Kaspersky Internet Security detecting security risks in Groove

[Nigel Holleran]

Starting this morning, I have been seeing a constant stream of alerts from
Kaspersky, telling me that Microsoft Office Groove is attempting to load an
object containing malicious software, namely a link to a site called tv190.com

Is anyone else seeing this problem?

Hard to track down is it shows a link back to a relay server - mainly blugro8

My concern is to how widespread the problem is?

So far, I have one other colleague reporting the same thing.

 

[Gregg Johnston [MSFT]]

Nigel,

Can you give us the text of the alerts? Is it possible that someone is
sending an Instant Message with this URL in the message? Is Kaspersky giving
an more details? what is the full URL given for blugro8?

Gregg

 

[Robert]

Just to add this to the discussion, this issue with tv190.com is going on all
over the place, and there are an increasing number of threads discussing this
on the internet. I am also having a problem, with IE not allowing at least
one specific site I regularly use. For whatever it is worth, the problem is
not limited to the IE browser.

 

[Nigel Holleran]

Hi Gregg,

I'll send a log from Kaspersky direct to your Groove ID, as there were many
alerts
but there follows are a couple of lines from it:

(also - thanks for the heads up on tv190.com Robert)

Nigel

28/08/2009 10:55:29 Web Traffic Denied: *.tv190.com Microsoft Office
Groove http:///2.0/blugro8relay.groove.mic...5eyev8jhupid7qbrp23c3dr9js,ConnType=LongLived Databases
28/08/2009 10:55:31 Web Traffic Detected: *.tv190.com Microsoft Office
Groove http:///2.0/df-grv-rly01.ms-gms.mic...tfpaxeyy2tvy7msyas45j2y9fi,ConnType=LongLived Databases
28/08/20