Exploit Toolkit Website 33 Attack

I haven't seen the problem at all but I have most of the scripts turned off.

Everything I've read on the net says that someone, a hacker, has loaded a malware program on Fauna

I would like to know where that is coming from as well. I'm going to go out on a limb here and say it's probably not and nobody is stating that fauna specifically has been hacked.

This has happened on several forums I visit. Conclusion, none of the sites had this scenario play out.

Everything I've read on the net says that someone, a hacker, has loaded a malware program on Fauna through an infected IFrame that looks to load a password stealing trojan thorough computer programs like Java, Adobe Reader, Adobe Flash Player, etc. For the past 3 days Norton has blocked attacks on my computer every time I login into the main page at Fauna. I also get attacked when I login to respond to this thread. I feel sorry for those who anti virus-software is not up to date as they will get infected.

I'm not a fan of Norton but I'll leave it at this, a lot of times this problem comes from Norton and java misreading advertisements.

Debating if I should post I have the goggle and banner ads turned off or not but it's a better option then telling and assuming a 'hacker" has infected fauna.

If you turn off the scripts you will not get the message.

java-script is rewriting a url for the advertisement. Norton then reads it wrong. Email Norton and tell them they have a bug.

Almost every time this issue has come up (or similar issue) on every forum I have visited it was a problem with google ads, java/ Norton combination.

I have Java disabled on Mozilla Firefox and I'm still getting multiple attack warnings from Norton when I go to Fauna and login. Also read about the infected IFrame theory at www.symantec.com Feel free to go there and type in Blackhole Theory in their search button and read for yourself.

Originally Posted by Snakepliscan

I have Java disabled on Mozilla Firefox and I'm still getting multiple attack warnings from Norton when I go to Fauna and login. Also read about the infected IFrame theory at www.symantec.com Feel free to go there and type in Blackhole Theory in their search button and read for yourself.

I did check on this specific error and in every instance, Norton seems to be in the center of it. This particular error has cropped up on other sites in the past. Simply Google the thread topic line (Exploit Toolkit Website 33) and see what you come up with.

Quite frankly, I will NOT run Norton AV on any of my systems. It sometimes comes with new systems as a trial-based "freebie" that is quite difficult to eradicate from your system if you decide you don't want that product. I have come to think of Norton AV as a malignant program itself in that regard.

So quite honestly, I'm leaning towards Norton being the issue here. Possibly there has been some change with Google in how it feeds ads here that Norton has not kept in step with to recognize as legitimate code. Certainly my AV and Firewall protections haven't given a single peep about a problem, and I dare say I am here more hours during a day than most people. I have done all I intend to do to satisfy myself that my server and/or this site has NOT been compromised by a hacker. If anyone feels otherwise, and feels this site is a risk to them, I guess you have to make your own decision about what to do about that.

Originally Posted by Dennis Hultman

I haven't seen the problem at all but I have most of the scripts turned off.


I would like to know where that is coming from as well. I'm going to go out on a limb here and say it's probably not and nobody is stating that fauna specifically has been hacked.

This has happened on several forums I visit. Conclusion, none of the sites had this scenario play out.


I'm not a fan of Norton but I'll leave it at this, a lot of times this problem comes from Norton and java misreading advertisements.

Debating if I should post I have the goggle and banner ads turned off or not but it's a better option then telling and assuming a 'hacker" has infected fauna.

If you turn off the scripts you will not get the message.



Almost every time this issue has come up (or similar issue) on every forum I have visited it was a problem with google ads, java/ Norton combination.

Dennis... I have my FireFox buttoned down tight. I don't get any google ads here and I still got attacked when I visited this site. Actually... I got attacked both times I logged in today.

Therefore I can't see how it's a google ad vs Norton combination since I see no ads. I do however have Norton blocking the attacks. I had brought it up to Rich via PM and he told me about this thread.

Originally Posted by WebSlave

I did check on this specific error and in every instance, Norton seems to be in the center of it. This particular error has cropped up on other sites in the past. Simply Google the thread topic line (Exploit Toolkit Website 33) and see what you come up with.

So quite honestly, I'm leaning towards Norton being the issue here. Possibly there has been some change with Google in how it feeds ads here that Norton has not kept in step with to recognize as legitimate code. Certainly my AV and Firewall protections haven't given a single peep about a problem, and I dare say I am here more hours during a day than most people. I have done all I intend to do to satisfy myself that my server and/or this site has NOT been compromised by a hacker. If anyone feels otherwise, and feels this site is a risk to them, I guess you have to make your own decision about what to do about that.

Originally Posted by LauraB

For the 3rd time today, my AVG blocked a threat. Not 4 minutes ago, I clicked on an ad for Bufo alvarius adults posted by a "Bruce Banner" and got the latest threat blocked. I, too, only got the threats here.

Unfortunately, I didn't look closely at the threat, so can't ID ... but I use AVG, Spybot S&D, Malwarebytes and CCleaner, and use all regularly. (Can you call me paranoid? lol)

Originally Posted by Metachrosis

Got the Blackhole AVG pop up for the first time today myself
I run Firefox and have yet to load the 24.0 update due to some screwy acting things the last week or so.

Just out of curiosity... how can you say Norton is at the center of it when both Norton users and AVG users are having the issue. I mean... I understand your position. You've scanned your server and it came up negative... but something is causing the problem. I am all over the web and haven't had this pop up until I came here.

I don't have a freebie bundled Norton Anti Virus software myself. I've have the latest version that I paid for and I update and upgrade it on a regular basis.

Rich... after some digging I ran across this. Maybe it will help.

http://www.wordpress.org/support/top...w-to-remove-it

Originally Posted by WebSlave

I know this might sound dumb, but did you scan your own computer using another virus checking program?

I've scanned with both Norton Internet Security and Trend Micro's Housecall. Both scans came up clean.

Originally Posted by Snakepliscan

Rich I've gotten 3 attacks in 2 days. My Norton says it's Blackhole Toolkit Website 36, Blackhole Toolkit Website 31 and Exploit Toolkit Website 33. What I've read via google my Norton IS 2013 is saying that there is malware loaded in an add somehere on Fauna and every time I visit Fauna's website Norton is blocking an attack from this malware which is trying to expolit vulnerabilities on my pc.

Google is saying the malware has to be wiped at the website hosting servers end. According to Norton this malware is very high risk. The malware tries to load a trojan which steals login password info. So if you pay your bills online BEWARE! I've done scans on my pc and Norton says it's not infected. Since yesterday Norton has blocked 3 high risk attacks and I only get them when I go to Fauna.

If you happen to get infected

Removing the Blackhole Exploit
http://www.youtube.com/watch?v=YAesD1TEfk0

Well, I just ran the online AVG scanner on this site and it came up clean.

http://www.avgthreatlabs.com/website...assifieds.com/

Also did this one -> http://sitecheck.sucuri.net/results/...lassifieds.com

And this one -> http://www.urlvoid.com/scan/faunaclassifieds.com/

Until I see a problem, I have absolutely NOTHING to go on. If anyone feels this site is a problem to you, then you have to deal with it as you feel is in your best interests.