pcmech.com forum infected? ..or How Do You Know if it's a False Postive?

Viruses and worms
1

It didn’t happen today, but the last 4-5 times I visited the forum at pcmech.com I received a malware popup.

How do verify (and or report it) a false positive?

I read a different thread (http://forum.avast.com/index.php?topic=106680.0) and went to the two sites mentioned there (sitecheck and mywot) and they say pcmech.com is OK, but the didn’t mention the forum section.

It is a highly recommended site for help with computers and tech stuff so it would seem strange for it to have problems spread out over the weeks I’ve tried.

The Avast Web Shield page says:
http://www.pcmech.com/forum/internet-web-applications-cloud/…[Embedded:DeanEdwards]

2

→ http://sitecheck.sucuri.net/results/pcmech.com
→ http://zulu.zscaler.com/submission/show/cf6687c96aa5bb3cbcd6a148bb9c40c7-1349509405

3

Since this is a forum…they post about problems there
my guess is that somone have done a copy and paste of malware code found on a website…and pasted it in the forum, and then avast detect it

this has also happend here in avast forum, and that is why we advice to take a screen shot of the code and paste that as it will not give detection

can you attach a screenshot of the avast warning ?

4

Hi folks,

Get a sucuri alert for the software used here: Wordpress internal path: /usr/www/users/pcmech/pcmech/wp-content/themes/TheSource/index.php
Vulnerable to the -s command PHP-CGI-string vulnerability, exploited in the wild since May of this year,

polonus

5

Good point, Pondus. I’d love to attach a screen shot, but the problem did Not occur again today. Is there any way to review prior popups?

I did take a screenshot of the Avast Web Shield page that shows the last infected page. It said:

“http://www.pcmech.com/forum/internet-web-applications-cloud/…[Embedded:DeanEdwards]”

6

I tried those links, Asyn, and it seems OK but it does have 3 ‘suspicious’ items. I assume that’s OK…? (This is the 3rd time I’m trying to reply… I hope it sticks this time)

7

Thanks polonus… but that is way more advanced than I am. What am I suppose to do?