Topic: Noticing Malware coming from www.orthodoxchristianity.net...

[ignatius]

Grace and Peace,

I'm noticing Malware getting blocked by Malwarebytes' Anti-Malware from an IP Address 95.169.190.73. I just thought you should know.

[Anastasios]

Thanks for letting me know. That is not the IP address of our server at all. It is coming from the Russian Federation. Could you be more descriptive as to what the alert says?

[Anastasios]

Google has listed our site as clean for all recent history:
http://google.com/safebrowsing/diagnostic?site=orthodoxchristianity.net

Did you only now start seeing this warning?

[ignatius]

Google has listed our site as clean for all recent history:
http://google.com/safebrowsing/diagnostic?site=orthodoxchristianity.net

Did you only now start seeing this warning?

Grace and Peace Father,

Yes I noticed it today. My virus software is blocking it but it comes up every time I refresh a page. It doesn't necessary have to be a virus, it may well be Malware or Adware. But I thought you guys and gals should know since it's your site.

If you check out that IP Address with tools like DNStuff it's coming out of Russia.  

It just states that Malwarebytes' has blocked activity from that IP address.

[Anastasios]

I am happy you have alerted me. I am just not sure where there could be spyware or adware or malware. I checked our server (which is not at that IP address) and there have been no unauthorized intrusions in to the server or files changed in the sources directory...so not sure. Could you send me a private message with the error message/log info from this program you have, because otherwise I will never be able to figure out what to look for.

Thanks!

Fr Anastasios

[Entscheidungsproblem]

I've tried to replicate the error with Anti-Malware, but didn't find anything wrong with it.

I find it fairly odd, since the IP it is linking to seems to come up clean through Google clean browsing and through Anti-Malware itself.  The best bet would be to check the logs to see what exactly it says is happening.  A couple questions: a) when you load and refresh, in the status bar, do you notice it mentioning any site besides orthodoxchristianity.net?, b) are you having this problem with any other websites now or is it still just orthodoxchristinaity.net?

It sounds like it is likely more of a local problem, rather than something on the server.  I'm not sure why that IP would even be mentioned in loading this site (and can't get it to do so on my own machine), unless something locally on your machine is trying to force it.  It might also be a false positive.

[ignatius]

Grace and Peace,

I'm only noticing it on this thread...

http://www.orthodoxchristianity.net/forum/index.php/topic,25198.45.html

every time I enter or post on this thread I see the notice come up....

14:55:46   chris   IP-BLOCK   81.169.145.86
14:56:56   chris   IP-BLOCK   95.169.190.73

It's diffidently coming up only when I've visiting this forum.

[Fr. George]

Maybe someone is targeting people who are watching/on this site...

[Entscheidungsproblem]

Thanks for the info, ignatius.

It is the following picture that is causing the problem:

http://en.academic.ru/pictures/enwiki/66/Byzantium1204.png

from this post.

[ignatius]

Thanks for the info, ignatius.

It is the following picture that is causing the problem:

http://en.academic.ru/pictures/enwiki/66/Byzantium1204.png

from this post.

You are more than welcome. So was it a virus or just Malware/Adware?

[Entscheidungsproblem]

Thanks for the info, ignatius.

It is the following picture that is causing the problem:

http://en.academic.ru/pictures/enwiki/66/Byzantium1204.png

from this post.

You are more than welcome. So was it a virus or just Malware/Adware?

Neither.  For some reason, anti-malware has blacklisted the IP that the image was hosted on.  The image is clean, the website doesn't seem to actively possess any threats, so it is likely that either the site had issues in the past or malicious sites are hosted on the same server or on the same server farm.

[ignatius]

Thanks for the info, ignatius.

It is the following picture that is causing the problem:

http://en.academic.ru/pictures/enwiki/66/Byzantium1204.png

from this post.

You are more than welcome. So was it a virus or just Malware/Adware?

Neither.  For some reason, anti-malware has blacklisted the IP that the image was hosted on.  The image is clean, the website doesn't seem to actively possess any threats, so it is likely that either the site had issues in the past or malicious sites are hosted on the same server or on the same server farm.

Hi Guys. I'm noticing the same warning in the thread on Protestants and Icons... just so you know.

[Anastasios]

Is your program telling you it is because of one of the linked images?

[ignatius]

Is your program telling you it is because of one of the linked images?

Sorry Father it doesn't give me that much info but it appears to be the same issue as before. My guess it's one of the linked images as before. I'm not trying to get anyone worried or anything I just thought someone should know.

[Entscheidungsproblem]

Yup, it is another linked image.

http://mariedenazareth.com/typo3temp/pics/576c12baa6.jpg from this post.

[Anastasios]

Basically if it is a linked image, there will be nothing we can do about it. We could theoretically ban hotlinking to images outside our forum,  but then people would attach the images here and use up all our bandwidth. So if you see such warnings again, know that they are not coming from this site. If you see a warning not related to an image, let us know.

[Velsigne]

Hi,

You are getting malware attacks on this thread: an ex-catechumen comparing the Episcopalian Lent

93.125.99.4

[dcommini]

I just did my own scan and it came back negative for malware. Perhaps it is one of the photos again.

[Velsigne]

I just did my own scan and it came back negative for malware. Perhaps it is one of the photos again.

Okay, thanks for checking on that.