Jump to content

[RESOLVED] Malicious Scripts on forums


1 reply to this topic

#1 Minsc

    Member

  • PipPipPipPipPipPip
  • Bad Company
  • Bad Company
  • 463 posts
  • LocationOhio, USA

Posted 23 May 2012 - 06:58 AM

So starting today, MalwareBytes is alerting me that is it is blocking malicious scripts on these forums. I have not had a problem here since I signed up several months ago. I visit the forums on average once a day for the last two months or so and have never had an issue.

The problem occurs when I open some topics in the general forums. I have not yet visit other forums today to see if I have trouble on other sections of the site. Thus far it is two different IP's being reported, both US based. One is New Jersey, the other New Hampshire. I also have my script blocker in my brower to allow everything on mwomers.com

There are many new people posting now with new signatures and posting pictures which are hosted on third party websites. (For example I have been hit by malicious software by photobucket and tinypc).

Is it possible that some of the site updates are just sending false positives to me or is it more likely some members may have some script running behind things they are posting?

For reference, here is today's log (so far) :

2012/05/23 09:58:54 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 59710, Process: firefox.exe)
2012/05/23 09:58:54 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 59711, Process: firefox.exe)
2012/05/23 09:58:54 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 59712, Process: firefox.exe)
2012/05/23 09:58:54 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 59713, Process: firefox.exe)
2012/05/23 10:30:25 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 60119, Process: firefox.exe)
2012/05/23 10:30:25 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 60121, Process: firefox.exe)
2012/05/23 10:30:59 -0400 MESSAGE Starting database refresh
2012/05/23 10:30:59 -0400 MESSAGE Stopping IP protection
2012/05/23 10:31:52 -0400 MESSAGE IP Protection stopped
2012/05/23 10:31:54 -0400 MESSAGE Database refreshed successfully
2012/05/23 10:31:54 -0400 MESSAGE Starting IP protection
2012/05/23 10:31:55 -0400 MESSAGE IP Protection started successfully
2012/05/23 10:43:23 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 60440, Process: firefox.exe)
2012/05/23 10:43:23 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 60441, Process: firefox.exe)
2012/05/23 10:43:23 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 60456, Process: firefox.exe)
2012/05/23 10:43:23 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 60457, Process: firefox.exe)
2012/05/23 10:43:55 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 60480, Process: firefox.exe)
2012/05/23 10:43:55 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 60481, Process: firefox.exe)
2012/05/23 10:43:55 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 60482, Process: firefox.exe)
2012/05/23 10:43:55 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 60483, Process: firefox.exe)
2012/05/23 10:43:55 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 60484, Process: firefox.exe)
2012/05/23 10:43:55 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 60486, Process: firefox.exe)
2012/05/23 10:43:55 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 60487, Process: firefox.exe)
2012/05/23 10:43:55 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 60488, Process: firefox.exe)
2012/05/23 10:43:55 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 60489, Process: firefox.exe)
2012/05/23 10:43:55 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 60490, Process: firefox.exe)
2012/05/23 10:44:03 -0400 IP-BLOCK 69.163.39.108 (Type: outgoing, Port: 60493, Process: firefox.exe)
2012/05/23 10:44:03 -0400 IP-BLOCK 69.163.39.108 (Type: outgoing, Port: 60494, Process: firefox.exe)
2012/05/23 10:46:51 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 60529, Process: firefox.exe)
2012/05/23 10:46:51 -0400 IP-BLOCK 68.168.212.202 (Type: outgoing, Port: 60533, Process: firefox.exe)

#2 Kyle Polulak

    <member/>

  • Overlord
  • Overlord
  • 584 posts
  • LocationVancouver, BC

Posted 23 May 2012 - 04:22 PM

I think your browser/computer is infected. We do not allow javascript to be used by our users.





1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users