Prev: pricegrabber.com problem?
Next: Malwarebytes' Anti-Malware 1.45 released
From: Buffalo on 28 Mar 2010 10:49


Ron wrote:
> On Mar 27, 10:59 am, "Buffalo" <E...(a)nada.com.invalid> wrote:
>>
>> I just tried that pricegrabber site again and clicked on the TV box
>> on the lower right and got it again.
>> Buffalo
>> PS: I did send that file to Avira
>
> I just upgraded to Windows 7, 3 days ago, and Avira 10 got the
> warning. Just tried it again and no warning.
[snip]

It seems to be there on an alternating basis (perhaps only seconds or
perhaps randomly on the number of viewers). It may be a false positive, but
I'm not trusting it anymore. I did send the file to Avira and I also send
the TotalVirus results to the Pricegrabber group.

I did let Avira ignore it for a few seconds and then I closed FF3. I could
not delete what it put into the FF temp even though I had FF closed. It said
file was in use. I finally physically disconnected from the Internet and
finally got to delete all the files in FF temp.
Buffalo
I don't know enough about why, but perhaps someone will be able to explain
it to me.
Buffalo
PS: Thanks for posting your results on that page.


From: Andy Walker on 28 Mar 2010 11:31
Buffalo wrote:

>It seems to be there on an alternating basis (perhaps only seconds or
>perhaps randomly on the number of viewers).

This could be a result of load balancing of web servers. Say you have
two server that are used to serve up the same content, if one is
infected visitors to the site would see the infection every other hit.
There are also infections that are specifically designed to attach
infected code only 1 in x visits. If the page only servers up the
infected code 10% of the time it makes detection and remediation
harder.
First  |  Prev  | 
Pages: 1 2 3 4
Prev: pricegrabber.com problem?
Next: Malwarebytes' Anti-Malware 1.45 released