Jump to content
BC Boards

Norton virus alert warning???


Recommended Posts

Just in the last few days when I have logged into this web site I get a warning from my Norton antivirus telling me this site is now unsafe??? when I go to the details list for info it comes up with a long list of thubmnail attachments that contain a trojan virus???? is anyone else getting this??

Link to comment
Share on other sites

Guest echoica
Just in the last few days when I have logged into this web site I get a warning from my Norton antivirus telling me this site is now unsafe??? when I go to the details list for info it comes up with a long list of thubmnail attachments that contain a trojan virus???? is anyone else getting this??

 

i doubt it's the site as there are no ads here...and for them to be jpgs...nmph. sounds like you might already have a virus and it is running in the background. what browser are you using?...i am going to guess internet exlporer :rolleyes: (THE WORST browser ever for that sort of thing!)

Link to comment
Share on other sites

I've been getting the same thing from my Norton. The details list "trojans". However, I've corresponded with Heather and she assures me there is no problem with the site but that she thinks Norton may just be giving false positives. That's good enough for me, although it's frustrating. I've never had this happen before and it's only happening with www.bordercollie.org.

Link to comment
Share on other sites

I use firefox and I'm getting the same thing.

 

298 threats all coming from these thumbnail pictures

 

Viruses (what's this?)

 

Threats found: 298

Here is a sample:

Threat Name: Trojan.Malscript!html

Location: http://bordercollie.org/boards/uploads/thumbs/page1702.html

 

 

Threat Name: Trojan.Malscript!html

Location: http://bordercollie.org/boards/uploads/thumbs/page2034.html

 

 

Threat Name: Trojan.Malscript!html

Location: http://bordercollie.org/boards/uploads/thumbs/page1278.html

 

 

Threat Name: Trojan.Malscript!html

Location: http://bordercollie.org/boards/uploads/thumbs/page920.html

 

 

Threat Name: Trojan.Malscript!html

Location: http://bordercollie.org/boards/uploads/thumbs/page913.html

 

 

Threat Name: Trojan.Malscript!html

Location: http://bordercollie.org/boards/uploads/thumbs/page123.html

 

 

Threat Name: Trojan.Malscript!html

Location: http://bordercollie.org/boards/uploads/thumbs/page2535.html

 

 

Threat Name: Trojan.Malscript!html

Location: http://bordercollie.org/boards/uploads/thumbs/page282.html

 

 

Threat Name: Trojan.Malscript!html

Location: http://bordercollie.org/boards/uploads/thumbs/page1918.html

 

 

Threat Name: Trojan.Malscript!html

Location: http://bordercollie.org/boards/uploads/thumbs/page193.html

Link to comment
Share on other sites

I get the same thing with Norton. But I haven't had any problems and haven't gotten anything from this site. So I'm guessing its safe.

Link to comment
Share on other sites

I get the same thing with Norton. But I haven't had any problems and haven't gotten anything from this site. So I'm guessing its safe.

Which forum/topic/page gives this message? I don't get any infected pages browsing normally. The links referenced in the Norton report are infected, but I have no idea they related to the normal forum pages. Someone who gets these messages, please post what you did immediately before, so that Heather has a chance to find out what is happening.

Link to comment
Share on other sites

I remember my first virus.; Michaelangelo for the original PC. 1986. It was a boot sector virus. I was working as a part time electronics and computer instructor and another instructor and I wrote a killer for it.

Link to comment
Share on other sites

Heather, et al, the warning seems to show on every page on the BC Boards site in both Firefox and IE (at least those I've visited). See screenshots below. Sorry the last is a bit large, if I reduce the screenshot images in size, the text degrades in quality and can't be read.

 

See "Norton" and red warning "X" above browsing tab (this shows green with a checkmark on "safe" sites):

Boards.jpg

 

When the drop down arrow next to the warning X is clicked, the information message is as follows:

Norton.jpg

 

When "Full Report" is clicked, a new page is opened with a report from Symantec. At the bottom of this image you can see the beginning of the list previously pasted by Lokisaab.

Nortonthreatreport.jpg

 

Hope this is some help.

Link to comment
Share on other sites

Advanced Member

***

 

Joined: 28-February 09

Posts: 839

Location:

 

 

 

This is where being better than average with computers gets ya. biggrin.gif

 

This bad boy is a Clicker Type Trojan, usually found in email. It's not the Trojan that gets ya it's where you go when you click on it. This one wasn't too bad all it did was throw a lot of advertising at you. However clicking on one of the ads... Who knows? lots of evil things possible. So t'warn't all that bad. Some clicker Trojans can take you places that will dump a Java script to your computer and take over. The first thing you see is your anti-virus stops working. By then whatever data the ubiquitous they want they got. A similar Trojan is called a drive-by download. Just following the link is enough to open a page that dumps a file to your system which executes and does whatever the once again nefarious they ahve in mind

Link to comment
Share on other sites

None of this is wildly clear to me. Nobody but Megan seems to be reporting problems on every page in the site--I certainly don't have that problem, and I've checked on multiple computers, each with different virus programs. I gather that there is a thread with a link to a potentially low-risk infected site. I'm happy to take the thread down if someone could tell me *specifically* which thread contains the suspicious link. If not, we'll leave things alone. Thanks!

Link to comment
Share on other sites

None of this is wildly clear to me. Nobody but Megan seems to be reporting problems on every page in the site--I certainly don't have that problem, and I've checked on multiple computers, each with different virus programs. I gather that there is a thread with a link to a potentially low-risk infected site. I'm happy to take the thread down if someone could tell me *specifically* which thread contains the suspicious link. If not, we'll leave things alone. Thanks!

 

 

I am getting the same site unsafe as Megan, it still shows 298 threats on here now.

 

It comes up on all the forum sections i have been in, i haven't clicked around much though as i don't like having the site unsafe on as i don't know hardly anything about these virus things.

Link to comment
Share on other sites

You could be having false positives. I've seen that happen when internet security programs are set to high or tight. Check your security levels and return them to their defaults if not set there. Then clear your cookies and browser history and try again.

Link to comment
Share on other sites

There is obviously something going on; the links to "thumbnails" point to pages that are infected by a Javascript trojan and they are on the bordercollie.org site. I have checked very carefully with web tools that I use and I am absolutely sure that there are no references to any of the reported links when I browse the site. I am using Firefox on Linux. My board settings are plain vanilla.

Link to comment
Share on other sites

John would you PM me the links. I'm not getting any warnings at all and I have my security set pretty tight. I went through the thumbs and nothing. I may not be hitting the right ones or something in my security may be intercepting it without telling me.

Link to comment
Share on other sites

Don't feel bad Loki. John and I are dissecting this thing trying to find the problem. Not with much luck however. it turns out this is one nasty Trojan when you dig into it. It seems to have eaten or taken over the thumbnails reference page.

 

I shall say this after looking at in on another computer be careful. It can disable your anti virus, then it makes an attempt to hijack your browser and seems to dl script that could be a data miner. If you You hit one of those pages close your browesr. Reopen it. If it come ujp to your home page OK, if not your infected. Clear your cookies, caches and history then close and reopen your browser.

 

I do recommend you have a second browser so if one is infected you can open another. Recommend browsers are Firefox, Opera, Chrome and Safari. All available for PC, Mac and Linux.

 

@John HijackThis doesn't report anything out of the ordinary in memory running as a process

Link to comment
Share on other sites

You could be having false positives. I've seen that happen when internet security programs are set to high or tight. Check your security levels and return them to their defaults if not set there. Then clear your cookies and browser history and try again.

 

The history and cookies get cleared quite often on here so i think i am fine there, also our Norton has only just been renewed so i think it is still at the default settings.

 

I shall say this after looking at in on another computer be careful. It can disable your anti virus, then it makes an attempt to hijack your browser and seems to dl script that could be a data miner. If you You hit one of those pages close your browesr. Reopen it. If it come ujp to your home page OK, if not your infected. Clear your cookies, caches and history then close and reopen your browser.

 

I do recommend you have a second browser so if one is infected you can open another. Recommend browsers are Firefox, Opera, Chrome and Safari. All available for PC, Mac and Linux.

 

I am now on Firefox and still getting the same Norton warning as i do on IE, 298 threats.

 

I think i will stay off here again for a while until it is clear and safe again. I am scared to click on any other threads now except this one.

Link to comment
Share on other sites

Heather, I'd suggest speaking with the hosting company and have them scan the /uploads directory. It may not be something that can be dealt with remotely from the server.

 

FWIW, I don't get any warnings on this site unless I specifically click one of the links. If people are getting it consistently after the first time, I'd look at caching setup on the browser, perhaps they've cached the pages.

Deleting all temp internet files might help.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...