Security Issues...........

[Liz Courts]

I had a few problems a couple of weeks ago accessing tMP from both home and at work because of possible viruses. I'm still getting warnings at home but all seems clear at work now!

[Accidental]

I too got a virus the moment I logged into tMp a couple of weeks ago, in fact this is the first time I've visited the site since, I've been deliberately avoiding it so as not to have to go through and sort out all the virus problems again.

Today I thought I would try again hoping that in the meantime it would have been sorted but my Norton has reported it as an unsafe site with the same 6 issues that are listed above.

Me too. It took my work PC out for a whole day last week (which didn't go down well!) so I've been avoiding. The Norton on my home laptop is still flagging it as unsafe today...... not good

[Pauli Walnuts]

Flagged again today by AVG: Exploit Blackhole Exploit Kit (type 200 129.121.128.110/Home/index.php

[Martin Hall]

Sort it out tMP you are trying to shaft my pc too!!!

[WoodenFlugel]

Err excuse me! We've already stated several times now that there is no threat to your computer from tMP. We have run diagnositics on our servers and everything has come back clear. We've checked and re-checked for any threat and there simply isn't one.

So no, we are not trying to 'shaft' your computer - as we have already said. Next time, how about thinking before you start banding acusations like that around?

[andyp]

Be interested to know what people are using/running when they access tmp and get these warnings, might give a clue as to the cause? There are many known exploits in (for example) Internet Explorer which can allow nasties to infect which have nothing to do with the site visited.

FWIW I use Firefox 4 with NoScript and AdBlock Plus, on Windows XP, run Comodo Internet Security and Threatfire, scan with Malwarebytes, and have never had a problem with tMP.

[Anno Draconis]

IE9 doesn't seem to have a problem - so far.

Looks like a job for Windows Update...

[TheFopp]

Kaspersky antivirus is picking it up. It is the 'Windows Recovery' malware and it is being found at the web address 129(dot)121(dot)128(dot)110/Home/...won't print the full address incase people click on it. I know this IP isn't TMP's IP but there is something on your homepage, maybe an ad, that every so often tries to open this IP.

[oleredeye]

....We've already stated several times now that there is no threat to your computer from tMP. We have run diagnositics on our servers and everything has come back clear. We've checked and re-checked for any threat and there simply isn't one.....

Despite your reassurance that tMP is "clean", I am still getting alerts!! Points to note:

1. I AM ONLY GETTING ALERTS ON VISITING tMP - and on no other sites
2. This only happens occasionally - not every time
3. The latest alert is shown in the attached screenshot... detected by AVG 10.0.1209, virus database version 1500/3611.
4. It is also picked up by MalwareBytes 1.50.1.1100 database version 6496
   Files Infected:
   c:\Users\....\AppData\Local\Temp\jar_cache10874010 49578954379.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
5. I am running Internet Explorer 8.0.6001.19048; Windows Vista SP2 with all patches / security updates applied

So how to reconcile your statement that your servers are clean, yet many users are receiving virus / malware alerts?? It has already been noted in this thread that:

1. post #25 mentions embedded links to malicious sites
2. post #30 suggests that the Adverts frames on the Home Page

Scanning the server itself apparently gives a clean bill of health; browsing can occasionally - but not always - give virus / malware alerts. The adverts change - perhaps there is just a single (or possibly a combination of) advert pointing to a rogue site.

(Note too, that the above MalwareBytes alert is to a Java executable; not all users will have Java enabled, therefore may not be susceptible to this problem....)

It is not sufficient for tMP to state that its servers are clean; you may also need to ensure that scripts giving scrolling / changing graphics linking to sponsors are beyond question....

HTH...

[MoominDave]

Kaspersky antivirus is picking it up. It is the 'Windows Recovery' malware and it is being found at the web address 129(dot)121(dot)128(dot)110/Home/...won't print the full address incase people click on it. I know this IP isn't TMP's IP but there is something on your homepage, maybe an ad, that every so often tries to open this IP.

I run Kaspersky on my PC at home, and it has never picked up any problem relating to tMP. It's Windows XP, and everything is fine under each of IE8, FF3, and Chrome.

[Jan H]

I haven't had any warnings either, on different PCs, with different Windows-versions and different virusscanners (but always using Firefox, release 3 or 4).
The three adds on the right side of the screen are, afaik, only animated gifs with a hyperlink. They have been on the site for quite a long time already ("the new 2009/2010 brochure" ????).
What else could it be? the Twitter app? the Paypal link?
Apparently there is a link to suspicious server with IP address 129.121.128.110. I have looked through the source code of several forum pages, but can't find this link
I found this though the website http://safeweb.norton.com/safety?ulang=eng, but they are not clear at all about what they mean with "Embedded Link To Malicious Site". I've looked around on Google a bit, and I found several other websites that colmplaiend about "false positives" from Norton as well.

[Pauli Walnuts]

129.121.128.110. I have looked through the source code of several forum pages, but can't find this link

embedded links within tMp will most likely have the URL and not the IP address .

[andyp]

This may be relevant - particularly the bit about conditional redirects (where the dodgy redirect only happens under certain conditions).

http://redleg-redleg.blogspot.com/20...ious-site.html

[Thirteen Ball]

I havent had any warnings either - but I still got the virus. It came straight past AVG without so much as a by-your-leave. Same 'windows defender/protector sort of virus that's been mentioned on the thread before.

I have to say - without any hint of malice (I know you guys are doing your damndest to make sure TMp is clean) it definitely came down from somewhere on this site too. I'd been happily sibeliussing away for a couple of hours, and (thankfully) saved mystuff and decided to check my subscribed threads. Boom. Pop-ups, errors, disappearing files, the whole nine yards.

I've since given AVG the heave-ho (useless sack of old iron that it was) and invested in Kaspersky - which took it's time but threw it out.... and found a shedload of other spyware cookies that AVG had been ignoring for months....

[Jan H]

if there's anyone who can definitely say which link on the website is referring to this supposedly malicious, please let us know, so we can take care of removing the add or whatever is causing it.
All the other speculations aren't really helping us further...