Trojan Horse

[dburg30]

well it's something in a file called swfobject.js in the /js directory of wdwinfo.com. I do figure that it's something that AVG changed to look for that is throwing the positive...

I would agree that there is about a 99.9 percent chance this is a false positive..
I'm going to send the file in question to AVG so they can take a look at it and fix their update if that's what happened..

 

[WebmasterAlex]

hello.
I have this virus as well. I use vista and have avg but avg does not heal it.

I picked this virus up somehere else *** I've never been on disboards before.

I googled "trojan downloader generic_c asx" to find some help and this is the only forum I could find with info on this virus. It must be very new. I got it last night (saturday 30th August 08)

It only happens when I log in to my internet explorer homepage. Doesn't seem to happen when I browse via mozilla firefox.

Any advice on removing it would be hugely appreciated.

Keith

Keithster, thanks for posting, it gives us some very useful information.
I don't believe you have a virus, what it looks like is that AVG is falsly identifying something as a virus that isn't.
I should point out that AVG is a pretty good program, this happens to all virus software once in a while.

 

[keithster]

Hi Alex,

Thanks. So my lap-tops not at risk then? I was concerned a hacker may be able to key log or access any sensitive info?

Keithster

 

[safetymom]

I am using AVG 8, Internet Explorer 7, Vista. I don't get the alert with Firefox.

 

[CarolA]

I just checked on my office machine which uses McAffee (YUCK!) No alert there!

 

[Tinks1984]

I'm on Vista using AVG too...it's happening on my main page DIS boards also...don't have much more info though, I'm not too good with the technical issues... Sorry!!

 

[Lewisc]

Same problem, also AVG.

 

[doconeill]

I'm not on my box that has AVG (TrendMicro here), but it could be caused by a false positive on one of the advertisements on the pages. When I get a chance I will check my AVG/XP box.

 

[lovetoscrap]

I just logged on and got the same thing. It is only on the Main Forum page and I also got it on the wdwinfo main page.

 

[jnemo]

I am also using AVG 8, Internet Explorer 7, Vista. This is the only place I am getting the message.

 

[CarolynU]

I use AVG and I've got it too. Any updates please?

 

[dburg30]

There probably wont be one til AVG 'fixes' whatever is throwing the positives. Unless of course they did change something here in the last couple of days, but I doubt that. I did send the file to AVG so they can investigate it.

 

[MUDisneyCouple]

Hoping to find the answer...we have been getting it too.

 

[Sandy Fisher]

We also have AVG and it happens when I use IE. We also have Firefox and I haven't tried that. Only comes up when I use my bookmark for the main page. I tried clicking on Heal and it still came up next time I came back to the site. I also said to put it in the vault. (yeh, right) and it showed up again the next time.
It's a little disconcerting..............

 

[dburg30]

It's because it's calling the same file everytime you goto the front page. It will do it every time the front page loads. There is a java script that runs on the front page (could have something to do with the news block) or soemthing that's only on the main page. It's a TEMPORARY file, so everytime it is loaded you'll get the error.


And firefox shouldnt give you the error..

 

[WebmasterAlex]

If you are having this problem try switching to the 'test2' style. Let me know if that helps

 

[HappyDznyCamper]

If you are having this problem try switching to the 'test2' style. Let me know if that helps

Ok, I just tried that and did not receive the trojan horse message.

BTW, I did get the message on firefox as well as IE7.
Changing to test2 seems to work

 

[WebmasterAlex]

Ok, that will help us narrow it down anyway

 

[HappyDznyCamper]

Ok, that will help us narrow it down anyway

Good luck figuring it out, and Thank You!

 

[WebmasterAlex]

Ok we believe we have found the code causing the issue and removed it! I'm going to turn off the test style, would everyone be kind enough to let me know if the issue is cleared up?
Thanks