Clubwrx Infected or linked to something bad?

[PewterTA]

I'm just curious why when I come here I'm getting attacks from this site (not necessarily your site, but linked to) when I go to ClubWRX Forum...

I keep getting multiple .jar files sent from the address below. It only happens when I come to this website...not sent from any other websites and this is with brand new OS installation as well.

I'm blocking these with NOD32 along with Vipre AV programs on multiple computers. So that's two programs that are catching things "linked to" it seems this website... McAfee and TrendMicro (for sure) are letting these through and then when I try to search you get sent through a .ru website on your searches...

I changed the link because I don't want someone clicking on them.

hxxp://91.188.59.53/x/midi.jar a variant of OSX/Exploit.Smid.B trojan connection terminated - quarantined Threat was detected upon access to web by the application: C:\Program Files (x86)\Java\jre6\bin\java.exe.

hxxp://91.188.59.53/x/jar.jar multiple threats connection terminated - quarantined Threat was detected upon access to web by the application: C:\Program Files (x86)\Java\jre6\bin\java.exe.

91.188.59.53 - Geo Information
IP Address 91.188.59.53
Host 91.188.59.53
Location LV, Latvia
City Riga, 25 -
Organization DOCSIS IP pool for cable customers
ISP SIA IZZI COM
AS Number AS6851 BKCNET Autonomous System
Latitude 56°95'00" North
Longitude 24°10'00" East
Distance 1587.28 km (986.29 miles)

[ZJbrandon]

my browser (chrome) keeps giving me malware warnings, too.
i wonder if one of the ads?

[06scoobyrex]

Yeah... I keep seeing weird porn posts too in some weird language...

[mudferret]

Yeah... I keep seeing weird porn posts too in some weird language...

That's just bots, pretty common on most VB sites. There was an easy way to prevent bots a while ago, then they got smarter. I think they're bots that time travelled from the mid-90's since they all have ICQ

[Anub1s]

Here's what I saw just now:

[T0rque]

I've had a couple things too

[nmrortizWRX]

I used to be able to view clubWRX at work, but the site saw the advertisments as a suspected maleware site. So I shut it off and now no one where I work can view it. O well 5200 employees I bet we lost at least 65+ subaru owners that were surfing the site.

[Anub1s]

I used to be able to view clubWRX at work, but the site saw the advertisments as a suspected maleware site. So I shut it off and now no one where I work can view it. O well 5200 employees I bet we lost at least 65+ subaru owners that were surfing the site.

That was YOU?!

j/k

[BlazinWRX]

Checking on what's going on and I'll keep you guys posted. I've never gotten any errors like that personally so there's a chance that it's coming from the user's end.

[mudferret]

Checking on what's going on and I'll keep you guys posted. I've never gotten any errors like that personally so there's a chance that it's coming from the user's end.

I did have a ton of errors like this in the past both with IE and FF; a lot of others did too. Clubwrx, or one or a few of the banner ads, made it onto an unsafe browsing list or malware list of some sort. I haven't had the issue in the past, although I did end up adding rule exceptions for the site. Seems like it's a Chrome issue now, which I don't use.

[Mark Grant]

I have noticed the site is running VERY slow and makes my computer go into no-response mode. I had to hold the power button down yesterday to shut the machine down after this site locked it up. It also says I'm not logged in when trying to respond, that is frustrating. Maybe I should become a contributing member so I don't look like such a douche complaining about how a free site is working, huh?

[FyrHazard]

I've had malware warnings in chrome here also. I can usually just pop back to it and it will let me through, but it happens pretty regularly.

[WRXie]

I haven't had an issue until I used Google Chrome on a PC today. Chrome won't work on my Mac for some reason, but when I use Safari or Firefox I get 0 malware warnings.

[Rogan]

Tim,
I got it on FFX and Chrome, but not IE.

This morning, I did not get it on FFX, but previously, McAfee would go ballistic (late last week) when I'd try to hit the site.

This weekend, at home, Chrome was barking about it too. Nothing so far today, though.

[mudferret]

I had to add an exception for Subaru Genuine Parts as well. I think any/all browsers have been updated to run in hyper safe mode.