Site Being Blocked for Malware quite Frequently

B

Bassman2003

Veteran
Hello,

I have noticed that in the past three weeks I have had DVXUser blocked by my Anti Virus when I hit the favorite to visit this site. The website listed on the red screen has been different every time. If I close and come back everything is fine.

Just thought I should let somebody know.
 
Hey. Has it been a specific thread that has been causing it? Sometimes a link is posted in a thread that is to a flagged site, which in turns flags that page of the thread on this site.
 
Hello,

it is my favorite for the index page of the forum. It just happened again. Next time I will try to capture a screen shot.
 
please do. I am unable to reproduce, and google diagnostics is telling me there were zero pages flagged in the last 90 days.

Also, please let me know what av you are using.

Thanks.
 
ok, it happened again. I am using Microsoft Security Essentials. I have attached the screenshot. All works well after I close Internet Explorer 11 and go back to DVXUser.
 

Attachments

  • Blocked Page.jpg
    Blocked Page.jpg
    16.8 KB · Views: 0
Thanks. That is helpful. Is everyone else getting that same domain?

So far, I am unable to find anything on the site that would be causing this. I am still investigating, and any additional info would be helpful. Thanks.
 
My Symantec pops up when I go to the forum. Just says web attack blocking 96.30.3.96 (ip lookup says host landmineads.com)

Then it blocks dvxuser for 600 seconds.

"Malicious image request detected"
 
Last edited:
If I try to open the forum in Safari, there is actually a little tab at the bottom of the page that says "connecting to landmineads.com"
 
landmineads is where the banners are served from, so that is why you see it loading on page loads.

However, I'm still trying to investigate why it is flagging for some of you...
 
At work I also get blocked by the fire eye server. Here's a partial report
alerts:
msg: normal
product: CMS
version: 7.6.2.418330
appliance: fireeye-cms.xxxxxxxxxx.com
appliance-id: 00:25:90:87:8A:AC
alert (id:25843, name:infection-match):
product: Web MPS
appliance-id: 00:25:90:87:40:88
severity: minr
version: 7.6.1.418520
sensor: fireeye-web
explanation:
protocol: tcp
analysis: content
malware-detected:
malware (name:Exploit.Kit.Angler):
stype: bot-command
sid: 84575018
cnc-services:
cnc-service:
protocol: tcp
port: 80
address: 185.66.9.113
 
I see nothing has been done. I quit coming here because a standard installation of Symantec blocks the site while I'm at home and Symantec and Fireeye server block the site while I'm at work.
 
I just checked and at the bottom of my screen (using Safari) I see this:

Copyright 2003-2015. DVXuser.com and Landmine Media, Inc.
Links monetized by VigLink​
 
Must have done something... Not getting blocked anymore. :cheesy:

I'll check Monday if the Fire Eye server at work is letting it through now.
 
Last edited:
You must log in or register to reply here.
Back
Top