avast blocking piriform forum

[JohnnyBob]

avast blocking piriform forum

http://forum.piriform.com/

Sometimes I get an avast popup saying it is blocking a virus, sometimes not, but I always get:

Fatal error: require_once() [function.require]: Failed opening required './initdata.php' (include_path='.:/usr/local/php53/pear') in /home/ccleaner/public_html/index.php on line 23

anybody else?

[Asyn]

-> http://sitecheck.sucuri.net/results/forum.piriform.com/
-> http://labs.sucuri.net/db/malware/malware-entry-mwexploitkitblackhole1?v22
-> http://zulu.zscaler.com/submission/show/e1820da766e49e123ab35c26999edc76-1351838538

[JohnnyBob]

Thanks for the links. The first time I tried the zscaler.com link, it said forum.piriform.com is OK. The second time is said it is malicious. The securi.net link reports it as malicious.

forum.piriform.com is an old established forum. I don't go there frequently so don't know how long this problem has existed. Of course they could be infected but I doubt it. I suspect it's just a bug in their code. I tried to email their webmaster but it was returned as undeliverable.

[Asyn]

1. Thanks for the links.
2. I've emailed their webmaster.

1. You're welcome.
2. Good.

[Pondus]

Of course they could be infected but I doubt it.

of cours not....avast must be wrong 

http://urlquery.net/report.php?id=77737

and the site seems to be down now


we have a article somwhere in here (cant find the link now) about infected websites hacked/found every 3,5sek

[Asyn]

Of course they could be infected but I doubt it.

of cours not....avast must be wrong 

They always say that...

[JohnnyBob]

According to the following 2 testers, forum.piriform.com is up
http://www.isup.me/forum.piriform.com
http://host-tracker.com/check_res_ajx/11494891-0/

[Pondus]

found it

Every 3.6 seconds a website is infected
http://www.scmagazine.com/every-36-seconds-a-website-is-infected/article/140414/

noting is 100% secure......
and the more people that visit a site, the more interesting it is for thew bad guys to infect as they fish in the pond that have most fish.....bigger chanse that somone take the bait

[Pondus]

According to the following 2 testers, forum.piriform.com is up
http://www.isup.me/forum.piriform.com
http://host-tracker.com/check_res_ajx/11494891-0/

see the urlQuery link i posted above.....click the picture in top right corner

[essexboy]

Any site can get infected... Geeks to Go was hit about a year back, only Avast spotted it.  The site was down for a day whilst they cleared the redirect malware

EDIT:  A hack has been confirmed, cleaning it now 

[JohnnyBob]

I'm not getting the avast block anymore (are you?), just
Fatal error: require_once() [function.require]: Failed opening required './initdata.php' (include_path='.:/usr/local/php53/pear') in /home/ccleaner/public_html/index.php on line 41
So I think this is a case of a buggy website, not a virus. They've cut themselves off from the outer world by making their registration private and not providing a working email address to contact them. So they may still be unaware.

[true indian]

there is infection there...better not go there 

[JohnnyBob]

there is infection there...better not go there 

I can't. Apparently nobody can because of the website coding bug. It's not working. I doubt that it is a virus.

[essexboy]

Neither Eset nor MBAM will allow you to go there , so methinks an infection is the best bet

[DavidR]

Lets put it this way, why would piriform.com, a UK Company, be connecting to a Russian IP address (rather than a plain language domain name), at best that is obfuscation, at worst highly suspect.

http://en.wikipedia.org/wiki/Piriform_%28company%29.

"Piriform is a privately owned software house based in the West End of London, UK"

Though server appears to be in Texas.

When this is in relation to an iframe, I get even more suspicious as it reeks of iframe injection. Look further and you will find that the 46.166.147.133 IP address is on the avast malicious sites list and WOT doesn't like it either. I'm sure if you do any further analysis on the 46.166.147.133 IP you will no doubt find more, so it looks like an iframe injection attack on piriform.