through my defences. You are visiting a site that has shown a general disregard for these continual malware reports over several years, and has done little or nothing to change, or respond. If I cared to spend the time to search, I could cite thread after thread, after thread, of these complaints. Neither the will or the technical ability exist here to fix the problem. You must protect yourself while visiting this site. ---
**Author:** ![Ed\_Zotti](https://avatars.discourse-cdn.com/v4/letter/e/fbc32d/32.png) [@Ed\_Zotti](https://boards.straightdope.com/u/Ed_Zotti)\ **Post date:** [January 6, 2012, 5:49pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/20 "2012-01-06T17:49:06Z")
> [@Dallas\_Jones](#): > > Today’s threat comes from [hedlio.com](http://hedlio.com) 178.18.243.189 just a minute ago while reading Great Debates, this thread; [It is not necessary to reject a Creator in order to accept evolution - Great Debates - Straight Dope Message Board](http://boards.straightdope.com/sdmb/showthread.php?t=636181) Since you seem to be getting a lot of these things, you’re in a good position to help us get to the bottom of this. Do us a favor and report all malware indications you receive. Also, if you’ll forgive my asking a possibly stupid question, what is your location? Are you in Dallas? [Next page](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283.md?page=2)