Author Topic: WG WEBSITE INFECTED WITH JAVASCRIPT VIRUS (Read 10275 times)

rodekyll · « **on:** June 06, 2015, 02:18:33 PM »

My antivirus is going nuts on WG. Please be sure your protection is up to date.

Arizona Wayne · « **Reply #1 on:** June 06, 2015, 02:38:12 PM »

My antivirus(TrendMicro) removed something today but I don't know what it was.

Later my computer asked if I wanted to add a javascript and I said NO.

jackson · « **Reply #2 on:** June 06, 2015, 05:12:11 PM »

AVG just picked up three instances of HTML Framer on this site. Gave me the option of deleting which I did. I've never seen this particular virus on any site. Not sure if it's a real virus or some coding for the new site. Maybe Luap will jump in an clarify.

Yeahoo Whoyah · « **Reply #3 on:** June 06, 2015, 05:24:03 PM »

Will this crud goof up my iPad ?

jackson · « **Reply #4 on:** June 06, 2015, 05:28:16 PM »

HTML/Framer is the name given by your antivirus vendor to any html or javascript code which looks suspicious enough to have been produced and injected by malware, a virus or a trojan horse. The reasons of why this is being detected in your computer can be several and different solutions exist to get rid of this problem.
(From this page): http://www.htmlframer.com/

fotoguzzi · « **Reply #5 on:** June 06, 2015, 06:19:33 PM »

forum here was a little funky so I refreshed Firefox and tho still slow seems good.

balvenie · « **Reply #6 on:** June 06, 2015, 06:35:32 PM »

FWIW
While connecting to WG this am, Symantec flashed a couple of notices on my screen but they faded before I could read them, for all the good it would have done my Luddite brain.

HDGoose · « **Reply #7 on:** June 06, 2015, 06:37:52 PM »

My Linux machine didn't notice...

kern16 · « **Reply #8 on:** June 06, 2015, 06:44:06 PM »

Quote from: Yeahoo Whoyah on June 06, 2015, 05:24:03 PM

Will this crud goof up my iPad ?

MAC products are not near as likely to be infected. I've always reasoned that the %$#@!&^ who have nothing better to do then send this crap out must figure there are ALOT more PC's than MAC's........makes sense to me?

rbm · « **Reply #9 on:** June 06, 2015, 06:56:34 PM »

Performance at the moment is terrible (20:00 EST). While my PC nor Mac has identified a Javascript malware, I did notice an innocuous Russian URL being referenced while reading messages:

Referencing this site while loading PMs can't be intentioned by Luap. Possible hack??

rodekyll · « **Reply #10 on:** June 06, 2015, 07:07:16 PM »

Just checking in to see if it's fixed yet. It's not. The proper response is to not access WG for a while. I get three intercepts in PM and two every time I touch something in the forum. Java is an equal opportunity scripter. It works on mac or ibm ambidextrously. Although the simplistic mac os has fewer places for a virus to hide, it's not worth the risk to me.

be back later.

cruzziguzzi · « **Reply #11 on:** June 06, 2015, 08:39:10 PM »

Is the problem JAVA as a "plug in" or JAVA script as relates to web content?

As it happens, I have both turned off and the site is still functioning though this is counter to my usual experience. While the JAVA plug in has been off for quite some time, other than this site, having JAVA script disabled has limited sign ins, text and the like. Here, this does not seem to be the case as even with both disabled the site functions.

'Course, I may literally not know what I'm missing too.

Todd.

Matt Story · « **Reply #12 on:** June 06, 2015, 10:51:48 PM »

Microsoft Security Essentials has been picking up Trojan:JS/Redirect.NL all day long on my PC. Haven't been able to tell where from. Most likely this is the same infection and I'm getting it from here?

frizzit · « **Reply #13 on:** June 07, 2015, 01:41:59 AM »

I'm getting a virus warning from Avast as well JS:Includer-AUF [Trj]

Dean Rose · « **Reply #14 on:** June 07, 2015, 01:52:43 AM »

Quote from: Goose on June 06, 2015, 06:37:52 PM

My Linux machine didn't notice...

:1:

Dean

pauldaytona · « **Reply #15 on:** June 07, 2015, 03:25:54 AM »

when I look at the page source, I find at the top:

Quote

href="http://elitstom-nn.ru/feed/

elitstom is a russian dentist when you goto the site, so might be hacked too.

Luap please get it out, I'm glad to help, I'm webmaster too.

rodekyll · « **Reply #16 on:** June 07, 2015, 03:45:10 AM »

Quote from: Goose on June 06, 2015, 06:37:52 PM

My Linux machine didn't notice...

WG lives on a unix server.

pauldaytona · « **Reply #17 on:** June 07, 2015, 04:32:19 AM »

Quote

My Linux machine didn't notice...

No it hasn't an real antivirusprogram that notice it.
Javascript works on every OS. Javascript has nothing to do with Java. It is a script language that makes up most of the web pages.
And I have the idea thet it doesn't come on every page reload.

pauldaytona · « **Reply #18 on:** June 07, 2015, 09:42:56 AM »

virus is into:
http://wildguzzi.com/forum/Themes/default/scripts/script.js,qfin20+theme.js,qfin20.pagespeed.jc.121IVEwH2u.js

Luap McKeever · « **Reply #19 on:** June 07, 2015, 04:49:56 PM »

Should be okay now...

rodekyll · « **Reply #20 on:** June 07, 2015, 05:33:33 PM »

Thanks, luap. :)

Arizona Wayne · « **Reply #21 on:** June 07, 2015, 07:11:49 PM »

Quote from: Luap McKeever on June 07, 2015, 04:49:56 PM

Should be okay now...

I just came back to Wildguzzi a few minutes ago, went to 'stand by to flame me' article and my anitivirus informed me it just blocked threat (6483.bat) from getting into my computer.

Now 10 min. later my TrendMicro antivirus tells me a file has been removed from my computer (1BA2.tmp) because it's a threat. I'm staying off Wildguzzi for awhile again.

Luap McKeever · « **Reply #22 on:** June 07, 2015, 07:46:26 PM »

Quote from: Arizona Wayne on June 07, 2015, 07:11:49 PM

I just came back to Wildguzzi a few minutes ago, went to 'stand by to flame me' article and my anitivirus informed me it just blocked threat (6483.bat) from getting into my computer.

Now 10 min. later my TrendMicro antivirus tells me a file has been removed from my computer (1BA2.tmp) because it's a threat. I'm staying off Wildguzzi for awhile again.

All threats on the server have been removed. Not sure why you're getting that message.

jackson · « **Reply #23 on:** June 07, 2015, 07:53:13 PM »

I am no longer getting the warnings but the site takes an extraordinary amount of time to go to a page after you click on it.

Kiwi Dave · « **Reply #24 on:** June 08, 2015, 07:04:10 PM »

I am running Firefox with No Script add-on. All javascripts are disabled unless approved by me.

screamday · « **Reply #25 on:** June 08, 2015, 08:56:18 PM »

Quote from: Kiwi Dave on June 08, 2015, 07:04:10 PM

I am running Firefox with No Script add-on. All javascripts are disabled unless approved by me.

Same set up here.

News:

Author Topic: WG WEBSITE INFECTED WITH JAVASCRIPT VIRUS (Read 10275 times)