Topic 'Re: Malware on grandcanyonskywalk.com or FP?' in forum 'Security' - dslreports.com http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22644903 en Sat, 11 Feb 2012 05:25:45 EDT Sat, 11 Feb 2012 05:25:45 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22653687
»www.grandcanyonskywalk.com/main.swf]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22653687 Sat, 04 Jul 2009 12:41:36 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22653294 said by CajunTek:

Interesting stuff here.. Tried at home with KAV and IE 8.. get similar results.. At work with Norton... site opens right up in IE 6.. hmmm
With IE8 and NIS I get the ''cannot initialize site'' page.

What Norton are you using with IE6 ?

:)
--
Proud Member of ASAP
DSLR Phishtracker]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22653294 Sat, 04 Jul 2009 10:28:33 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22653178 --
"Facts not FUD!"]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22653178 Sat, 04 Jul 2009 09:35:54 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22652695 said by Its a Secret:

I got the same thing:
*** Can't find address for server webaliser.net: Server failed

Interesting. Why would replying to your post trigger this?
Because I posted the iframe url link, and apparently just seeing that code (even though it is only text in the DSLR [code]...[/code] posting) is enough to trigger the Avast! warning alarm (just as it is sufficient to trigger the same alarm on the grandcanyonskywalk.com site even though the webaliser.net is not actually reachable),
--
A well-regulated militia, being necessary to the security of a free State, the right of the people to keep and bear arms shall not be infringed.
»portscan.dcs-net.net
»nature-pics.com]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22652695 Sat, 04 Jul 2009 02:02:56 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22652681 *** Can't find address for server webaliser.net: Server failed

Interesting. Why would replying to your post trigger this?]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22652681 Sat, 04 Jul 2009 01:53:14 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22652456 said by GuruGuy:

Still getting the av alert after clicking the english flag after the flash page loads..................still an issue.
Interesting, I don't see an english flag even after I allow the flash file to load and also allow the webaliser.net iframe code.

[att=1]

Just out of curiosity, what do you get if you do a nslookup webaliser.net?

Oops, nevermind. I just reread all of your posts in this thread, and you were not using the OP's url to get to the site. Clicking on the flag image from your url however, takes you to the OP's page.
--
A well-regulated militia, being necessary to the security of a free State, the right of the people to keep and bear arms shall not be infringed.
»portscan.dcs-net.net
»nature-pics.com
Click for full size
]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22652456 Sat, 04 Jul 2009 00:20:11 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22652438 said by Its a Secret:

said by NetFixer:


Try flushing your browser and/or DNS cache, and see if you still get the alert message.
Have done that. Intersting though, I went to reply to you and got the Avast! virus alert!
Perhaps Avast! is simply triggering on the webaliser.net iframe link code based on an assumption that anything at webaliser.net is bogus. Just out of curiosity, what do you get if you do a nslookup webaliser.net?
--
A well-regulated militia, being necessary to the security of a free State, the right of the people to keep and bear arms shall not be infringed.
»portscan.dcs-net.net
»nature-pics.com]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22652438 Sat, 04 Jul 2009 00:13:11 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22652238 said by NetFixer:


Try flushing your browser and/or DNS cache, and see if you still get the alert message.
Have done that. Intersting though, I went to reply to you and got the Avast! virus alert!
--
"In the future, that which is not mandatory will be illegal"
"Nobody knows the age of the human race, but everybody agrees that it is old enough to know better" - Anonymous
Click for full size
]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22652238 Fri, 03 Jul 2009 23:09:13 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22652209 said by CajunTek:

Interesting stuff here.. Tried at home with KAV and IE 8.. get similar results.. At work with Norton... site opens right up in IE 6.. hmmm
That's norton for you
--
GuruGuy]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22652209 Fri, 03 Jul 2009 22:58:43 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22652206 said by NetFixer:

said by Its a Secret:

No, it's still there.
The code on the grandcanyonskywalk.com web site may still be there, but webaliser.net is no longer to be found (at least with the DNS servers I use/tried).

<iframe src="http://webaliser.net/statistic/out.php?s_id=1" width="0" height="0" frameborder="0"></iframe>  


webhost:/ # nslookup webaliser.net
Server:         192.168.10.1
Address:        192.168.10.1#53
 
** server can't find webaliser.net: SERVFAIL
 
webhost:/ # nslookup webaliser.net 68.94.156.1
Server:         68.94.156.1
Address:        68.94.156.1#53
 
** server can't find webaliser.net: SERVFAIL
 
webhost:/ # nslookup webaliser.net 208.67.222.222
Server:         208.67.222.222
Address:        208.67.222.222#53
 
** server can't find webaliser.net: SERVFAIL
 
webhost:/ # ping webaliser.net
ping: unknown host webaliser.net


Try flushing your browser and/or DNS cache, and see if you still get the alert message.
Still getting the av alert after clicking the english flag after the flash page loads..................still an issue.
--
GuruGuy]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22652206 Fri, 03 Jul 2009 22:58:18 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22652204 --
da Cajun Darn I hate Malware]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22652204 Fri, 03 Jul 2009 22:58:12 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22650906 said by Its a Secret:

No, it's still there.
The code on the grandcanyonskywalk.com web site may still be there, but webaliser.net is no longer to be found (at least with the DNS servers I use/tried).

<iframe src="http://webaliser.net/statistic/out.php?s_id=1" width="0" height="0" frameborder="0"></iframe>  


webhost:/ # nslookup webaliser.net
Server:         192.168.10.1
Address:        192.168.10.1#53
 
** server can't find webaliser.net: SERVFAIL
 
webhost:/ # nslookup webaliser.net 68.94.156.1
Server:         68.94.156.1
Address:        68.94.156.1#53
 
** server can't find webaliser.net: SERVFAIL
 
webhost:/ # nslookup webaliser.net 208.67.222.222
Server:         208.67.222.222
Address:        208.67.222.222#53
 
** server can't find webaliser.net: SERVFAIL
 
webhost:/ # ping webaliser.net
ping: unknown host webaliser.net


Try flushing your browser and/or DNS cache, and see if you still get the alert message.
--
A well-regulated militia, being necessary to the security of a free State, the right of the people to keep and bear arms shall not be infringed.
»portscan.dcs-net.net
»nature-pics.com]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22650906 Fri, 03 Jul 2009 17:40:13 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22650838 http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22650838 Fri, 03 Jul 2009 17:25:28 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22650076 http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22650076 Fri, 03 Jul 2009 14:31:01 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22649610 http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22649610 Fri, 03 Jul 2009 12:33:36 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22649390 Thanks.
--
"Facts not FUD!"]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22649390 Fri, 03 Jul 2009 11:45:58 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22649380
when i loaded that page, the HAVP(Http Antivirus proxy) running ClamAV on my pfsense box(which scans all traffic passing though my pfsense box with clamav) threw up this warning before Avira even got a chance to do anything

"This page was blocked because it contained the following virus: PUA JS.Obfus-2

So I would say its infected...]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22649380 Fri, 03 Jul 2009 11:44:46 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22649161 said by Grail Knight:

Fx v3.5.1 says it "Can not initialize."
Mine did too at first, then I typed it in as

www.grandcanyonskywalk.com

And it worked. After I clicked the little English button below I got the Avira warning.
--
GuruGuy]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22649161 Fri, 03 Jul 2009 11:03:53 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22648698 --
"Facts not FUD!"]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22648698 Fri, 03 Jul 2009 08:01:22 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22648630
Requested URL: www.grandcanyonskywalk.com/mainmenu.html
Information Contains recognition pattern of the HTML/Infected.WebPage.Gen HTML script virus
--
GuruGuy]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22648630 Fri, 03 Jul 2009 07:24:05 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22648628 --
GuruGuy]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22648628 Fri, 03 Jul 2009 07:22:12 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22648595
(Note: the real Webalizer domain is spelled with a 'z'.)]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22648595 Fri, 03 Jul 2009 06:48:34 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22648043 --
"The same ferocity that our founders devoted to protect the freedom and independence of the press is now appropriate for our defense of the freedom of the internet. The stakes are the same: the survival of our Republic". Al Gore, The Assault on Reason]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22648043 Thu, 02 Jul 2009 23:58:25 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22646362 said by beefcake122:

Firefox 3.5 says it "cannot initialize site". It never trys to load.
www.grandcanyonskywalk.com won't load in IE6 or Opera either.

Try: www.grandcanyonskywalk.com/mainmenu.html

Searching for webaliser.net that was in the i-frame pulls up different opinions about that site.

----
rich]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22646362 Thu, 02 Jul 2009 17:26:34 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22645970 http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22645970 Thu, 02 Jul 2009 16:12:07 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22645914 http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22645914 Thu, 02 Jul 2009 15:58:57 EDT Re: Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22645219 --
My dog walks on water.]]> http://www.dslreports.com/forum/Re-Malware-on-grandcanyonskywalkcom-or-FP-22645219 Thu, 02 Jul 2009 13:38:07 EDT Malware on grandcanyonskywalk.com or FP? http://www.dslreports.com/forum/Malware-on-grandcanyonskywalkcom-or-FP-22644903
hxxp://www.grandcanyonskywalk.com/mainmenu.html

Anyone else getting this with another AV?
--
"In the future, that which is not mandatory will be illegal"
"Nobody knows the age of the human race, but everybody agrees that it is old enough to know better" - Anonymous
]]> http://www.dslreports.com/forum/Malware-on-grandcanyonskywalkcom-or-FP-22644903 Thu, 02 Jul 2009 12:38:44 EDT