[Squall-Leonhart]

Dax, click the more details link, it should tell you which portion of the script the infection is coming from.

 

[PCXL-Fan]

I don't have a virus scanner, but I presume my PC would be acting funky if I were infected. Right now I have ads unblocked due to some testing on my own site, perhaps Firefox and Windows 7 with UAC has saved my hide for now.

comeon xtreme, you know better then to presume that. We all know not all viruses hog the cpu cycles or cause noticeable weird behavior.

When I finally decided to allow access to the site earlier today I was infected 4 times with the iframe payload virus since noscript's iframe blocking wasn't enabled at the time. Dax was infected 3 times and he was using firefox + adblock(uptodate) + noscript(defaultsettings).

Iframe blocking has to be enabled.

 

[Xtreme2damax]

My apologies, seems this headache also has a side effect of causing my brain to malfunction. :lol:

 

[PCXL-Fan]

lol, lay off the diet coke man. Aspartame is known to causes memory problems. Here are my 4 infections.

Squall suggests using hostfile to block it.

 

[Cid Highwind]

Kaspersky also reports virii on every page for me. Any CG responses? >.>

Chrono has sent an email to Sanjay 4 hours ago. Right now we just have to wait for a reply. When I see something at the staff board I'll let you know right away, but otherwise you have to be patient for Chrono to dig into it. Seeing how it's nighttime in the States now, it'll take a few hours. I'm sorry guys, as an smod I can only be the messenger.

 

[Cid Highwind]

Also, I would like to ask what can be done as a workaround. I'm using the latest Firefox, with Adblock Plus (Easylist Germany (Deutschland) + EasyList) and have found no problems or alarms. Therefore I would suggest you to do the same until a solution has been found. I'd like to get feedback from others as well if this is the solution. If this is the case I can see if I can make a global announcement, given the scale of the issue.

 

[gamefreak94]

I haven't experience any problems or warning messages either.

 

[jonc2006]

same here, and all ive got is a pop-up blocker.

 

[46480]

Man I just reinstalled windows 7 (not because of this), but I came to the forums without adblock and noscript first.

I blocked Iframe from noscript, but how do I know I if got infected from it.

I'm only running MS Security Essentials atm.

 

[Lex_Light]

I have Nod32 4, and he doesn't say nothing about the page.

 

[sanjay]

For me kaspersky flags the entire forum - every single page, every single section.



The similarity is that me koko and nosound.97 all have kaspersky which detects it.

So those without kaspersky many not get the warning.

This seems to be a kaspersky sensitivity issue. I did some googling and found that there are a lot fo false positives because of some new advanced heurestic algorithms incorporated into kaspersky.

From their own forums: HEUR: TROJAN.Script.Iframer - Kaspersky Lab Forum

 

[sanjay]

More on false positive:

HEUR:Trojan.Script.Iframer - Kaspersky Lab Forum

Another forum with false positive:

Trojan on Arenajunkies - Arena Junkies Forums

 

[sanjay]

We are going to continue to look into this and do research. Please post anythign that might be helpful in uncovering this issue. If you use kaspersky please look up this alert on their forums- I think it will make you comfortable that this is not a hostile trojan, but possibly a false positive from kaspersky's method of evaluating active processes.

If anyone finds anything else that might be a clue let us know, but we are running diagnostics on our end.

 

[PsyMan]

Yeah, false positives became quite common during the last few years, especially with software that uses the kaspersky AV engine.

 

[70597]

The issue seems to have vanished. I guess it was just a false positive after all.

 

[P3R3]

The issue was related to an exploit released this morning in the VBSEO software. The JS was exploiting clickthroughs and page views to try and illegally gain traffic. We have patched our VBSEO install and we thank the ngemu community for your prompt response to the problem at hand. Let us know if anything else arises.

-CG Team

 

[Lex_Light]

Thanks, P3R3.