Trojan Infection on SW Forum Site? 2

[Theophilus]

I'm getting notices of trojan infestation on the SW forum this morning. Not sure whether this is a false positive, intercepted connection, or what, but I'm attaching a snapshot to show what I mean. The site seems to be hosting a script that runs upon load of the page.

Has anyone seen similar symptoms/warnings? Might be serious, or it might be nothing. I use Avast (Pro), which has a script-sniffer, as well as the no-script add-on within Firefox (which is designated to "allow" the forum page, so would have been ineffective in stopping a trojan-related script in this case). With the script disabled, I cannot post there.

Can anyone verify or debug this issue?

Thanks,

Jeff Mowry

http://www.industrialdesignhaus.com

A people governed by fear cannot value freedom.

 

[Theophilus]

Here's another snapshot that shows the SW domain name.



Jeff Mowry

http://www.industrialdesignhaus.com

A people governed by fear cannot value freedom.

 

[CorBlimeyLimey]

I've not received any such messages nor noticed any malware type activity.

Running Win7 x64 with MS Security Essentials, Windows Defender & Windows Firewall enabled. A quick scan with Malwarebytes reported no problems.

Have you reported your findings to SW? Perhaps you should start a related thread in the forum to see if others there are seeing something similar?

 

[Theophilus]

Yeah, I'd like to start a thread in the SW forum, but while this script is being blocked on my side, the script required to create a post is also inactive (same script, or all scripts are being disabled as a precaution by Avast).

Please feel free to pass this along on the SW forum, but until I've got some reasonable certainty this is a mere false positive I'm not going to force allowance of the script. Otherwise, I've sent notice to a couple of people at SolidWorks by email.


Jeff Mowry

http://www.industrialdesignhaus.com

A people governed by fear cannot value freedom.

 

[CorBlimeyLimey]

OK, I'll copy & paste your OP & images in a thread.

 

[Theophilus]

Thanks.

Just saw an article on a late-edition Java exploit here:

http://www.theregister.co.uk/2012/08/27/disable_java_to_block_exploit/

Jeff Mowry

http://www.industrialdesignhaus.com

A people governed by fear cannot value freedom.

 

[CorBlimeyLimey]

A response has been posted at the SW forum.

We checked this out, and here's the response from the tech folks:

We have concluded that this was an issue with the virus definitions of Avast (#120828-1). If you update to the newest virus definitions (currently #120828-2), you should not receive the warning anymore as it has fixed the problem. This was a simple false positive, so there is no need to worry about infected computers due to this.

 

[Theophilus]

Perfect--Richard sent that to me as well, and it's good to see there aren't any real issues with the forum. Thanks for getting this update posted here quickly.



Jeff Mowry

http://www.industrialdesignhaus.com

A people governed by fear cannot value freedom.