Visit our Popular Forums

**azflycaster** · 03-22-2006, 06:23 PM

2air,
Yes I have, it was a slow day at work today and I was pushing out Microsoft Critical Updates to 500 workstations and there is alot of wait and see time involved. I think I read everything on the site. BTW, what version of AV areyou running?

Macozil · 03-22-2006, 06:27 PM

Don't worry, I'll be around. By the way, I am pretty much of a Windows Geek. I know my way around a Mac, and can do enough with it to network it to a server. But I am a Windows MCSE, MCT (Trainer) and Netware ECNE. Either I am remarkably hard skinned or completely unobservant because I didn't notice anyone trying to quiet me. I completely welcome being challenged, and am never convinced that I am always right… but I try. :-)

2airishuman · 03-22-2006, 07:14 PM

artlink......
you've been borgartin' the walbernizer again.....pass it around.....
as norton said......"hellooooooooooo ball"

az'....
ok good you've checked it out.....i'm feelin betta'

a/v is 11.0.16.2 and security is 8.0.5.14a with live updates enabled...

i think i've got another year before re-uping cash....

macozil......
in no way was i trying to quiet you either....

and thick skin is a virtue......aluminum or not.....

we need more microsoft enabled folks here.....

and those willing to handle the challenge or this exchange...

so welcome 2 the forums....

cheers
2air'

Macozil · 03-22-2006, 07:21 PM

No problem here 2air, never thought you were. My Ex-wife always said I never noticed when she was mad... that made me mad... so now she is my Ex. So I wonder sometimes how sensitive I am.

guy99 · 03-22-2006, 09:40 PM

Air,
A lot of what hijackthis show is perfectly fine. If you are not sure you can usually google the item and find out.

jordandvm · 03-23-2006, 07:39 AM

I'm having some problems similar to 2air......I got the warning from Norton when I was perusing the March photos thread.....which I thought was interesting and couldn't go anywhere on the forums after the warning. I had to reboot the computer to get back on. I also visited the savewally website just before it happened. I'm running 2006 version of Norton SystemWorks and haven't had any problems before this. I am still having problems with ASforums and have to reboot to reaccess this site to start over. I am not having problems with any other sites that I access.......only ASforums! So is it just you and I......2air that are having problems.....or is anyone else experiencing the same thing?

squrlgurl · 03-23-2006, 07:48 AM

Quote:

Originally Posted by guy99

Air,
A lot of what hijackthis show is perfectly fine. If you are not sure you can usually google the item and find out.

You have to be very careful using Hijack This. Removing somethng that you are unsure of can cripple some programs, your internet access, or even Widows.It is best to save your scan HJT log and post it to a forum like spywareinfo.com. If you are feeling adventurous then proceed carefull by removing items that you check out using castlecops.com and processlibrary.com (DLL search here). Google searching for stuff that is not on ether site is helpful too.

HJT is a tool to use once you already have an infection. It does not run in real time and protect you from anything, so it's really only damage control. I am hoping that PC users will evolve into paranoid creatures and use the multitude of (mostly free) spyware and antivirus protection tools out there. Spybot Search and Destroy, AdAware, Microsoft Defender, SpywareBlaster, AVG Free, AntiVir, Zone Alarm and Sygate (free firewalls...let you know what's "phoning home"). Ditch Internet Explorer and use Mozilla, turn off the preview pane in Outlook Express, and the list goes on.In my business, while I prefer network setups and PC builds, I mostly remove spyware and virus infections from (sometime savvy, but mostly clueless) clients PC's. Even though I send the clean system back to them in a relative state of lock-down, sometimes they manage to still get re-infected. No protection is foolproof and the enemy is always one step ahead of the users. The best protection against an infected PC is to be a cautious user. Think before you click.

It is my mission to teach people this stuff so we can all be safer on the internet!

-Tracey

jordandvm · 03-23-2006, 07:51 AM

After I made my previous post to this thread, I went to the March Photo thread and pics in threads 67, 68, 69, 70, 74, 75, 76 do not show up on my screen.....while all the other pics show up. Also after I visited this thread, I couldn't reaccess the portal and had to reboot the computer to get back onto the forums to post this thread. What's happening? It's very annoying and I've never had this problem! I'm not getting any warnings....just can't navigate the forums! Help!

pienjim · 03-23-2006, 10:30 AM

You can add our laptop to the list of machines that are experiencing the norton threat message reorted by 2air'. After the message the only recourse for forum access is reboot.

The problem only occurs if we accesss the thread "Calling All WBCCI Members". If you stay away from that one no problems. The desktop machine running Zone Alarm Pro doesn't share the problem.

Jim

**Andy R** · 03-23-2006, 01:09 PM

I will update all the software running this site next week and then let's go through more troubleshooting. FYI - Sorry for all of those that are having issues. Nothing has changed on the site for a long time (as far as software).

2airishuman · 03-23-2006, 01:50 PM

hi andyr and thanks for checking in on us......

while nothing has changed on the forums......
is it possible that when we click on these links......that seem to be the problem.....we are re-routed to those links....and off the forum server.....so upgrades/protection on the forum server won't help, or isn't the issue? does my question make sense?

hi, jordandvm and pienjim......

it appears we are having issues with the same sites, which aren't the actual forum threads...but the hyperlinks...in the posts.....so for now i'd just avoid them....
i haven't had an issue with the photo contest thread....but i haven't gone to the linked site/slideshow link.....did you?

if you go to the norton security suite.....on your desktop.....
and find the activity log......and open 'intrusion detection'....there will be a list and a red warning, next to the issues......and how norton has handled it......for me it's a 30 minute block of the ip address....

so doing this will allow you to see details about what triggered the alert, and so on......i've not needed to reboot...but wait out the 30 minutes....and this setting can be made shorter....i think.

when azflycaster gets on line later......perhaps he or one of the other 'it' gurus can chime in.....

since reporting this issue.....i've just avoided those links......with no more warnings by norton....

cheers
2air'

**Stefrobrts** · 03-23-2006, 01:52 PM

2air also mentioned to me he got the warning when following the link in my sig, which used to go to my blog, hosted by Google. Now it goes to my private website, which is on our business server and he said he didn't get the alert at the new site.

2airishuman · 03-23-2006, 02:10 PM

hi stef.....

did you see my cryptic/secret message

to you, in post 23?

cheers
2air'

**jcanavera** · 03-23-2006, 02:28 PM

I'm running the Norton Anti-Virus for watching the email, but I use the free version of Zone-Alarm for my firewall. While it doesn't have all the bells and whistles of the pay version, the basic firewall protection is the same as the pay version. Best of all it's free and probably one of the best software firewall product out there.

I've run a few independent outside test tools that test to see if the firewall is exploitable, and so far we have come through with flying colors.

Jack

**Stefrobrts** · 03-23-2006, 02:57 PM

Quote:

Originally Posted by 2airishuman

hi stef.....

did you see my cryptic/secret message

to you, in post 23?

cheers
2air'

No, I have a heard enough time figuring out what things say on the surface, I don't dig very deep!

Buttercup · 03-23-2006, 11:53 PM

Quote:

just to be clear...this 'detection' happened while on the forum....but after i clicked on links in posts to other sites.....specifically the save wally dot org link...and the decals/pdf document there....so while norton reported it coming from the forums....it was while connected to another site through the forums...is that any clearer? what norton does in in that situation....is lock out the site/ip address for a defined time...in this case 30 minutes....

2air - what pdf file are you talking about. While we have many PDF files on our site, we do not have a "decals" pdf. I am attempting to reproduce this problem but as of yet have not been able to on any machine that I have, mac or pc running several versions of AV software. The virus scanning software I use went through some 6800 files during my testing and found nothing. I do not have Norton.

Also, did I understand correctly that you got the error message AFTER visiting Savewally.org but not while visiting the site? Or did it come up when opening one of the files on the site?

Did your AV software SPECIFICALLY flag any piece of content from Savewally.org? If not, I am confused how you determined that it was caused by Savewally.org.

As the webmaster of that site I take security, and any suggestion of lack thereof, very seriously. Your help in this is appreciated...

2airishuman · 03-24-2006, 01:04 AM

hello b'cup

norton throws a little popup window onto the desktop, lower right corner... whenever there is action...updates in virus definitions, threats, detections (real or not) and so on....since i don't use the full screen for windows....i can see it working.

for me the first time was clicking on carol's link...in message 1? followed by the the pdf doc of the survey....norton didn't fire till the survey opened....not just viewing the home page....was well into the survey....like at the comments section near the end....

next night, same sequence only this time i clicked on the emblems/decals tab.....on the .org page.....again norton fired off....

both times i'd been on the forums sites....an hour or so without issues (and really without issues ever)....

when i closed the .org link and page, which open in a separate window.... and clicked back to the forums page which was still up in the background...the forums page would shut/lock....trying to reopen the page would get a "page not available error"....

norton makes a log of all activity...and recored the issue as i described in post 1...with a 30 minute time out....after which the forums home page would open normally....

when this happend the 2nd time....i watched the norton log....in real time...and while it recorded the forums ip address as the issue it was the minute i hit the .org link to the emblems/decals....or whatever term you are using....

so no norton didn't id the .org ip address, but rather the forums ip address....but my eyes saw the pop up detection box while i was viewing on .org as explained here....does that make sense?

now the other time, i was reading stef's post in this thread....and clicked her blog link....and norton fired again....but after she changed host sites for her blog, no more problems.... she may have changed hosts, literally the same nite you guy went live....so i think her hit was in between my 2 visits to .org....

i know very little about these issues....and only what i've posted as links to the color memory module threats...and i've been careful not to declare where the problem is....or if it's even real....

now 2 others using norton have had something similar......while azfly' had no issues...

any insight welcome

2air'

Buttercup · 03-24-2006, 02:35 AM

Well, I can offer this.

I downloaded the entire site (89.8 MB, 4867 files) to my hard drive on the corporate computer where I work. That computer has firewall and antivirus protection out the yin-yang (as best as you can for a windows machine

). Using McAfee on demand scan, I checked the entire contents of the site. Nothing found. I am not sure what McAfee can check but it does list overflows as one of the checks it performs - for whatever that's worth. I do know that there is no software (MAC or PC) that I could find to test files directly to identify the existence of this overflow issue. Only patches for Windows.

The color management overflow issue is not a new one for PC's and I suspect that, as some of the content is produced on a PC, with photoshop and that software is one that can perform color management on an image (not sure that this makes a difference), this may be part of the issue. But I am not an expert in viruses.

I have read enough about Norton to learn that while it lists no false positives, that may not be the case at all (as reports on a few security forums on the web indicated) - but I'll let the hard core techies determine the validity of that.

I believe that it is the system configuration & Norton issue, rather than our content, that is the root of the problem being as the issue is limited to only a few individuals (and being that I trust Norton's "no false positive" statement about as far as I could throw it

.

If you are able to locate this in your log files (assuming that is enabled) I would love to take a look at the sequence recorded when Norton picked it up.

jordandvm · 03-24-2006, 12:45 PM

Quote:

Originally Posted by 2airishuman

hi andyr and thanks for checking in on us......

while nothing has changed on the forums......
is it possible that when we click on these links......that seem to be the problem.....we are re-routed to those links....and off the forum server.....so upgrades/protection on the forum server won't help, or isn't the issue? does my question make sense?

hi, jordandvm and pienjim......

it appears we are having issues with the same sites, which aren't the actual forum threads...but the hyperlinks...in the posts.....so for now i'd just avoid them....
i haven't had an issue with the photo contest thread....but i haven't gone to the linked site/slideshow link.....did you?

if you go to the norton security suite.....on your desktop.....
and find the activity log......and open 'intrusion detection'....there will be a list and a red warning, next to the issues......and how norton has handled it......for me it's a 30 minute block of the ip address....

so doing this will allow you to see details about what triggered the alert, and so on......i've not needed to reboot...but wait out the 30 minutes....and this setting can be made shorter....i think.

when azflycaster gets on line later......perhaps he or one of the other 'it' gurus can chime in.....

since reporting this issue.....i've just avoided those links......with no more warnings by norton....

cheers
2air'

Update to 2air's suggestion to look into my norton intrusion detection log...... it shows that the information (details) on the intrusion is: IP Address- 69.56.211.54 , Location-Dallas, TX , Node Name 69-56-211-54-the planet.com, Internet Services, Inc. Is this a webhosting address that someone is using on this forum?
I don't know what all this means,

but it's the same address each time I get blocked for 30 minutes.
I got blocked today without any warning showing, and I didn't click on any links or enter the March Photos thread or savewally website. Anyone else besides 2air, pienjim, and me having problems?