Downloader File from the Den??

[AMC of Houston]

A few days ago, I started having a weird thing happen whenever I boot up the Den.   My Norton virus scan tells me a file named swfobject{1}.js is trying to download from the Den; and Norton thinks its unsafe and removes it from my 'puter.    Anyone know what this file is??

[carnuck]

I agree it may be a N Korea or other guys bug. I have seen my screen go nuts and try to redirect me to hsda.NK

[recomer]

George,

Its happening to me too. The Den is the only site that's doing this. Ran a full scan of my machine and nothing malicious comes up. I've been in contact with Doug and in turn he with Ken to look into this.

Rich

[IowaEagle]

Ken is on top of this as we speak.  I had another member visit with me about this on the FB page.  Here is Ken's reply from a few minutes ago:

I got a report just minutes age from 2BY2 support group, they have scanned the entire site and found no Virus attach to any page of the entire forum. They did not scan the site they do not support from the bottons on the top of our forum home page. I begged them to do me a favor and just do a fast scan of the home page of those sites not the entire subset of there links. It was reported back to me that, EVOL and FBDen have viruses on there main pages!
They have or are contacting the support center of FaceBook, But do not know who to contact as there is no support group or [Whois] contact for the EVOL Forum. Maybe you know or can contact the owner there that there main page has two viruses attached to there main login page, all other links are clean and passed there test.

[IowaEagle]

Update:  Apparently, the virus attempt pops up if you use the AMC Eagles Den home page buttons for the Forum and the Evolution Forums.  Until we get a all is OK notification I suggest no one use the buttons of the Den's Home Page.  Go directly to either forum when accessing them. 

[IowaEagle]

Just found out from another member that the virus was originally on the old Nest home page and when it morphed into the Den's home page it travelled along with it.  So, do not use the buttons on the Den's home page for the time being.

[AMC of Houston]

On my 'puter, the mess pops up before I even try to hit any buttons.   Just an FYI.........

[1985amceagle]

On my 'puter, the mess pops up before I even try to hit any buttons.   Just an FYI.........

if you don't mind my asking, what is the URL to the page that this is happening on?

[recomer]

Seems not every AV is picking it up. Symantec screams soon as you go to the beginning page for the Den (amceaglesden.com). If you go into the forums directly (forums.amceaglesden.com) you don't get the hit. I tried it on my laptop running Microsoft security essentials and it doesn't detect it. I went to a online scanning tool and it hit on a swfobject.js file from the Dens home page. A little further research and this is a known issue on Word Press sites dealing with a vulnerability in a plugin used on wordpress.

[IowaEagle]

I have updated Ken with all of this and he will be in contact with our fix-it company.  Ken is only allowed to be on the computer at the nursing home he is in (for health reasons) for 15 minutes at a time.  He did not say how long he has to wait between computer usages.

[IowaEagle]

Latest update from Ken:

I had Paula check the computer with the Norton antivirus software on it move from page to page, Wordpress, FB, Evol, Eaglepedia, RT66, Main Home, any link that could be found as I have windows protect here in the home on my pc.
As extra protect I asked friends over at Geek Sqaurd since they have lots of computers with differnt virusware to go through the check of all pages on the Den, no notice of any Virus showed up on 32 computers there, 2BY2 also has gone over the entire site a second time using know anty-vius products showed by members the virus, Facebook Did have a virus know as (Downloader) which has been fixed by Sunday the 2 virus on Evol seems to not propergate here and the owner was contacted and was doing a scan, the Face Book virus goes by different names and generaly propergate to the main index in our case is Wordpress, but no signs either on Friday or weekend showed the virus on any of our pages, since it could morf or propergate or jump from one place to another, some people with some products may have seen it on any of our pages as facebook is main parms are loaded upon entry into the main page, some members who did not clear there cache would think it was us, the virus create date was created in Aug 8,2001. so only hardware running windows 7 and before would see it under very strange issues, I have been asured a I did not just take there word for it but checked as many ways as I could dream up, we have no virus infection and our support group will be running nightly scans for now, at of a bit of extra cost, but worth it as the main package donation membership store is about to open anew in about three weeks, bad stuff travels fast, good news people shrug off, so I  need the word to go out we are clean were and still are if you get any rare cases that your computer of any user this or any virus shows up please clean up your cache then enter the Main page again and you will find your problem gone.
We need to stop the fire of virus (Fire call or Wolf is coming) as new things are being added there as well as the forum and history forum.
Ken 

[carnuck]

It could be a server side or network virus too. Firefox has been reporting hacks the past while too. They just released an update because it was coming through a Flash plugin.