Malicious Image - Adssiverdisc

[Jonathan-Joe]

Every time I open a new page in AnswerBank, Norton blocks a "Malicious Image Attack" from ads.silverdisc.co.uk. I will not use AnswerBaank untin this is sorted.

[factor-fiction]

I realise you may not see this reply, but Avast doesn't seem to have an issue and Norton has never had an issue when i occasionally run that

[AB Editor]

What are you using for your anti-virus?

[AB Editor]

Sorry, I see you've said "Norton" in your OP.

We'll have a look.

[aelmpvw]

never had that problem with norton

[perseverer]

Having exactly the same problem as Jonathan-Joe

[AB Editor]

Thanks. Is there any more information given by Norton?

[shoota]

Me too + something else I can't remember the name of. Just occurred this morning.

[AB Editor]

We think it's related to this: https://community.norton.com/t5/Norton-Internet-Security-Norton/saveweb-says-dnsdojo-com-is-unsave-when-it-is-safe/td-p/481400

Working on it now.

[shoota]

ads.silverdisc.co.uk are the culprits.

Attacking computer (64.237.61.69, 80)

Do you need 'owt else?

[AB Editor]

"ads.silverdisc.co.uk are the culprits."

LOL, no they're not, it's where we serve our ads from.

What ads are on the page when you get the error message?

[shoota]

Tesco Real Food
LSBF ACCA exam success
Jumio NetVerify

[AB Editor]

Thanks :)

[shoota]

This time its just LSBF ACCA and Joe Malone perfume (?)

[pinkyboyid]

Just another observation for what is worth but,

it could still be sliverdisc.co.uk since they are serving out the adverts, see the advert on the right-hand side of your web page if you select properties/source in the web browser.

Not sure if the info below for the Symantec Norton site is vaild for this 'attack' condition, but it looks as if it could be based on "Malicious Image Attack" .

http://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=23331

[shoota]

There is no one advertiser common to all occurences.....

[perseverer]

This is the message I am getting from Norton (with my details removed.)
It is happening with IE9 but not with Chrome.

Category: Intrusion Prevention
Date & Time,Risk,Activity,Status,Recommended Action,IPS Alert Name,Default Action,Action Taken,Attacking Computer,Attacker URL,Destination Address,Source Address,Traffic Description
21/02/2013 12:37:43,High,An intrusion attempt by 64.237.61.69 was blocked.,Blocked,No Action Required,Web Attack: Malicious Image Request 2,No Action Required,No Action Required,"64.237.61.69, 80","ads.silverdisc.co.uk/www/delivery/lg.php?bannerid=1&campaignid=1&zoneid=1&OACBLOCK=86400&OACCAP=1000000&OASCCAP=1000000&loc=1&referer=http://www.theanswerbank.co.uk/AB-Editors-Blog/Question1218584.html&cb=ae479a1637
Network traffic from ads.silverdisc.co.uk/www/delivery/lg.php?bannerid=1&campaignid=1&zoneid=1&OACBLOCK=86400&OACCAP=1000000&OASCCAP=1000000&loc=1&referer=http://www.theanswerbank.co.uk/AB-Editors-Blog/Question1218584.html&cb=ae479a1637 matches the signature of a known attack. The attack was resulted from \DEVICE\HARDDISKVOLUME2\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE. To stop being notified for this type of traffic, in the Actions panel, click Stop Notifying Me.

[Sammy48]

Jonathan, I have the same problem. Everytime I click on Answerbank my computer security is saying the same.

[AB Editor]

"There is no one advertiser common to all occurences....."

But there may be a network with many advertisers who is common between all.

[AB Editor]

perseverer, thanks.