AirNav Forum Trojan?

[Anmer]

If you visit the AirNav forum you may like to check out this thread.

I'm not getting any warnings using AVG but there are reports of a trojan from a number of AirNav members.

http://www.airnavsystems.com/forum/index.php?topic=6913.msg79053#msg79053

[Sun Worshipper]

I saw that title and thought tarbat had created yet another username

[alanrdarby]

I use Avast and this blocked it on connection last night

[Bethsalem]

Malwarebytes and AVG finds nothing on my machine.

[Anmer]

AVG has found nothing here and 4 hours into a scan of one of two hard drives, Malwarebytes has found nowt so far.

[alanrdarby]

The file name that Avast blocked was shown as Infection  JS:redirecto-TH

[stonosnr]

I had the same Trojan report on the ShipTrax Forum this morning and couldn't access it. Oddly enough someone from "Microsoft" phoned me up a few minutes afterwards to advise me that he had spotted a nasty virus on my machine!
I told him to "go away", or the Anglo Saxon equivalent, but wondered if there might be a connection. A remarkable co-incidence though!

Peter

[Anmer]

I suspect it's a false alert from some of the so-called AV products.

I have a bunch of "security" products here and what one finds another doesn't.

[Anmer]

I had the same Trojan report on the ShipTrax Forum this morning and couldn't access it. Oddly enough someone from "Microsoft" phoned me up a few minutes afterwards to advise me that he had spotted a nasty virus on my machine!
I told him to "go away", or the Anglo Saxon equivalent, but wondered if there might be a connection. A remarkable co-incidence though!

Posted on "another" forum:

"HMMMM
are you using microsoft essentials and have you got it set to send reports to microsoft ??
which i think you can do"

I didn't think anyone was that naive?

[Anmer]

Since I'm banned from the radarspotters forum and can't post a reply to the personal abuse from the member concerned I'll post his reply here.  It may help someone if they get an unsolicited call from Microsoft to say they've spotted a serious virus on their computer 

"Dont even think about copy and paste this to your stupid forum Mr Anmer
this is copywrite of me and this forum


Hi All

firstly i dont want to be inundated with requests in the future regarding virus/malware >>>that said
as its this forum and fellow virtual radar users

a very good friend of mine is a Microsoft MSVP for their security pages
i have just spoken to him and heres his over the phone reply :-

1] if real this is a very nasty Virus

2] assuming you have been sensible with a 64 bit win7 machine and NOT turned the UAC off
which was being advised by some. you should be ok as you should be asked if you want to install

only a total wally would click yes

if you are 32 bit you are in greater danger than the 64 bit guys

3] your anti virus software should grab it
make sure if its quarantined it gets removed/deleted

4] heres the bit re websites and forums

there is about a 2% chance its bogus >>98% chance its real

it may well be from the forum its self>>any advert on that forum>>or worse its on the server they use for the forum
[ is that the same server for other airnav bits >> if it is i would keep away for the next few hours]

5] i was asked to send my pal an e-mail with the url posted in this thread at the top which i have done
he will have a look further tonight when he gets the chance

you have been warned !!!!

K/"

http://www.radarspotters.eu/forum/index.php/topic,6690.msg47587.html#msg47587

I'll await a letter from Keith D's solicitor. 

[Anmer]

I've just done a full system scan (took 8 hours) using Malwarebytes (AVG paid for version did a full scan overnight as it does every night) and nothing was detected.

Doesn't prove anything other than these two "security" products didn't find anything suspicious.

I've logged out of the AirNav forum and logged back in and no alerts.

Hopefully I'll get a call from Microsoft. 

[Anmer]

As advised elsewhere by an expert, the absence of an alert "from there (sic) anti virus/malware programme" is either because:

"a] the program they are using is totally useless [wether free or paid for]

b] they either haven't bothered or don't know how to update there definition dbase"

I know for a fact that both my AVG and Malwarebytes' definitions are up-to-date so can only assume both products are totally useless.

So if you rely on these products be warned and either get something better or keep away from the AirNav forum.

I'll take my chances.

[Chris-G0WTZ]

If you believe a site is issuing a virus send an email to your ISP support is usually all it takes for peace of mind.

I am sure google bots would have picked it up if there was an issue

[Anmer]

I see the security "expert" has back peddled:

"i just tried that URL again and it seems clear now"

[Anmer]

This morning I replaced AVG with Microsoft Security Essentials on a spare PC running Windows 7.

I then ran a full system scan, no threats detected.

Next I went to the AirNav forum.  Microsoft Essentials didn't issue any alert.

The security "expert" posted this on another forum:

"i just clicked on the link in the posting above yours and got a trojan warning from my security which is the bog standard Microsoft Essentials

check of the history window in there revealed

serious alert :-

Trojan:JS/blacoleRef.W"

He has since posted "i just tried that URL again and it seems clear now>>time will tell"

As I said before, all this proves is that the three products I'm using on my PCs aren't detecting any threats from the AirNav forum.

But as one AirNav member has posted:

I have had problems with my laptop for the last few days, since I opened this (AirNav) site and had a pop up which seems to have hi-jacked my machine.   I used to run Norton, but since this expired, and I changed from BT Internet to Orange, and had problems installed their freebie version of McAfee, I've not had any protection running - only myself to blame for that! - but there's definitely something interfering with things now.   If I open IE, sometimes the machine goes to various advertising sites and shuts down whatever I'm trying to access, my email is worst, which I'm not able to acces properly now.    I feel a re-format of HDDs and re-installation of Win 7 coming on, at least 2 years since I last had to do it, so that'll also get rid of an awful lot of crap!   Before this happened, RB program would act up, and won't let me highlight a particular a/c on the display, doing its own thing, going to any other a/c in the vicinity except the one I was trying to follow - anyone else had that?

Therefore, please make your own decisions about visiting the AirNav forum and, whatever you decide, make sure you protect yourself from threats and take regular backups.

Another thought has crossed my mind.

It's more than likely that the AirNav forum members who have detected threats are also RadarBox users and connect to the AirNav server for constant database updates?