Heavily infected site which is not blocked by Avast

[Secondmineboy]

Website URL: hxxp://www.otrforum.com/

See here:

hxxp://www.quttera.com/detailed_report/www.otrforum.com
hxxp://sitecheck.sucuri.net/scanner/?scan=http%3A%2F%2Fwww.otrforum.com%2F
htxp://www.avgthreatlabs.com/website-safety-reports/domain/otrforum.com/
htxp://www.google.com/safebrowsing/diagnostic?site=otrforum.com
htxps://www.virustotal.com/de/url/155ac3466b557bf4781bbd026f45da167a1e359c0da941f005a709bc1ab6c4c2/analysis/
hxxp://zulu.zscaler.com/submission/show/db1b0a88ea586dd860afd12643412b88-1381258333

[Pondus]

Heavily infected site which is not blocked by Avast

detected 
https://www.virustotal.com/en/file/f953f65d93288b564c9031e6a37a1ac63b0e8cb78af43ab65fd57ee83a6dedbb/analysis/1381262428/

[Secondmineboy]

When i go to the Url above it is not blocked.

What have you scanned in Virustotal?

[polonus]

Steven Winderlich,

You are right avast! Shields aren't alarming, but in firefox or Google Chrome you are bloacked in this way by Google Safebrowsing

   Warning - visiting this web site may harm your computer!
Suggestions:

    * Return to the previous page and pick another result.
    * Try another search to find what you're looking for.

Or you can continue to http://www.otrforum.com/ at your own risk. For detailed information about the problems we found, visit Google's Safe Browsing diagnostic page for this site.

For more information about how to protect yourself from harmful software online, you can visit StopBadware.org
 
.

If you are the owner of this web site, you can request a review of your site using Google's Webmaster Tools. More information about the review process is available in Google's Webmaster Help Center.
Advisory provided by   Google

Also see: http://scanurl.net/?u=http%3A%2F%2Fwww.otrforum.com&uesb=Check+This+URL#results
A general IP block recommended: https://www.virustotal.com/en/ip-address/217.70.184.38/information/
The live malware situation: http://support.clean-mx.de/clean-mx/viruses.php?ip=217.70.184.38&sort=virusname%20asc
Also lot of PHISHING going on at that AS,

polonus

[Pondus]

What have you scanned in Virustotal?

The malicious code ...

[Secondmineboy]

I dont know why the website is not blocked then, also there is no malicious code detected..........

[Pondus]

I dont know why the website is not blocked then, also there is no malicious code detected..........

http://sitecheck.sucuri.net/scanner/?scan=http%3A%2F%2Fwww.otrforum.com%2F

[Secondmineboy]

I dont know why the website is not blocked then, also there is no malicious code detected by Avast..........
Sorry. Wrote that wrong.

[polonus]

Hi Pondus and Steven Winderlich,

Well this report is quite convincing: http://www.google.com/safebrowsing/diagnostic?site=http://www.otrforum.com/&hl=en

Of the 211 pages we tested on the site over the past 90 days, 98 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2013-10-08, and the last time suspicious content was found on this site was on 2013-10-07.

Malicious software includes 200 exploit(s). Successful infection resulted in an average of 2 new process(es) on the target machine.

Malicious software is hosted on 15 domain(s), including kocohandre1983.tk/, googledrive.com/, 1381065003.hopto.org/.

8 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including kocohandre1983.tk/, 1381065003.hopto.org/, 1381075802.hopto.org/.

This site was hosted on 2 network(s) including AS24940 (HETZNER-AS), AS29169 (GANDI-AS).

Certainly not a site I want to visit.

Header response via Redleg's Fileviewer
Header returned by request for: htxp://www.otrforum.com/forum.php?s=c26979e310a52b176aa3b1ca153c055e

HTTP/1.1 302 Moved Temporarily
Server: Varnish
Location: htxp://www.onlinetvrecorder.com/v2/?go=forumwarning/forum.php?s=c26979e310a52b176aa3b1ca153c055e
Note: This line has redirected the request to htxp://www.onlinetvrecorder.com/v2/?go=forumwarning/forum.php?s=c26979e310a52b176aa3b1ca153c055e
Content-Type: text/html; charset=utf-8
Content-Length: 315
Accept-Ranges: bytes
Date: Tue, 08 Oct 2013 21:00:13 GMT
Via: 1.1 varnish
Connection: close
Age: 84

The location line in the header above has redirected the request to: hxtp://www.onlinetvrecorder.com/v2/?go=forumwarning/forum.php?s=c26979e310a52b176aa3b1ca153c055e

Code hick-up
 info: [script] wXw.usemax.de/ad.php?userid=1602&wf=1
     info: [decodingLevel=0] found JavaScript
     suspicious: maxruntime exceeded 10 seconds (incomplete) 0 bytes
     error: line:3: SyntaxError: missing = in XML attribute:
          error: line:3: <!DOCTYPE HTML PUBLIC "-/W3C/DTD HTML 4.01/EN">
          error: line:3: ...............^

Source code view: http://www.whoisip.co.za/source//www.otrforum.com/forum.php?s=c26979e310a52b176aa3b1ca153c055e

pol

[Secondmineboy]

This site is really really infected.

I already informed Avast via contact form.

[polonus]

Hi Steven Winderlich,

Thanks for reporting, check whether they indeed flag it and block it through Shield Detection in due time
Good it is blocked by Google Safebrowsing, but there are idiots that start to circumvent such warnings and click themselves into an infection anyway.
These folks cannot be helped, but when they have been here (which is very doubtful) they were noticed and only have to blame themselves for not paying attention.

polonus

[Secondmineboy]

And then are encountering system crashes and other garbage like that.

My computer just crashed a few minutes ago. The Notification service for system messages killed the system.

[Secondmineboy]

A week ago i had the same issues, i reinstalled Chrome and then they were gone. I will see if these happen again.

[polonus]

Hi Steven Winderlich,

You have to start MyEventViewer and look at the events log to get at the source of these errors. It can be interaction between the Microsoft Windows Security Auditing (windows FW notification error) and a specific dll. MalwareBytes Anti-Exploit tool is great at alerting these and on previous beta versions the blocks were also circumvented - this is malcode circumvention at work. It brought MBAE.exe to its knees and I had to restart it manually.

polonus

[Secondmineboy]

In this case it was svchost.exe which had an error.