am I infected by a malicious website?

[CCMUA2009]

Yesterday a family member was on facebook. Somehow there was a pop up something about explorer needing to close. The family member being smart used task manager to close out.

However, another family member not so smart went into the history, and clicked on a history something like rysbabyc which took them to www. getsabout .com ( I spaced out the name here so nobody would accidentally click on it) The web page looked like an adobe reader format page, you know like when you open something

[CCMUA2009]

I was able to find out more about the site www. getsabout.com

on this link here

http://www.malwareurl.com/listing.php?domain=getsabout.com

it showed that

Domain name

getsabout.com

IP Address

213.108.56.18

Description

Exploit kit / Rogue Antivirus

registrant

Pat Casey / patcasey@xhotmail.net

so it looks like it was one of those fake antivirus things. But it never showed any thing to download and scans come up clean

[CCMUA2009]

sorry should have been more succinct

I guess bottom line, can I consider that I did not get infected? Since all scans came up clean?

[mountaintree16]

Most likely you're not infected if nothing was found in the scans and if Norton was blocking the infection.

As for Adobe Reader, do you have JavaScript turned off in it? I keep mine off now just as a security thing, since that's often given as a work-around solution until Adobe has patched whatever vulnerability is found. Currently 9.3 is the most recent version, so that's good that you're up to date. I've chosen to keep my JavaScript off though, as that seems to be how Reader gets exploited the majority of the time.

To make sure that that computer is not infected, you could visit the HijackThis - Malware Removal forum and read the "I'm infected - What do I do now" pinned topic in that forum. You've been on the forum a little while now, you should know where this is. If not, I can get you the links. As I am sure you know, it can sometimes take a while to get a reply (2 days or more at busy times).

[CCMUA2009]

thanks for the reply. When I say my Norton blocked it, I meant Did my Norton block it? Because there was nothing on the screen when I clicked that website. So I was wondering if that is why i saw nothing on the screen.

However, there was noting in my Norton logs to show any type of malicious activity.

So in short, wonderingt it nothing ever got a chance to hit me to start with?

[CCMUA2009]

a little more research shows this is a pdf exploit out of Russia

So the fact that the ADOBE Reader 9.3 showed nothing when I clicked the website, would it be a good conclusion to reach from that that the reader 9.3 did not allow the exploit?

[noknojon]

Hi CCMUA2009 -

If you want to be sure that you have a clean system then post your logs etc, in the HiJack This area -

Please read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance - This is the best way to ensure you are clean -

If you wish to, and the system is reasonably stable, then keep using it as you follow the experts instructions (unless told otherwise) -

Thank You -

[mountaintree16]

Oh, I see what you're saying, CCMUA2009. So you got no prompts from Norton asking if you wanted to block or stop something? And Malwarebytes scans came out clean?

Hmm. I am not quite sure if you could be infected. Are there any icons on your desktop or in the system tray to the lower right where the time is located that you do NOT recognize or that you did NOT put there?

Again, if you are unsure, please visit the Malware Removal - HiJackThis forum, as it is impossible for us to know based on what you are telling us if you are infected or not.

You may be infected, and you also very well may not be infected. It's hard to say.

[CCMUA2009]

Hi CCMUA2009 -

If you want to be sure that you have a clean system then post your logs etc, in the HiJack This area -

Please read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance - This is the best way to ensure you are clean -

If you wish to, and the system is reasonably stable, then keep using it as you follow the experts instructions (unless told otherwise) -

Thank You -

Would you say from what I have written that there is a very strong chance I'm NOT infected, given the various scans that come up clean?

[noknojon]

Would you say from what I have written that there is a very strong chance I'm NOT infected, given the various scans that come up clean?

Only If you are unsure Then do the HiJack Forum - This up to you - Are YOU 100% sure or is it worth getting it checked ??

The choice is yours -