Automaton Toys website has virus again???

[pandaprime]

I used my IE browser and it prompted to install something call snapview.ocx

Snapview.ocx and Security Advisory 955179

Windows (and therefore all other browsers) may be broken... but a browser saved my Assets today.
I went to a site where I wanted to buy some cleaning supplies. We had gotten floor cleaning supplies from this web site in the past and we needed to order more. So I went there and clicked on the Products page. At the top of the page suddenly an activeX control asked to be installed. It was a control called "Snapview.ocx". I didn't approve it and then all of a sudden IE whited out, indicated it was needing to close and it crashed and reopened an IE window.
Hmmmm that's a bit unusual.. what exactly is Snapview.ocx?
Well after a bit of googling and connecting the dots...
https://forums.symantec.com/syment/b...ge.id=165#M165
http://www.securityfocus.com/bid/30114
http://www.microsoft.com/technet/sec...ry/955179.mspx
I do have issue with a statement in this advisory..
In a Web-based attack scenario, an attacker could host a Web site that contains a Web page that is used to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability. An attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail or Instant Messenger message that takes users to the attacker's Web site.
An attacker doesn't have to send me an email or anything. All they have to do is infect the hosting location of a site that people WANT to go to and then that site will nail folks.
But be aware that a supposedly "clean" (yeah this was a cleaning supply web site) site was trying to nail me earlier today. Fortunately, that "broken Vista" protected me and the browser crash was the side effect.
Be careful out there....

got this from: http://msmvps.com/blogs/bradley/arch...ry-955179.aspx

[pulsedragon20]

just checked the site and my firewall and AV (Trend Micro) found a malware and would not let me load the page...unless i allow

[jourdo]

I was going to go shopping on Automaton... guess that may have to wait.

[Mighty_Galvatron]

Everything works fine for me using Chrome at the moment...but I'm gonna stop going to that site for a while until this is all sorted out.

[hugh_da_man]

Chrome complains and Adobe tries to open if I use IE. Virus again. This is annoying and TFSource will get my next big order (mainly because Automaton didn't even warn people last time. If you get a virus and multiple emails from your customers telling you there is a virus then either fix it or warn people but Automaton did neither). I'd worry about your purchase information with all the virus problems they seem to have.

OP, ditch Shaw Secure. Download Microsoft Security Essentials and start using Google Chrome.

[CyberMnky]

I just tried with IE and it worked no problems... so either is a selective thingy or Im screwed...

[Da_Blinks]

Shaw Secure is based on F-Secure. F-Secure is a good program but last time I used it was a memory hog and slowed my system to much.

hugh_da_man
OP, ditch Shaw Secure. Download Microsoft Security Essentials and start using Google Chrome.

I agreed with that. Security Essentials is one of the best AV programs atm.

[protoform_ironhide]

So I am not the only one. Yes, it really pisses me off. Automaton is a good online store, but then it really bugs me when it gets me virus all the time.... I worry whenever I go into the site now... I am not changing my virus protection program just because of a website. Thanks Pandaprime for your info.

[Echotransformer]

I visited Automaton yesterday with Internet Explorer and it tried to load something...some kind of DLL but I didn't recognize the name so I didn't let it load. So there may in fact be a virus.

I'm going to run a scan on my PC and let you know if I got infected...I'm hoping that by not letting the Malware run I'm OK.

I actually got a virus recently trying to download from Rapidshare, and the virus was SO BAD I couldn't even get to my task manager. It is called "Windows Security 2010" virus and it is NOTORIOUS.

I booted into safe modes and tried various methods to disinfect (including placing the HDD in a different PC and scanning the drive as a slave) and over the course of 5 days of scanning, deleting, rebooting etc. the hard drive FAILED!!!

Yes, the virus played a hand in destroying my hardware.

So here I am, $60 poorer, new HDD...fingers crossed.

I don't think this is the same virus but I just wanted to share the pain of surfing the web these days and the crappy browser and anti-virus products out there that have a million security holes!

--Echo

[AUTOMATON]

Hi everyone,

Time to make an official statement here, obviously.

We are now in the process of migrating AutomatonToys.com towards a new webhosting service on a new server: it's been some time that we have that ''virus'' problem, in and out, and all analysis are pointing towards our actual webhosting service, wich is totally unacceptable.

Just as all of you, I'm totally frustrated to see our website spoiled with that problem: our webmaster and our webhosting service have been playing ping-pong long enough, each of them putting the blame on the other; one says it could indeed be somekind of virus plaguing the website(via the webhosting service)...while the other pretends it may be some oddities in the script of the website.

So I had to make a business decision wich is, in this case, to move both our webhosting and webmastering towards new horizons.

By Friday, the transfer should be completed. By then, those problems should be solved once and for all. I will keep this thread updated with any fresh info about this issue and the transfer.

If you don't feel comfortable to visit Automaton until then(this friday), we totally understand. I wouldn't go as far as to officially recommend to avoid our website, but maybe it would be safer for now. We are in a very stressful situation and I'm doing the impossible to solve the issue in a timely manner.

Our deepest apologies for the trouble this issue may cause.

Best Regards,
Mario