ATTACKED IP: from Google on TP: Website Operations Howto  -- Tractorpoint Site Discussion Forum and Review ATTACKED IP: from Google on TP: Website Operations Howto -- Tractorpoint Site Discussion Forum

  parts   |   manuals   |   discussion   |   photos   |   podcast   |   reviews   |   specs   |   dealers   |   classifieds   |   contact   |   faq   |   myProfile   |   home          Login Now | Sign Up


FAQ:   What is a tractor?

Forum Index
New As Posted | Active Subjects



www.emerichsales.com - New & Used Equipment
          View Tractors For Sale!


www.partsbynet.com - Lawn and Garden Equipment Parts


Bernardsville Landscape Lighting
Click to Post a New Message!

Discussion Boards > Active Subjects > Messages as Posted > Website Operations Howto Forum

Page [ 1 ] | 2 | 3 | | Next >>
Reply | Pop Up Window Reply | Add PhotoAdd Photo
 03-17-2005, 03:48 Post: 108159
harvey



View my Photos

View my Photos  Pics
Join Date: Sep 2000
Location: Moravia, NY
TractorPoint Premium Member -- 5 Tractors = Very Frequent Poster
Posts: 1525

7
Filter by User
 ATTACKED IP: from Google on TP

Dennis or others, My intrusion software just started getting hit, the past 2 days, from:

pagead2.googlesyndication.com(64.233.167.99) (http80).

Is anyone else seeing this?

I also show its an attack by a computer on my network. I'm not networked, yet. With the conflicting info I am reluctant to disable the warning. I get warned everytime I click on a topic or move to and from previous it the topic section. I am not to concerned about a maliasious attack from TP but with the stuff happening I try to be very careful.

Is google just trying to see what I read or have you (Dennis) installed a new monitoring system?

TIA Harvey

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Tractorpoint Operator Note:

Please DO NOT go out and install Symantec Internet Security 2005. Based on this report I made the fatal misstake of installing it on one of my backup machines that was working GREAT before the install. I am very &*%^*^(*^&&*^&* off at this point for doing what I intrinsically believed to be a misstake.

I was just trying to replicate Harvey's issue now I have problems. I noticed during the install of the &^*&^*&^ SW that it was going in too many areas for my liking.

Now I am paying the price losing alot of valuable data and time for *&*(&(*&*( darn it! Looks like I wil be foreced to rebuild the machine. BEWARE!!!!!!!

Dennis






Reply to PostReply | Quote Post Reply to PostQuote Reply | Add PhotoAdd Photo




Bookmarks: Digg It | Del.icio.us | Technorati | Furl | Stumble This

 03-17-2005, 08:05 Post: 108162
DennisCTB

TP Contributor

View my Photos

View my Photos  Pics
Join Date: Nov 1998
Location: NorthWest NJ
TractorPoint Premium Member -- 5 Tractors = Very Frequent Poster
Posts: 2544

6
Filter by User
 ATTACKED IP: from Google on TP

Harvey I noticed a huge spike in site hits that I was investigating yesterday, hopefully just seasonal increase in volume. Can you send me a PM on this and info on the SW you are using, I need to track this down.

Update 3/20/2005:

I checked my log files and I do not see any iregularities.

Dennis






Reply to PostReply | Quote Post Reply to PostQuote Reply | Add PhotoAdd Photo




Bookmarks: Digg It | Del.icio.us | Technorati | Furl | Stumble This

 03-18-2005, 04:05 Post: 108204
harvey



View my Photos

View my Photos  Pics
Join Date: Sep 2000
Location: Moravia, NY
TractorPoint Premium Member -- 5 Tractors = Very Frequent Poster
Posts: 1525

7
Filter by User
 ATTACKED IP: from Google on TP

Dennis I'm using Norton Internet Security, It updates daily.

The Security alert shows:

Intrusion: HTTP_ActivePerl_Overflow
Intruder: 0.0.0.0(3316)
Risk Level: Medium
Protocol: TCP.
Attacked IP: pagead2.googlesyndication.com(64.233.16...
Attacked Port:http(80)

I have looked at the secenarios and this could be a networked pc, but I do not have one. so it may be a computer trying to spoof the address.

Hell I don't know. I do wear glasses but I do not have a pocket protector yet! ;-0

The biggest RED FLAG is the address with part of a IP address.

I can call you or try to do this e-mail. You have my E-mail address.

Thanks Dennis






Reply to PostReply | Quote Post Reply to PostQuote Reply | Add PhotoAdd Photo




Bookmarks: Digg It | Del.icio.us | Technorati | Furl | Stumble This

 03-18-2005, 04:10 Post: 108205
harvey



View my Photos

View my Photos  Pics
Join Date: Sep 2000
Location: Moravia, NY
TractorPoint Premium Member -- 5 Tractors = Very Frequent Poster
Posts: 1525

7
Filter by User
 ATTACKED IP: from Google on TP


Dennis more of the info...













1995-2005 Symantec Corporation.
All rights reserved.
Legal Notices
Privacy Policy


HTTP_ActivePerl_Overflow
Severity: Medium

This attack could pose a moderate security threat. It does not require immediate action.

Attack Category: Suspicious Activity

Anomalous network conditions or traffic patterns. A suspicious activity signature, for example, might detect two systems with identical IP addresses, a condition that indicates an attempted IP spoofing attack.

Description

Older versions of ActivePerl on Windows have a buffer overflow vulnerability. An attacker can exploit this vulnerability to execute arbitrary code at the privilege level of the Web server process. This signature detects attempts to exploit the ActivePerl vulnerability through HTTP.

Links

CAN-2001-0815

BID 3526

Vulnerable Components

Activestate ActivePerl Version 5.6.1.629 and earlier on Windows

False Positive

This signature may not indicate malicious intent if ActivePerl versions other than those listed above are used or ActivePerl is not used at all. In this case, you can exclude this signature from monitoring.









Reply to PostReply | Quote Post Reply to PostQuote Reply | Add PhotoAdd Photo




Bookmarks: Digg It | Del.icio.us | Technorati | Furl | Stumble This

 03-19-2005, 21:18 Post: 108343
denwood



Join Date: Jul 2004
Location: Quarryville PA
TractorPoint Premium Member -- 5 Tractors = Very Frequent Poster
Posts: 542
 ATTACKED IP: from Google on TP

I got the same warnings today at work where our computer is better protected than at home. It was very annoying because it happened at least 5 times in 10 minutes. My home computer doen't have the same protection so I don't know if it is happening here.






Reply to PostReply | Quote Post Reply to PostQuote Reply | Add PhotoAdd Photo




Bookmarks: Digg It | Del.icio.us | Technorati | Furl | Stumble This

 03-19-2005, 22:01 Post: 108345
ksmmoto



View my Photos

View my Photos  Pics
Join Date: Jan 2004
Location: Central Lower Michigan
TractorPoint Premium Member -- 5 Tractors = Very Frequent Poster
Posts: 41

4
Filter by User
 ATTACKED IP: from Google on TP

I got the same warnings above ActivePearl from my Norton Internet Security. Always between 10:30 pm and 12:30 am every night since Tuesday. Nothing yet tonight however. This is the time I have been on Tractor Point.

The Internet was very slow on 3/17/05, maybe going around. My Norton gave a warning that it updated for Immediate Threats.

ksmmoto






Reply to PostReply | Quote Post Reply to PostQuote Reply | Add PhotoAdd Photo




Bookmarks: Digg It | Del.icio.us | Technorati | Furl | Stumble This

 03-19-2005, 22:56 Post: 108347
ksmmoto



View my Photos

View my Photos  Pics
Join Date: Jan 2004
Location: Central Lower Michigan
TractorPoint Premium Member -- 5 Tractors = Very Frequent Poster
Posts: 41

4
Filter by User
 ATTACKED IP: from Google on TP

I just got hit! At 11:03 pm and 11:53 pm. I always get hit twice and then no more. I was on this site and others during that time.

ksmmoto






Reply to PostReply | Quote Post Reply to PostQuote Reply | Add PhotoAdd Photo




Bookmarks: Digg It | Del.icio.us | Technorati | Furl | Stumble This

 03-19-2005, 22:59 Post: 108348
ksmmoto



View my Photos

View my Photos  Pics
Join Date: Jan 2004
Location: Central Lower Michigan
TractorPoint Premium Member -- 5 Tractors = Very Frequent Poster
Posts: 41

4
Filter by User
 ATTACKED IP: from Google on TP

Change my last post! Just got a third hit. I am done for a while tonight on Tractor Point, but will be online. I will come back lator and report if I get hit when I am not on TP.

ksmmoto






Reply to PostReply | Quote Post Reply to PostQuote Reply | Add PhotoAdd Photo




Bookmarks: Digg It | Del.icio.us | Technorati | Furl | Stumble This

 03-20-2005, 04:17 Post: 108352
harvey



View my Photos

View my Photos  Pics
Join Date: Sep 2000
Location: Moravia, NY
TractorPoint Premium Member -- 5 Tractors = Very Frequent Poster
Posts: 1525

7
Filter by User
 ATTACKED IP: from Google on TP

The best that I can come up with is: Google at IP 64.233.167.99 is trying to follow any and all posts we view and or their ad links.

It is frustrating that they are this persistant however I am goin to keep them blocked.

3/16/200 was their first atempt at comming in the backdoor and they have been at it since on this site.

My software is set fairly secure so there are quite a few web sites that will not allow my visit.

Only very trusted sites will I allow cookies and or their backdooring into my PC. Currently I have 242 addresses that are allowed in the backdoor most of those are multipule pages from the same web.Maybe I need to spend some time today reviewing them...

I trust TP (Dennis) but I do not trust Google (backdooring me) even if they do have the best search engine.






Reply to PostReply | Quote Post Reply to PostQuote Reply | Add PhotoAdd Photo




Bookmarks: Digg It | Del.icio.us | Technorati | Furl | Stumble This

 03-20-2005, 08:15 Post: 108357
DennisCTB

TP Contributor

View my Photos

View my Photos  Pics
Join Date: Nov 1998
Location: NorthWest NJ
TractorPoint Premium Member -- 5 Tractors = Very Frequent Poster
Posts: 2544

6
Filter by User
 ATTACKED IP: from Google on TP

I have an request into google on this, and I am waiting for a reply.

Here is my theroy on this, which is just conjecture at this point. The Google ads I have are what are called context sensitive ads. I think that these are not attacks on your desktops at all, rather what Google does in their script is try to review the TP page content before serving the context sensitive ads. Unfortunately all of the pages on Tractorpoint are dynamic content, there are almost no static content pages on the site. Therefore Google has to scan the pages each time. Now if you have some extremely sensitive SW on your PC you may be picking this up.

On my machine I have Norton with the latest virus files. And I do not see anything when I browse the site.

I will get back to you when I hear from Google, also to be able to analyze this more I will need some more info about any free SW you are using so that I can attempt to replicate the problem myself.

Dennis






Reply to PostReply | Quote Post Reply to PostQuote Reply | Add PhotoAdd Photo




Bookmarks: Digg It | Del.icio.us | Technorati | Furl | Stumble This

Reply | Pop Up Window Reply | Add PhotoAdd Photo


Page [ 1 ] | 2 | 3 | | Next >>

Discussion Boards > Active Subjects > Messages as Posted > Website Operations Howto Forum

Thread 108159 Filter by Poster:
bvance 2 | Casco1 1 | Chief 1 | DennisCTB 6 | denwood 1 | harvey 7 | ksmmoto 4 | kwschumm 4 |




Most Viewed

+ TP members coming and going
+ Any suggestions?
+ Registering on Tractorpoint
+ What Display Resolution Does your PC have?
+ Tractorpoint Site Improvement Survey
+ Oversea's Reply to Buy My Tractor- Suspicious?
+ Tractorpoint on Smart Phones
+ Slow Response Time for Tractor Point
+ Anybody else not getting updated message posts?
+ Ruger 357 Maximum

Most Discussion

+ TP members coming and going
+ Ruger 357 Maximum
+ Lights ! POWERR ! AC-!!
+ Big Bore Lever Actions
+ Looking a lot like Christmas
+ Anybody else not getting updat
+ Registering on Tractorpoint
+ Slow Response Time for Tractor
+ Tractorpoint Site Improvement
+ Site Suggestion Box

Newest Topics

+ Something I really like and something I don t
+ Equipment Manuals Now Available
+ How are Ads displayed on Tractorpoint
+ Twitter Tractorpoint
+ Subscription and Alert Changes
+ Tractorpoint Page Load Speed
+ Spam Private Mail Attack
+ Avatar?
+ Do you use Twitter Facebook Linkedin Stumbleupon
+ New Forum Subscription Capability













Turbochargers for Tractors and Industrial Machines
Cab Glass for Tractors and Industrial Machines

Alternators for Tractors and Industrial Machines
Radiators for Tractors and Industrial Machines

Driveline Components for Tractors and Industrial Machines
Starter Motors for Tractors and Industrial Machines