Kaspersky thinks 'prototype.js' is a trojan

[47137]

Throughout much of today, Kaspersky anti-virus has been telling me each page on the RMWeb is malicious, and is blocking the javascript. None of the drop-down menus work, and I can't edit a blog post or even post a screen capture, but in essence the message is this:

Object name HEUR:Trojan.Script.Generic

Object

http://www.rmweb.co.uk/community/public/js/3rd_party/prototype.js

Application

Opera Internet Browser

Object Type

Trojan program

 

I've tried another browser (Edge) with the same result. Bearing in mind no-one else has reported anything along these lines, please what might I do (short of disabling the a/v) to get useful access to the site? Other web sites seem to work fine.

 

- Richard.

[martin_wynne]

Hi Richard,

 

HEUR means "heuristic" which is a fancy name for a guess. In other words Kaspersky hasn't actually found a trojan, it just thinks something looks a bit odd. There should be a way to tell it that it's wrong, and this file is ok. Assuming it is, of course.

 

cheers,

 

Martin.

[Ouroborus]

I've had the same.  It was reported.  Using Chrome with avast

 

http://www.rmweb.co.uk/community/index.php?/topic/140648-web-attack-fake-browser-update-8/

Edited December 23, 2018 by Ouroborus

[wombatofludham]

I'm having the same on Micro$haft Edge and it's removed a lot of the functions as well, although I can read fine. As I'm going to digitally detox for the next few days as I visit relatives it's not a massive thing but I assume it'll get fixed somehow.

 

Also using the Russian Mafia internet security, and it seemed to start after the most recent Kaspersky update.

[Andy Y]

Hopefully the issue is now resolved.

[sb67]

Went to log on this morning and RMweb has been behaving differently, instead of a small log on box appearing in the middle of the screen and it remembering my password a whole new page opened up and each time I have to type my password in. Also when I click on the my profile drop down box in the top right of the page that does not appear and if I click on it, it takes me to my member profile. Not sure what could have happened, coincidence or linked to the above?

Wanted to add I was on the site around 6am and I tried logging on at 7ish and I noticed the problems.

Steve.

Edited December 24, 2018 by sb67

[sb67]

30 mins later and all gone back to normal now, all pages and drop down menus working. 

Steve.

[47137]

Hi Richard,

 

HEUR means "heuristic" which is a fancy name for a guess. In other words Kaspersky hasn't actually found a trojan, it just thinks something looks a bit odd. There should be a way to tell it that it's wrong, and this file is ok. Assuming it is, of course.

 

cheers,

 

Martin.

 

Martin - many thanks for this. In Kasperky's own words,

A technology for detecting threats about which information has not yet been added to Kaspersky Lab databases. The heuristic analyzer detects objects whose behavior in the operating system may pose a security threat. Objects detected by the heuristic analyzer are considered to be probably infected. For example, an object may be considered probably infected if it contains sequences of commands that are typical of malicious objects (open file, write to file).

 

Down in the depths of its UI, Kaspersky has a check box to let you turn off heuristic analysis, but this is a global setting for the program. It seems, you can tell Kaspersky about an individual application software, but not a trusted web site.

 

The trouble is of course, for me I would be very reluctant to turn the heuristics off, because the possibility of a hack on the RMWeb is finite. I've got no idea whether the antivirus software has made a correct judgement, but I suspect it knows more about making guesses than me.

 

Andy - whatever has changed, the features of the site I usually use all seem to be working fine now. Many thanks.

 

- Richard.

[wombatofludham]

All sorted this morning, thanks Andy and any "tech" people.  You've saved Vladimir having to divert his spambot technicians from posting trolling posts on BBC's "Have Your Say" pages to resolve the issue.

Edited December 24, 2018 by wombatofludham

[GeoffAlan]

As already reported elsewhere by me, Windows10, Chrome says rmweb is not secure. Maybe one of your certificates is out of date?

[55020]

As already reported elsewhere by me, Windows10, Chrome says rmweb is not secure. Maybe one of your certificates is out of date?

 

It is shown as "Not secure" because RMWeb isn't an https website i.e. data sent to/from the website isn't encrypted.  All perfectly fine and normal 

[Andy Y]

As already reported elsewhere by me, Windows10, Chrome says rmweb is not secure. Maybe one of your certificates is out of date?

 

As already responded to - http://www.rmweb.co.uk/community/index.php?/topic/140637-not-secure/

[royaloak]

It is shown as "Not secure" because RMWeb isn't an https website i.e. data sent to/from the website isn't encrypted.  All perfectly fine and normal 

Damn right its not secure, this website has done a fine job of emptying my wallet, especially that bloomin bargain hunters thread!