Virus Detected on Forum Private Message

[BobFromBucks]

I just got a virus warning for a nasty bug. It was in a private message.

Make sure you have your virus software up-to-date.

[knight0334]

It is false or overly sensitive hit from the advertisements.

[Totez]

I'm not so sure its a false. I've been getting it on specific threads for the past two days (most notably my pup's surgery donation page today every time I click reply).

I think the forum may be getting hacked and viruses being planted.

[StingyGunner]

Well if this is the case, adios for a while.

[ungawa]

Streaker posted a virus yesterday:

http://forum.pafoa.org/lounge-108/25...ml#post2719267

[soberbyker]

.

[bogey1]

Damn democrats.

[Rblakely]

It is false or overly sensitive hit from the advertisements.

Well Knight, I for one welcome my new virus overlords



I use an Ipad....no viruses for me

[psusra112]

.

It's the ads. VirusTotal has nada for the site itself:

https://www.virustotal.com/en/url/0b...is/1399426281/

However, if you search the IP 190.123.47.198, which is being loaded by ads, you see this:

https://www.virustotal.com/en/ip-add...8/information/
http://malware-traffic-analysis.net/.../29/index.html

That IP address has been used to do forum redirection and inject malicious code into browsers. That's what is probably tipping your HIDS when browsing PAFOA. As of right now, Snort isn't triggering any alerts for me when I browse PAFOA, so I don't think there's anything wrong with the actual site.

I'd suggest that the administrators pop a note to their ad company that they're serving up malware domains and request that ads originating from that IP be blocked from display on PAFOA. It should prevent these alerts (and threats to users) from occurring.