Warning be careful with this site - is it infected?

iamskippy

Warning could be infected site

http://www.google.ie/search?hl=en&complete=0&q=citronella+spray&btnG=Search&meta=cr%3DcountryIE

At the top link of this search which leads to

lmshr.fexco dot com/av/vurl/287695702.php

there is a pop up saying there is a virus and it is scanning my pc. It is a scam I think but not sure. Why is it that when you click on the top link

spray) | (mase spray) | (spray play)

it goes to the virus warning but if you copy and paste the url to address bar it doesn't. It is the same url.

How do they make the image of a disk and make it look like scanning? Made it dot com so no on can click

Biggins

There might be advertisements on that site that contain spyware/adware.
Keep away is all you can do. However they might have already infected your machine.

If your getting false advertisements popping up, download the free Malwarebytes tool and run it.
Here: http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

One of the best for checking your system for this crap.

Cuddlesworth

sandboxed it there, yes it is a site hosting a very nasty worm. I would suggest alt-f4 out of your browser and not returning to the site.

as for how they do it, scripts run on the site which take advantage of flaws in web broswers. If you don't want to encounter these things you can run a scriptblocker.

Spear

I have a vague memory of some malware that compromises sites, and only pushes it's payload to visitors incoming through Google, while anyone going direct wouldn't see it.

Cuddlesworth

Biggins wrote: »

There might be advertisements on that site that contain spyware/adware.
Keep away is all you can do. However they might have already infected your machine.

If your getting false advertisements popping up, download the free Malwarebytes tool and run it.
Here: http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

One of the best for checking your system for this crap.

Who site redirects to a stupid webpage telling you that there are virus on your system. When you try to click on the links to remove it it seems to drop about four worms on the system posing as the removal app(thank god for virtual machines) as well as requesting credit card details for it.

Biggins

Cuddlesworth wrote: »

Who site redirects to a stupid webpage telling you that there are virus on your system. When you try to click on the links to remove it it seems to drop about four worms on the system posing as the removal app(thank god for virtual machines) as well as requesting credit card details for it.

iamskippy - Here is a direct link for the Malwarebytes tool: HERE

Download window will pop-up right away (hopefully!)

Had a look at the pic you enclosed Cuddlesworth. Thats a DEFINITE infection you have iamskippy, if you have similar.
Thats window/screen in your pic is a standard type made to pop-up when your infected by false virus warning crap.
The thing warning you of a possible virus - is a virus itself.

You NEED to do a full scan.

Cuddlesworth

Biggins wrote: »

Had a look at the pic you enclosed Cuddlesworth. Thats a DEFINITE infection you have iamskippy, if you have similar.
Thats window/screen in your pic is a standard type made to pop-up when your infected by false virus warning crap.
The thing warning you of a possible virus - is a virus itself.

You NEED to do a full scan.

I don't think you grasp, the pic is of my browser window. Not a explorer window within my virtual system. You have to choose to install the worms.

iamskippy

Hi everyone thanks for the feedback

Biggins I did not download the 'anti virus' I think my av would have blocked it. I have malwarebytes and will scan just in case but i am not getting any popups.

Cuddlesworth wrote:
Who site redirects to a stupid webpage telling you that there are virus on your system. When you try to click on the links to remove it it seems to drop about four worms on the system posing as the removal app(thank god for virtual machines) as well as requesting credit card details for it.

Yes I saw that page posing as my pc bit did not download

Spear wrote:I have a vague memory of some malware that compromises sites, and only pushes it's payload to visitors incoming through Google, while anyone going direct wouldn't see it.

Oh i see

Scanning now with malwarebytes and nav 2009 will let you know the result

iamskippy

Cuddlesworth wrote: »

I don't think you grasp, the pic is of my browser window. Not a explorer window within my virtual system. You have to choose to install the worms.

yes I think you are right. How do they mimmick the window

Cuddlesworth

iamskippy wrote: »

yes I think you are right. How do they mimmick the window

Its the default Windows XP explorer layout with some added parts. Just a flash image using it. No different then a video playing within the browser.

Biggins

iamskippy wrote: »

...Scanning now with malwarebytes and nav 2009 will let you know the result

Good to hear. I have a sneaking suspicion Malwarebytes will be better at finding crap on your machine than the NAV.
Make sure you have the latest updated definitions for either. Good luck.

iamskippy

Cuddlesworth wrote: »

Its the default Windows XP explorer layout with some added parts. Just a flash image using it. No different then a video playing within the browser.

OH I see can imagine how a newbie could get caught, i am getting too long in tooth, famous last words:D?

iamskippy

Cuddlesworth wrote: »

sandboxed it there, yes it is a site hosting a very nasty worm.

What worm?

as for how they do it, scripts run on the site which take advantage of flaws in web broswers. If you don't want to encounter these things you can run a scriptblocker.

Can you suggest a scriptblocker or can I do this through IE7 and 8?

Thanks;)

iamskippy

My scans are clear so i did not get infected. I think it needs the person to say yes to the 'virus warning' and download the 'anti virus'