Firefox and Google Marking this as attack site, again.

[soundguruman]

Just logged on and was blocked by Firefox, because MEF is being marked as an attack site again.
Here is the advisory that has been posted:
Firefox Website Warning | StopBadware
Anyway, stop badware is an organization to keep viruses, etc, off the internet. They will advise you for free.
According to this, Google has marked this MEF as an attack site.

However if you are equipped with adblock, antivirus that is updated, you should not worry all that much.
I am checking my security log, and there is no indication that MEF is an attack site, when I have used it.
Any attempted attack is logged, and there is no recent record of any malware attack from using MEF in my system.
Therefore, I remain skeptical that MEF contains malware at this time...

[Mark Hammer]

Yep, got the same message.

Considering how often MEF appears to have been down or otherwise inaccessible in recent months (presumably for maintenance), is this possibly a result of the many interventions by T-Boy? I'll confess to having no technical clue whatsoever.

[oc disorder]

Computer locked up with insufficent resources to run task manager just then.
Using borrowed Asus laptop running Vista and trying out Avast anti virus which apparantly saved it from a malware infection.
Avast caught the url which was

http://46046.hotfeed.net

I presume this came from MEF as I had no other browser windows open.
If I try to go to the hotfeed site above Avast blocks it as a malicious URL.
Presume its some advertising webpage loader?????
From the Avast notice:-
"Avast! saved your computer from crashing
You just dodged a bullet
You may be wondering how you ended up with a virus, especially if you were visiting a ‘normal’ site. The latest research from the avast! Virus Lab shows that more than 80% of malware (viruses, spyware, and the like) spreads through legitimate websites, with only 1% coming from suspicious or ‘dodgy’ sites.
Good thing avast! had your back."

Well the first time I had to restart !

At the moment MEF seems fine ..bit like Russian Roulette ohh thats another casino add....

[Jazz P Bass]

That url: 4606.hotfeed.net is a pay-per-click advertising IP.

[soundguruman]

Oh I get more of it now...
You get e mail notifications, when you post on MEF
When you click the link to reply, that's how it plants the cookies..
(delete ALL your cookies NOW!!!)
WHEN you receive e mail notifications, from MEF, DO NOT click the "reply" link in your e mail!!!
Then it redirects your internet searches, to:
http://46046.hotfeed.net/
hotfeed .net
Use your firefox browser settings to block http: // 46046 . hotfeed . net

[tubeswell]

Use your firefox browser settings to block http: // 46046 . hotfeed . net

How does one do this?

[soundguruman]

How does one do this?

If running firefox...
when you are re-directed to the spam site...
point at the window (frame) of the offending website site with your mouse
right click
left click view page info
left click permissions
UN-check: "use default"
Check all the boxes: "block"
X close the permission window

Now the offending website cannot connect, and your browser will not be re-directed to that site any longer...

If using firefox, left click the orange firefox box, in the upper left hand corner of the browser
Left click options, left click privacy, left click show cookies, left click remove all cookies.
now the cookies if malicious are removed.

[SonnyW]

Well something seems to have improved lately, not getting the Norton Internet Security notices about Web Attack: Mass Injection Website anymore.

[soundguruman]

NEWS FLASH:The link in your e mail is infected. CONFIRMED!!!
This is not very unusual, a virus in another computer can send your e mail an infected link.
Instead of clicking "reply to thread" in your e mail
log onto MEF without clicking that link.

I am getting mega- blocked when I try to log on. By Firefox, Google and stop badware at 5 AM PST...
A. ONE main mechanism identified is:
Clicking on "reply" links in e mail, sent by (notification of reply) Music Electronics forum.
When you receive these e mails from MEF, DO NOT click the "reply" link. Clicking this link plants (tries to plant) the malware, and re-directs your internet.

B. Had ONE incident of being re-directed (after clicking email reply link), but after blocking the site with firefox permission controls, had no further problems.

This is what's installed:
1. Panda internet security w/ panda firewall
2. Firefox Browser w/ ad block, also contains Norton Antivirus (norton is built into firefox)
3. Microsoft security updates turned off, on purpose.
4. Not using internet explorer or microsoft mail services...on purpose
This combo seems to be pretty effective. Nothing bad has been able to get through it so far.
If you are using Internet Explorer, or Microsoft Mail service (outlook express, etc) I recommend you start using firefox, yahoo mail, G mail, instead.
The alternate services seem to bee less prone to targeting for attacks. (just saying)

[big_teee]

I always had real good Luck, with theSUPERAntiSpyware free version.
It is kind of a antivirus and Malware combined.
Before I retired our company unofficially used it too.
It has a daily Dat file that you manually tell it to update.
If it is on your box, it will find it.
SUPERAntiSpyware | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!
If you are still having trouble, give it a try.

[tboy]

NEWS FLASH:The link in your e mail is infected. CONFIRMED!!!

Confirmed how, exactly? By clicking the link in the email? Clicking that link takes you to a page on the forum; it's the forum that was infected, not the email.

[Jazz P Bass]

Thanks for all the hard work TBoy.
Ban him.

[SonnyW]

Well the Web Attack: Mass Injection Website notices are back today, same details on Norton Internet Security. Seems to me like a reinfection may have occurred.

[J M Fahey]

I get in, read, and post here all day long, such as now, and don't have problems at all.
Of course, my Firefox 9 is setup with NoScript *NOT RUNNING ANY* script which does not come from within MEF itself.
Here's my (very simple ) settings:

Click image to zoom.

I don't say "there's no problem with MEF", unfortunately there's "something", it's just that it does not run.
*If* the bad stuff did run, my Antivirus would warn me (as it did a week ago, once) and block the page or something.

NOTE: and I come here both ways: either "answering MEF notifications mails" and "clicking the link offered" (no problems at all, no wailing sirens, nothing ) or straight clicking some MEF old link in "browsing history" .
Nothing strange or alarming either way .

EDIT: not surprisingly, the first 3 sites I blocked try to fill any page I navigate to with tons of ads, most of them "specially selected for me" based on my personal browsing history.
Big Brother at its best
Not surprised at all that at least one of them is the infection carrier.
And Facebook is more intrusive an nosy than all others combined.
What is it doing inside MEF?

[Jazz P Bass]

I have not seen anything pop at all.
Until this morning.
MS Sec Ess found these bad boys.
Looks like TBoy is still in JavaScript hell.