8

Spoke with our security guys, and apparently VBS/Virus.invadesys was being detected. Probably a bad virus signature, or maybe one of the ads.

3

1 Answer 1

9

I was seeing this earlier:

enter image description here

But only for the bare domain http://serverfault.com, everything else was working, including https://serverfault.com/questions, https://serverfault.com/users, etc. The "File Name:" portion would randomly change to "questions" "favicon.ico" and "" (blank) when refreshing.

The blocked page wasn't coming from our web filter, it doesn't do "Virus Download Blocked". Our "page blocked" messages are served from our LightSpeed's address. I ran wireshark to investigate the "Virus Download Blocked" content and the IP (sorry didn't save the cap) resolved to "stackoverflow.com".

Shortly after the "blocked" message disappeared [maybe 25 minutes of mashing crtl+shift+r repeatedly] http://serverfault.com would not load at all. This appeared to only affect logged in SE accounts. A coworker logged out of SE and was able to load the front page. I went off a did some Real Work, by the time I was done, the front page was loading as a logged in user.

Just for fun, I blame Bart. :)

1
  • That's the same page I was seeing, but I assumed it had to be a transparent proxy since our security guy did find something in the logs.
    – Andrew B
    Aug 13, 2013 at 23:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .