Welcome to forums, please register on the red button below

Go Back   Librarium Online > Librarium Online > Site Feedback & Support
New! Use your Facebook, Google, AIM & Yahoo accounts to securely log into this site, click logo to login  
Register Blogs FAQ Calendar Mark Forums Read

Notices

Site Feedback & Support Have a good idea or just want to show your happiness for finding Librarium Online, do it all here.

Reply
 
LinkBack Thread Tools Display Modes
Old December 19th, 2005, 16:28   #1 (permalink)
Member
 
kidsyndrome's Avatar
 
Join Date: Oct 2005
Age: 27
Posts: 189
Thanks: 0
Thanked 0 Times in 0 Posts
Rep Power: 51
kidsyndrome is riding on a pony to the stars
Lego Virus?!

Is anyone else getting a virus notification when accessing these forums?

My computer's quarantined a bunch of files that were part of a "JS.Wonka" virus... apparently it runs through javascript or something...

I just figured I'd mention it in case anyone else was having the same issue.


(P.S: it's a trojan)


kidsyndrome is offline   Reply With Quote

Join the #1 Tabletop Gamer Forum Today - Its totally free!

Librarium Online - the forum for all your tabletop gaming needs. Librarium Online offers a wide variety of categories, all from choosing your army to building scenery for gameplay. With over 500 new members every month you can be sure that your questions will be answered. Get help from friendly experts around the world and share your work with us in the gallery or in your personal blog!

Sign Up Now!

 
Old December 19th, 2005, 16:47   #2 (permalink)
Senior Member
 
Join Date: Mar 2005
Location: Copenhagen, Denmark.
Age: 25
Posts: 914
Thanks: 0
Thanked 0 Times in 0 Posts
Rep Power: 79
Grephaun has a reputation beyond reputeGrephaun has a reputation beyond reputeGrephaun has a reputation beyond reputeGrephaun has a reputation beyond reputeGrephaun has a reputation beyond reputeGrephaun has a reputation beyond reputeGrephaun has a reputation beyond reputeGrephaun has a reputation beyond reputeGrephaun has a reputation beyond reputeGrephaun has a reputation beyond reputeGrephaun has a reputation beyond repute
Default

I’ve taken the liberty of moving this thread to a more correct sub-forum; hopefully one of the Admins will see it soon. I too am getting a virus notification from my Norman Antivirus program; it appears to be a Trojan of the type ‘JS/Exploit_based’. Norman has the following to say about this Trojan:

�This is a small piece of javascript code that is sometimes used to break through the security in Internet Explorer. Usually the code is used in connection with "planting" new default start pages, search bars, and favourites to your browser without you knowing about it.

The script does this using a bug in Internet Explorer, and it is the code to "use" this bug that we detect.

It is important to understand that while the script in most cases does not constitute more than an annoyance, it _may_ be used for more destructive actions.�


Will one of the Admins please have a look at this? Thank you.

~Greph.
__________________
"Girls are nice and cuddly on the outside, and freaky on the inside." ~ Lost Nemesis.

Grephaun is offline   Reply With Quote
Old December 19th, 2005, 17:13   #3 (permalink)
The Landlord
 
Blackhat's Avatar
 
Join Date: Aug 2002
Location: Norway
Age: 32
Posts: 4,536
Blog Entries: 14
Thanks: 11
Thanked 20 Times in 3 Posts
Rep Power: 131
Blackhat Zeus himself seeks your guidance.Blackhat Zeus himself seeks your guidance.Blackhat Zeus himself seeks your guidance.Blackhat Zeus himself seeks your guidance.Blackhat Zeus himself seeks your guidance.Blackhat Zeus himself seeks your guidance.Blackhat Zeus himself seeks your guidance.Blackhat Zeus himself seeks your guidance.Blackhat Zeus himself seeks your guidance.Blackhat Zeus himself seeks your guidance.Blackhat Zeus himself seeks your guidance.
Annual LO Award 
Total Awards: 1
Default

The only thing I can think of is the PNG fix for IE No need to worry then!

<!--[if gte IE 5.5000]>
<script type="text/javascript" src="clientscript/vbulletin_pngfix.js"></script>
<![endif]-->
Blackhat is offline   Reply With Quote
Old December 19th, 2005, 18:53   #4 (permalink)
Son of LO
 
Silver Wings's Avatar
 
Join Date: Oct 2004
Location: England.
Age: 21
Posts: 2,112
Thanks: 0
Thanked 0 Times in 0 Posts
Rep Power: 73
Silver Wings has got DCCL (or is three quarters of a way to being grand)Silver Wings has got DCCL (or is three quarters of a way to being grand)Silver Wings has got DCCL (or is three quarters of a way to being grand)Silver Wings has got DCCL (or is three quarters of a way to being grand)Silver Wings has got DCCL (or is three quarters of a way to being grand)Silver Wings has got DCCL (or is three quarters of a way to being grand)Silver Wings has got DCCL (or is three quarters of a way to being grand)
Default

My Virus attacker is also attacking a J.S Wonka virus.

I hope it wins, though I know nothing about computers.
__________________
Every time you read this sig: a fairie dies!
Silver Wings is offline   Reply With Quote
Old December 19th, 2005, 19:05   #5 (permalink)
The Landlord
 
Blackhat's Avatar
 
Join Date: Aug 2002
Location: Norway
Age: 32
Posts: 4,536
Blog Entries: 14
Thanks: 11
Thanked 20 Times in 3 Posts
Rep Power: 131
Blackhat Zeus himself seeks your guidance.Blackhat Zeus himself seeks your guidance.Blackhat Zeus himself seeks your guidance.Blackhat Zeus himself seeks your guidance.Blackhat Zeus himself seeks your guidance.Blackhat Zeus himself seeks your guidance.Blackhat Zeus himself seeks your guidance.Blackhat Zeus himself seeks your guidance.Blackhat Zeus himself seeks your guidance.Blackhat Zeus himself seeks your guidance.Blackhat Zeus himself seeks your guidance.
Annual LO Award 
Total Awards: 1
Default

http://vil.mcafeesecurity.com/vil/content/v_135834.htm

You can read more about your virus there
Blackhat is offline   Reply With Quote
Old December 19th, 2005, 23:12   #6 (permalink)
Pwned by Phobos.
 
LictorInTheGrass's Avatar
 
Join Date: Oct 2005
Location: Middle of No Where
Age: 24
Posts: 1,338
Thanks: 0
Thanked 0 Times in 0 Posts
Rep Power: 0
LictorInTheGrass is not welcome in these parts
Default

Umm... I got the same hit as well, is anything going to be done about this?
LictorInTheGrass is offline   Reply With Quote
Old December 19th, 2005, 23:37   #7 (permalink)
Senior Member
 
Join Date: Mar 2004
Location: Brisbane, Aus
Posts: 294
Thanks: 0
Thanked 0 Times in 0 Posts
Rep Power: 70
spongebob is starting to score
Default

Same its picking up in spyware doctor but not in nortons... we gotnthe latest edition and all the updates...
__________________
Your Signature:
spongebob is offline   Reply With Quote
Old December 20th, 2005, 00:14   #8 (permalink)
Member
 
Strava's Avatar
 
Join Date: Nov 2005
Age: 57
Posts: 82
Thanks: 0
Thanked 0 Times in 0 Posts
Rep Power: 49
Strava has found the secret of life, the universe and everything
Default

McAfee has been trapping the JS/Wonka Trojan and the Downloader-SG trojan every time I have connected to LO for the past 2 days.

My McAfee is set to auto-update every 7 days.
So it's current.

Thanks for the link BlackHat.
My read of that McAfee report is that JS/Wonka IS a real trojan.
And that reports of false hits were, in fact, real hits of the trojan.

I am going to have McAffe check for the lastest updates
And if this continues I would guess that LO has a real problem.

[EDIT]
OK, just had McAfee check for updates. And it says I am current.
McAfee reports that the NEWS[1].HTML is infected with the JS/WONKA Trojan
and
OPEN[1].EXE is infected with the Downloader-SG Trojan.

Hope this info helps...
__________________
Fear the Wolf !!

Last edited by Strava; December 20th, 2005 at 00:21.
Strava is offline   Reply With Quote
Old December 20th, 2005, 01:47   #9 (permalink)
Senior Member
 
Vindkall's Avatar
 
Join Date: Jan 2003
Location: Karlskrona (Sweden)
Age: 25
Posts: 779
Thanks: 0
Thanked 0 Times in 0 Posts
Rep Power: 86
Vindkall is nothing like as gross as beforeVindkall is nothing like as gross as before
Default

Quote:
Originally Posted by Blackhat
The only thing I can think of is the PNG fix for IE No need to worry then!
Actually, the JS/Wonka virus is to be worried about, it hasn't been destructive yet, but, there are a possiblity that the LO frontpage has been compromised and had this code added, but it could also be any add links on the frontpage that's causing it.

I found this link and this link

I forgot to mention, no, your not safe because you use Firefox or any other non IE browser.
__________________
"As I walk through the valley of LO I fear no spammer, because I got the power to ban"



Of Trui and Gay

A Chaos Space Marines Diary

Svenska Rackham Sidan

troopseses!

Last edited by Blackhat; December 20th, 2005 at 16:58.
Vindkall is offline   Reply With Quote
Old December 20th, 2005, 01:48   #10 (permalink)
LO Zealot
 
Ezekiel1990's Avatar
 
Join Date: Dec 2004
Location: CT, USA
Age: 19
Posts: 1,600
Thanks: 0
Thanked 0 Times in 0 Posts
Rep Power: 69
Ezekiel1990 has got six and seven beckons...Ezekiel1990 has got six and seven beckons...Ezekiel1990 has got six and seven beckons...Ezekiel1990 has got six and seven beckons...Ezekiel1990 has got six and seven beckons...Ezekiel1990 has got six and seven beckons...
Default

I have an Apple, so no worries here.

For windows users, I would suggest disabling javascript unless you want to add rep, because turning it off doesn't stop you from doing much.
__________________
Ezekiel1990 is offline   Reply With Quote
Reply

Similar Threads
Thread Thread Starter Forum Replies Last Post
Hit By Something, Msn Virus Archaon PC Support 9 July 13th, 2005 01:19
Virus Attack Hard A** General Discussions 10 June 8th, 2004 12:02
Virus Leprechaun_of_War Site Feedback & Support 6 May 8th, 2004 03:57
Virus Warning MasterBelial General Announcement 0 April 9th, 2003 23:37


Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT +1. The time now is 14:35.

Array [contact_us] - Librarium Online - Archive - Top
Warvault Webring

Join The Librarium Online Banner Exchange