Join the #1 Tabletop Gamer Forum Today - Its totally free!

kidsyndrome · December 19th, 2005, 16:28

Is anyone else getting a virus notification when accessing these forums?

My computer's quarantined a bunch of files that were part of a "JS.Wonka" virus... apparently it runs through javascript or something...

I just figured I'd mention it in case anyone else was having the same issue.

(P.S: it's a trojan)

Grephaun · December 19th, 2005, 16:47

Iâ€™ve taken the liberty of moving this thread to a more correct sub-forum; hopefully one of the Admins will see it soon. I too am getting a virus notification from my Norman Antivirus program; it appears to be a Trojan of the type â€˜JS/Exploit_basedâ€™. Norman has the following to say about this Trojan:

â€?This is a small piece of javascript code that is sometimes used to break through the security in Internet Explorer. Usually the code is used in connection with "planting" new default start pages, search bars, and favourites to your browser without you knowing about it.

The script does this using a bug in Internet Explorer, and it is the code to "use" this bug that we detect.

It is important to understand that while the script in most cases does not constitute more than an annoyance, it _may_ be used for more destructive actions.â€?

Will one of the Admins please have a look at this? Thank you.

~Greph.

Blackhat · December 19th, 2005, 17:13

The only thing I can think of is the PNG fix for IE

No need to worry then!

Silver Wings · December 19th, 2005, 18:53

My Virus attacker is also attacking a J.S Wonka virus.

I hope it wins, though I know nothing about computers.

Blackhat · December 19th, 2005, 19:05

http://vil.mcafeesecurity.com/vil/content/v_135834.htm

You can read more about your virus there

LictorInTheGrass · December 19th, 2005, 23:12

Umm... I got the same hit as well, is anything going to be done about this?

spongebob · December 19th, 2005, 23:37

Same its picking up in spyware doctor but not in nortons... we gotnthe latest edition and all the updates...

Strava · December 20th, 2005, 00:14

McAfee has been trapping the JS/Wonka Trojan and the Downloader-SG trojan every time I have connected to LO for the past 2 days.

My McAfee is set to auto-update every 7 days.
So it's current.

Thanks for the link BlackHat.
My read of that McAfee report is that JS/Wonka IS a real trojan.
And that reports of false hits were, in fact, real hits of the trojan.

I am going to have McAffe check for the lastest updates
And if this continues I would guess that LO has a real problem.

[EDIT]
OK, just had McAfee check for updates. And it says I am current.
McAfee reports that the NEWS[1].HTML is infected with the JS/WONKA Trojan
and
OPEN[1].EXE is infected with the Downloader-SG Trojan.

Hope this info helps...

Vindkall · December 20th, 2005, 01:47

Quote:

Originally Posted by Blackhat

The only thing I can think of is the PNG fix for IE

No need to worry then!

Actually, the JS/Wonka virus is to be worried about, it hasn't been destructive yet, but, there are a possiblity that the LO frontpage has been compromised and had this code added, but it could also be any add links on the frontpage that's causing it.

I found this link and this link

I forgot to mention, no, your not safe because you use Firefox or any other non IE browser.

Ezekiel1990 · December 20th, 2005, 01:48

I have an Apple, so no worries here.

For windows users, I would suggest disabling javascript unless you want to add rep, because turning it off doesn't stop you from doing much.

December 19th, 2005, 16:28	#1 (permalink)
kidsyndrome Member Join Date: Oct 2005 Age: 27 Posts: 189 Thanks: 0 Thanked 0 Times in 0 Posts Rep Power: 51	Virus?! <a onclick="pageTracker._trackPageview ('/outgoing/http_d1_openx_org_ck_php_n_a83f474f_amp_cb_46587945173');" rel='nofollow' href='http://d1.openx.org/ck.php?n=a83f474f&cb=46587945173' target='_blank'><img src='http://d1.openx.org/avw.php?zoneid=22572&cb=46587945173&n=a83f474f' border='0' alt='' /></a> Is anyone else getting a virus notification when accessing these forums? My computer's quarantined a bunch of files that were part of a "JS.Wonka" virus... apparently it runs through javascript or something... I just figured I'd mention it in case anyone else was having the same issue. (P.S: it's a trojan)

December 19th, 2005, 16:47	#2 (permalink)
Grephaun Senior Member Join Date: Mar 2005 Location: Copenhagen, Denmark. Age: 25 Posts: 914 Thanks: 0 Thanked 0 Times in 0 Posts Rep Power: 79	Iâ€™ve taken the liberty of moving this thread to a more correct sub-forum; hopefully one of the Admins will see it soon. I too am getting a virus notification from my Norman Antivirus program; it appears to be a Trojan of the type â€˜JS/Exploit_basedâ€™. Norman has the following to say about this Trojan: â€?This is a small piece of javascript code that is sometimes used to break through the security in Internet Explorer. Usually the code is used in connection with "planting" new default start pages, search bars, and favourites to your browser without you knowing about it. The script does this using a bug in Internet Explorer, and it is the code to "use" this bug that we detect. It is important to understand that while the script in most cases does not constitute more than an annoyance, it _may_ be used for more destructive actions.â€? Will one of the Admins please have a look at this? Thank you. ~Greph. __________________ "Girls are nice and cuddly on the outside, and freaky on the inside." ~ Lost Nemesis.

December 19th, 2005, 17:13	#3 (permalink)
Blackhat The Landlord Join Date: Aug 2002 Location: Norway Age: 32 Posts: 4,536 Blog Entries: 14 Thanks: 11 Thanked 20 Times in 3 Posts Rep Power: 131 Total Awards: 1	The only thing I can think of is the PNG fix for IE No need to worry then! <!--[if gte IE 5.5000]> <script type="text/javascript" src="clientscript/vbulletin_pngfix.js"></script> <![endif]--> __________________ Submit news to LO frontpage, click here

December 19th, 2005, 18:53	#4 (permalink)
Silver Wings Son of LO Join Date: Oct 2004 Location: England. Age: 21 Posts: 2,112 Thanks: 0 Thanked 0 Times in 0 Posts Rep Power: 73	My Virus attacker is also attacking a J.S Wonka virus. I hope it wins, though I know nothing about computers. __________________ Every time you read this sig: a fairie dies!

December 19th, 2005, 19:05	#5 (permalink)
Blackhat The Landlord Join Date: Aug 2002 Location: Norway Age: 32 Posts: 4,536 Blog Entries: 14 Thanks: 11 Thanked 20 Times in 3 Posts Rep Power: 131 Total Awards: 1	http://vil.mcafeesecurity.com/vil/content/v_135834.htm You can read more about your virus there __________________ Submit news to LO frontpage, click here

December 19th, 2005, 23:12	#6 (permalink)
LictorInTheGrass Pwned by Phobos. Join Date: Oct 2005 Location: Middle of No Where Age: 24 Posts: 1,338 Thanks: 0 Thanked 0 Times in 0 Posts Rep Power: 0	Umm... I got the same hit as well, is anything going to be done about this?

December 19th, 2005, 23:37	#7 (permalink)
spongebob Senior Member Join Date: Mar 2004 Location: Brisbane, Aus Posts: 294 Thanks: 0 Thanked 0 Times in 0 Posts Rep Power: 70	Same its picking up in spyware doctor but not in nortons... we gotnthe latest edition and all the updates... __________________ Your Signature:

December 20th, 2005, 00:14	#8 (permalink)
Strava Member Join Date: Nov 2005 Age: 57 Posts: 82 Thanks: 0 Thanked 0 Times in 0 Posts Rep Power: 49	McAfee has been trapping the JS/Wonka Trojan and the Downloader-SG trojan every time I have connected to LO for the past 2 days. My McAfee is set to auto-update every 7 days. So it's current. Thanks for the link BlackHat. My read of that McAfee report is that JS/Wonka IS a real trojan. And that reports of false hits were, in fact, real hits of the trojan. I am going to have McAffe check for the lastest updates And if this continues I would guess that LO has a real problem. [EDIT] OK, just had McAfee check for updates. And it says I am current. McAfee reports that the NEWS[1].HTML is infected with the JS/WONKA Trojan and OPEN[1].EXE is infected with the Downloader-SG Trojan. Hope this info helps... __________________ Fear the Wolf !! Last edited by Strava; December 20th, 2005 at 00:21.

December 20th, 2005, 01:48	#10 (permalink)
Ezekiel1990 LO Zealot Join Date: Dec 2004 Location: CT, USA Age: 19 Posts: 1,600 Thanks: 0 Thanked 0 Times in 0 Posts Rep Power: 69	I have an Apple, so no worries here. For windows users, I would suggest disabling javascript unless you want to add rep, because turning it off doesn't stop you from doing much. __________________

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Hit By Something, Msn Virus	Archaon	PC Support	9	July 13th, 2005 01:19
Virus Attack	Hard A**	General Discussions	10	June 8th, 2004 12:02
Virus	Leprechaun_of_War	Site Feedback & Support	6	May 8th, 2004 03:57
Virus Warning	MasterBelial	General Announcement	0	April 9th, 2003 23:37

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode