Virus?!

[kidsyndrome]

Is anyone else getting a virus notification when accessing these forums?

My computer's quarantined a bunch of files that were part of a "JS.Wonka" virus... apparently it runs through javascript or something...

I just figured I'd mention it in case anyone else was having the same issue.


(P.S: it's a trojan)

[Grephaun]

I’ve taken the liberty of moving this thread to a more correct sub-forum; hopefully one of the Admins will see it soon. I too am getting a virus notification from my Norman Antivirus program; it appears to be a Trojan of the type ‘JS/Exploit_based’. Norman has the following to say about this Trojan:

�This is a small piece of javascript code that is sometimes used to break through the security in Internet Explorer. Usually the code is used in connection with "planting" new default start pages, search bars, and favourites to your browser without you knowing about it.

The script does this using a bug in Internet Explorer, and it is the code to "use" this bug that we detect.

It is important to understand that while the script in most cases does not constitute more than an annoyance, it _may_ be used for more destructive actions.�

Will one of the Admins please have a look at this? Thank you.

~Greph.

[Blackhat]

The only thing I can think of is the PNG fix for IE No need to worry then!

<!--[if gte IE 5.5000]>
<script type="text/javascript" src="clientscript/vbulletin_pngfix.js"></script>
<![endif]-->

[Silver Wings]

My Virus attacker is also attacking a J.S Wonka virus.

I hope it wins, though I know nothing about computers.

[Blackhat]

http://vil.mcafeesecurity.com/vil/content/v_135834.htm

You can read more about your virus there

[LictorInTheGrass]

Umm... I got the same hit as well, is anything going to be done about this?

[spongebob]

Same its picking up in spyware doctor but not in nortons... we gotnthe latest edition and all the updates...

[Strava]

McAfee has been trapping the JS/Wonka Trojan and the Downloader-SG trojan every time I have connected to LO for the past 2 days.

My McAfee is set to auto-update every 7 days.
So it's current.

Thanks for the link BlackHat.
My read of that McAfee report is that JS/Wonka IS a real trojan.
And that reports of false hits were, in fact, real hits of the trojan.

I am going to have McAffe check for the lastest updates
And if this continues I would guess that LO has a real problem.

[EDIT]
OK, just had McAfee check for updates. And it says I am current.
McAfee reports that the NEWS[1].HTML is infected with the JS/WONKA Trojan
and
OPEN[1].EXE is infected with the Downloader-SG Trojan.

Hope this info helps...

[Vindkall]

The only thing I can think of is the PNG fix for IE No need to worry then!

Actually, the JS/Wonka virus is to be worried about, it hasn't been destructive yet, but, there are a possiblity that the LO frontpage has been compromised and had this code added, but it could also be any add links on the frontpage that's causing it.

I found this link and this link

I forgot to mention, no, your not safe because you use Firefox or any other non IE browser.

[Ezekiel1990]

I have an Apple, so no worries here.

For windows users, I would suggest disabling javascript unless you want to add rep, because turning it off doesn't stop you from doing much.