Community Forums

Kuma · 10-31-2007, 03:04 AM

When I access any of the individual discussion forums my virus scanner is giving me an alert for the 'JS/Feeb.cj' virus. It's catching it, and getting rid of, but it's annoying.

I'm fairly sure it's a false positive, but I'm not sure how to stop making it happen.

My scanner, the CA Security Center, updates the signatures daily, if not more often... and I don't intend to change scanners. I've used most of the scanners out there at one time or another, free or subscription, and really like the CA product.

Any thoughts?

FLYTYER · 10-31-2007, 03:41 AM

Does this occur only on this site? If so, I would send a detailed email to webmaster@irv2.com. If not then there is something within the setup that is perhaps not correct.

Assuming you are using WindowsXP, do you have the firewall turned on?

In the WindowsXP security center does your virus scanner show as being active?

Kuma · 10-31-2007, 04:21 AM

Yes, only here and only on the sub-forums, not the main forum page. I'm running WinXP/SP2 along with Computer Associates "CA Security Center" - Virus scanner, Firewall, Pop-up blocker, Spyware detector, etc., all rolled into one.

I did a search on the CA website and there's a whole family of 'Feeb.xx' variants... It's actually a WORM, but the description states they're passed via eMail or ICQ... no mention of it being passed via a discussion forum... But it's a JAVA Script enabled thing so I'd assume it's possible...

I'll eMail the webmaster and let them know...

RustyJC · 10-31-2007, 04:56 AM

I'm linking this post up into the Website forum since that's the real subject.

It's interesting you mention this. We use sbcglobal.net (AT&T) as our home ISP provider. This morning, Sandy said that there were some virus alert messages on the screen and asked me to check them out. IIRC, the viruses identified by the CA software in the firewall were the ones you mention, and they were in the Internet "temp" files. After going to IE tools and deleting all temp files, cookies, etc., we can't log onto iRV2.com from the home computer - we can see the forums, but when we try to bring up the login screen, it won't load (timeout error). It's as if the firewall is blocking access to that screen.

We can open all the other forums we frequent (e.g., i-bmw.com, etc.) just fine. Obviously, I'm posting this from work.

Rusty

MonacoMama · 10-31-2007, 06:05 AM

Kuma...
Is it any and all of the sub-forums...or just a few specific sub-forums?

Kuma · 10-31-2007, 06:18 AM

I haven't tried to access every single sub-forum because there's so many of them, but all the one's I have accessed (maybe 10 or so) generate the alert. But the main page DOES NOT generate an alert!

I know there's a possibility this is my virus scanner giving a false positive. It started happening right after the daily signature file update occured this morning...

When I searched the Computer Associates website it didn't return any information on this particular variant (JS/Feeb.cj - but it did return information on a LOT of other 'Feeb.xx; variants. It's a LARGE family!

I went to several other forums and websites with NO problem. So, thinking this might be a new variant is what prompted the post, and it's also why I emailed the webmaster.

MonacoMama · 10-31-2007, 06:26 AM

What is one of the dub forums you went to?

Kuma · 10-31-2007, 06:49 AM

The one we're in now... all three of them in this category. The 5er forum(s), and two or three others that I can't remember.

Note: I just ran a FULL anti-virus scan on my system and it came back NEGATIVE! The alert's are being generated from the 'Real-time runtime component'. I'm getting ready to eMail support at Computer Associates, pass all the information to them, then ask rather or not they screwed up something in the latest signature file. Or, if the run-time scan engine could throw an alert if it detected some programming anomaly in a site or discussion forum code (a JAVA Script anomaly)...

If they get back I'll get back...

RustyJC · 10-31-2007, 06:52 AM

Kuma,

Please do post back what you find out from CA. I have to come up with a fix for our home computer as well, and I think whatever's keeping us from logging onto iRV2 is tied to the CA security software in the firewall.

Rusty

MonacoMama · 10-31-2007, 06:56 AM

I will also go onto one of those pages and then run a different scan. I do use Grisoft's free AVG ...and sometimes run Panda's...
Gotta go to work ... will check it tonight ...

Hitchhiker · 10-31-2007, 07:41 AM

No problems here on my end and the forum reflects that there are currently 69 members) and 182 guests logged onto the forums. However, I'll ask Bill "Warpath" to look into the possibility of a virus in the server and/or our Groupee supplier. Thanks for the 'heads up'.

UFO Pilot · 10-31-2007, 08:19 AM

My CA scan is giving me the same results. Every sub forum I open gives me the message, infected with 'JS/Feeb.cj'

Pusherman · 10-31-2007, 10:04 AM

I too am getting the 'JS/Feeb.cj' virus infection notification. I also have CA scan, and it has told me it's an infection, and it did not clean it. Just as other's have described.

rebelsbeach · 10-31-2007, 12:25 PM

We have researched this issue and the best thing we can tell you is it's a CA issue and not an issue with iRV2 or our server.

Warpath checked into it with infopop and has pretty much determined it's Ca with the issues and not us.

I regret this situation is causing you folks some issues with accessing the forum and I hope they get it straightened out soon.