Attack attempts made every time I come here.

**poppytall** · 06-10-2011 07:32 AM

I have a virus protection program so I don't think I've ever actually gotten anything, but every time I come here the little box comes up saying an attack was just blocked. I don't recall this ever happening on any other site.

This is the information I could get, if it's helpful.

Web Attack: Malicious Toolkit Website 2
Attacking Computer: 88.198.41.180, 80
Attacker url: wwwzonis.co.tv/9s1hjngl/?2

Apparently that IP address is from Germany?
Anyway, I love this site and it bothers me that I'm a little worried about computer bugs every time I come here. I don't know if there's anything that can be done about it though.

**caterpillar79** · 06-10-2011 07:34 AM

What is your antivirus and what browser do you use?

**poppytall** · 06-10-2011 07:45 AM

I use Firefox and have Norton Antivirus.

**Little** · 06-10-2011 08:46 AM

Is this on a certain thread or the main site? Are you accidentally clicking on any advertisements? The site is US based, so I'm not sure where the German IP is coming from.

**poppytall** · 06-10-2011 11:28 AM

It's on the main site and I never click on any adverts. It seems to be happening on and off now, instead of every time. I did just get on using my library's computer and a similar warning came up that looked like it was from the same source. I couldn't look into it though, because it was a public computer and I can't access that information.

**Beautiful Disaster** · 06-10-2011 12:26 PM

I've never seen this come up on mine, at home or at the office. This is strange. :\ I searched the virus and came up with this:

Web Attack: Malicious Toolkit Website 2
Severity: High
This attack could pose a serious security threat. You should take immediate action to stop any damage or prevent further damage from happening.
Description
This signature detects attempt to download exploits from a malicious toolkit which may compromise a computer through various vendor vulnerabilities.
Additional Information
This signature detect attempts to download exploits from a malicious toolkit which may compromise a computer through various vendor vulnerabilities.
Affected

* Various

Response
Update all vendor patches to the latest versions.

Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.

**Claret** · 06-10-2011 12:43 PM

I would guess that it has embedded itself in your log in to this site somehow. That would explain why it doesn't pop up on other programs. Run your virus and set it up to do an update then scan your entire computer manually. If it doesn't find it, contact Norton or Firefox and see if they have a special ap that would take care of it.

**Little** · 06-10-2011 12:44 PM

You should make sure your virus protection is up to date, and run a scan. Also, you should get an adware scanner and use it too (you can search google for Ad-Aware, it is free and what I use.) It sounds like this is an internal problem for you. Some malicious programs get into your browser and pretend to be "warning you" about a virus - but actually want you to download the real virus, or their anti-virus program. A good scan with virus software and anti-adware software should take care of it.
If it doesn't, let us know please.

**ItsASecret** · 06-10-2011 05:05 PM

Another good one to have is No Script, it blocks all programs that are run in the background of all websites. If the programs are not able to come forth to begin with any attack attempts are prevented. So far this website has 38 scripts, everything from the coding for the design of this website (and therefore need to keep that script running), to the advert scripts that run. I have no issues and nothing popping up in my virus scanner.