Has anyone else gotten virus intrusion warnings from your antivirus software while surfing through this forum? I have Norton Antivirus and I recently I've been getting warnings from Norton indicating that there's been a worm intrusion and I the program has blocked it for me. This doesn't apply to all threads. I mainly get these warnings from threads with pictures. Maybe the links to the pictures aren't safe? I suggest fellow S2kers to either purchase or update your antivirus software and run a full diagnostic.

I've gotten 2 types of warnings from Norton Antivirus.
Intrusion: HTTP Apache Redundant Slashes DoS.
or
Intrusion: Invalid TCP Destination Port

I keep my computer fairly clean and run scans daily, so I'm sure the problem is from this forum. I hope the mod can sort this out. I've heard of a lot of spammers messing up forums as my website forum has nearly been destroyed by spammers and whatever else they tried to do to my website.

 

YES. LOTS! All from the same source. Mine says this:

Intrusion: HTTP Apache Redundant Slashes DoS.
Intruder: DOWNSTAIRS (192.168.0.135)(1331)
Risk Level: Medium.
Protocol: TCP.
Attacked IP: www.danasoft.com(66.98.200.22).
Attacked Port: http(80).

I have sent this to my internet provider, but have received no response. If you do an IP check on this, it comes from "Marina del Rey".

OH, you should get a mod to move this to "Site Info".

 

yes...same as above.

meek

 

192.168.0.135 is an internal IP, if the attacker is truly coming from that address it is your machines attacking something on the Internet.

Possibly it is this: an ad or graphic or site sponsor inclusion has a malformed URL that your browser is requesting from the server (e.g. www.danasoft.com). This URL probably "looks" like a worm signature to Norton/whatever and it is throwing the wobbler. This would make it look like a machine on your home LAN is "attacking" the site on the internet.

That, or your home machine is compromised and it is paying attention to what sites your browser downloads from, and then tries to attack them.

Edit: www.danasoft.com is a provider of internet signatures. So it is coming from people's sigs most likely.

 

i will check tonight when i get home. 192.168's are internal duh, i'll give u the details from the server log tonight.

 

Norton is a piece of crap and will tell you anything and everything and be wrong on all of it. No flames, I have Norton myself and when the subscription ends I will dump it for good.

 

i use blackice corporate, network ice or whatever it's called...and zonealarm.

 

I think it's in this guy's sig or posts:

https://www.s2ki.com/forums/index.php?showtopic=405888

Luke350

Click on any thread with him in it and you should get the virus warning.

 

Actually Symantec makes good products, what is better?

Snorting proves how users rely on administrator's honesty and technical abilities.

 

Moving to site info.