Malicious Threat notification on MSE Site

rufusdog52

I have logged onto the MSE forums a few times this morning and each time I have had a notice come up from my AVG virus thingy saying a malicious threat has been blocked from this site.

My AVG was updating this morning so not sure whether this is just since it updated or what is going on. Is it anything to worry about? I hav only had the problem when coming to the MSE forums and have not had it before, just today and about 4 times now.

Edited to add, I have just had the message again, says file name is 94.136.40.103 and then says underneath Malicious Site

rufusdog52

Hi Russ
Thank you for your reply. I usually use Firefox which is the latest version, it happened when I went to the Special Occasions thread http://forums.moneysavingexpert.com/forumdisplay.php?f=101 but I also got it when going to the grabbit thread and to this techies thread too. It doesnt happen everytime.

I have tried going through Google Chrome but I didn't get the message come up although I only tried the once.

I am about to try the other things you put in your post and will come back.

malamute

Using firefox and have malwarebytes using the link in the original post 94.136.40.103 results in the following coming up http://www.123-reg.co.uk/

rufusdog52

malamute wrote: »

Using firefox and have malwarebytes using the link in the original post 94.136.40.103 results in the following coming up http://www.123-reg.co.uk/

What does that mean? Sorry I am a numpty when it comes to techy talk lol

malamute

the 4 sets of numbers 94.136.40.103 is a web address which is http://www.123-reg.co.uk/

rufusdog52

Ok thank you

espresso

malamute wrote: »

the 4 sets of numbers 94.136.40.103 is a web address which is http://www.123-reg.co.uk/

Which doesn't help as there are hundreds of domains hosted on that address see here

RussJK

malamute wrote: »

the 4 sets of numbers 94.136.40.103 is a web address which is http://www.123-reg.co.uk/

The IP address of site 123-reg.co.uk is 94.136.40.129:
Hostname: www.123-reg.co.uk
ISP: Webfusion Internet Solutions
Organization: ATLS-LB

and is not on any blacklists otherwise I wouldn't be able to view it

The other ip address just takes you to the hosting site when you go to it directly with a web browser, but is on a number of blacklists:
Hostname: 94.136.40.103
ISP: Webfusion Internet Solutions

Not that it really matters. The OP just needs to know why coming to MSE appears to activate a blacklisted IP address.

rufusdog52

Well I have run a quick scan with Malwarebytes Anti-Malware and it didnt find anything at all. Will try the HijackThis now and post a log. Shall I just post it on here on the forum or through a private message?

RussJK

rufusd!!!2 wrote: »

Well I have run a quick scan with Malwarebytes Anti-Malware and it didnt find anything at all. Will try the HijackThis now and post a log. Shall I just post it on here on the forum or through a private message?

Here is safe enough. I'll suggest some extra steps if you want to protect the browser. I just wanted to make sure you didn't have a piece of malware already on the computer trying to "phone home".

Just let me know what browser you use. I'll be back on later in the afternoon/evening.

rufusdog52

I have been having a play around and think it might be something to do with the Google Toolbar I use in Firefox as I went to go to another site via the Google toolbar and got the same message, so dont think it is anything to do with accessing this site. Thing is I have all my bookmarks on the tool bar that I really don't want to lose if possible as I can access them on any computer.

I have tried uninstalling the toolbar and then reinstalling it but still getting the same malicious notice coming up when I go to use the toolbar.