PPRuNe Forums

PPRuNe Forums (https://www.pprune.org/)
-   Computer/Internet Issues & Troubleshooting (https://www.pprune.org/computer-internet-issues-troubleshooting-46/)
-   -   Virus Question (https://www.pprune.org/computer-internet-issues-troubleshooting/496357-virus-question.html)

lomapaseo 24th September 2012 19:32

Virus Question
 
I got an Email from a trusted friend with a link to an article

the usual http stuff followed by

business7newsco.net/work/?article=22599

When the E-mail opened AVAST alarms went off in red.

I tried pasting the link in bits into giggle search and no such website was found. So I am thinking the link name http: etc.etc. is a direct executable somewhere.

If so where does it reside (server or my HD) and how do I find out what kind of file it is?

Milo Minderbinder 24th September 2012 20:50

just tried the link for you
it appears to point directly to a file on that site, and the file is infective
If your AV sofware worked, you should be OK

Its important to understand though that things have progressed to a point where its possible to embed malware into the link itself not in the actual target URL
you can actually make the shortcut infective........ I don't think thats the case here as I cut and pasted your text, and got the alarm warnings to the problem in probably on the website business7newsco.net/

The site is actually Russian-owned and is almost certainly a deliberate scam site. Details of ownership are at
Business7NewsCo.net - Business 7 News Co (thats a safe link)

The registrant has around another 4000 sites and is

Registrant:
Olga Golubeva
ul. Pushkina 98 56
Barnaul, 656000
RUSSIAN FEDERATION
+7.4955467812



edit - PS he may be a trusted friend, but you can't trust his e-mail
His account has either been hijacked or scammed in some way

lomapaseo 24th September 2012 22:03

Many thanks

I wonder why Giggle failed to alert me to this same information.

I don't like clicking on links to find a pot of infections at the end.

Milo Minderbinder 24th September 2012 23:50

what could it tell you?
firstly theres nothing on that site to index other than viruses
secondly it was only registered on 24th September 2012
No time for it to be indexed

Don't use Google as virus alerting service. Its not what its for. They'll blacklist sites if they can - but they do that by simply blocking them, not indexing them!

next time you want to try something like that, try to plug the URL into VirusTotal
https://www.virustotal.com/
However in this case even that was a waste of time - the scan both on the link, and the domain times out and comes up blank.
Just proves how careful you need to be

Milo Minderbinder 25th September 2012 00:12

heres the interesting thing
Virustotal - shows the site as clean (24 scan engines show as clean, 5 haven't checked it yet)
Sucuri - shows site as clean
urlvoid - three engines show site as contaminated, 26 show it as clean!!!!!

Those three engines which show as contaminated two are DBL blocklists, the other a "World of Trust" rating all actioned yesterday but with no explanation

I think its another example of Avast being ahead of the game again
Yet I've just got Comodo to rescan the site, and again its blank
Whatever is on there is well hidden

lomapaseo 25th September 2012 02:23


secondly it was only registered on 24th September 2012
No time for it to be indexed
Bingo :ok:

I had considered that but felt it was low probability that it was so new that even the master site didn't know it. I figured that it probably came from a site known for trouble.

I suspect that others on the distribution list that got similar E-nail links must have succumb by now.


All times are GMT. The time now is 08:38.


Copyright © 2026 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.