Mapcore Trojan

    lol, gg IE.

    I loaded with IE here at work. Nothing.

    All that is on the front page is just some php loading the background and the Background image itself. The front page used to grab stuff from the forums which might mimic how that trojan works. The thumbnail images were either submitted by Frie, Klein or myself, so unless one of us made some crazy iamge h4x, I think its safe to assume its not mapcore.

    If you get it, take a screenshot and report what software you are using, instead of "omg its back"

    It's real. The site tries to randomly ask me to install a microsoft data remote access something, but my virus program terminates my IE session as soon as I get the message on top of the browser. Doesn't sound too unintentional or unhostile to me.

    I have been getting this for a couple of weeks now, my Mcafee Corporate picks it up, it's an embedded script.

    Script executed by iexplore.exe

    Detected as VBS/Psyme

    Detection Type: Trojan

    I can't see anything that could be causing it, then.

    The virus warning in the screenshot above refers to a script, which almost always means Javascript. This is why I still think it's the viruses thinking the Javascript is a virus when in fact it's harmless.

    This is a fresh installation of phpBB so I really can't see what else could be doing it. Unless you guys can pinpoint the problem area by looking at your virus software more (ie: the script or image causing it) closely there's realistically nothing we can do. At this point, "I'm getting it too" does not help.

    Each virus software also seems to think the 'virus' is something completely different, none of which bring up anything helpful on Google.

    So what is this Microsoft Data Access - Remote Data Services Dat... something, "signed by Microsoft" the site wants me to run on a random basis?

    IE also reports an error on row 484 everytime this happens.

    Quote from Sentura

    i get a popup every now and then from microsoft access something something. that's about all; however i reckon this means it's not unintentional.

    We don't know.

    I've just looked into the HTML source and there're only 414 lines on this page, and I have no idea what page you were looking at when you got the error. It could help if you can copy/paste the HTML source when you next get the error.

    The exact error message you get could help, too.

    Ok, I saved the html code of the front page with the problem, and after an immediate refresh without the problem. For some reason IE states that there is an error on that particular row irrespective of the page or row amount. Feels strange.

    Here is a short snippet of the differences I found in the code:

    With issues:

    Quote

    <body id="phpbb" class="section-index ltr"><script language='Javascript' type='text/javascript' src='mkwed.js'></script>

    Without issues:

    Quote

    <body id="phpbb" class="section-index ltr">

    The root of all evil!:

    [Blocked Image: http://koti.mbnet.fi/stratty/mapcor…oot_of_evil.jpg]

    Full code here:

    With problem

    Without problem

    Hope this helps!

    This thing is evil!

    The js. file name keeps changing!

    So far I've seen:

    Quote

    <body id="phpbb" class="section-index ltr"><script language='Javascript' type='text/javascript' src='dhkfn.js'></script>

    and

    Quote

    <body id="phpbb" class="section-viewtopic ltr"><script language='Javascript' type='text/javascript' src='mufox.js'></script>

    There is definitely something going on!

    I've saved the html codes for these two hits as well. Tell me if you want them.

    As I'm writing this reply, it appeared again. The js. file name appears to be completely random (kemuo.js this time). I have spotted it everywhere on the forum pages. I haven't tested the mapcore front page (portal page) much but I haven't seen it there.

    I refuse to load that .js thing on my computer, I don't have it in my cache.

    UPDATE: It appears in intervalls. I get it like virtually 5 times in a row on various forum pages, then it disappears for a while. This thing is mean. How is this even possible?

    I'm a complete noob at this so don't beat me up but can a server be inficated with a virus/trojan/worm like a normal computer? So it wouldn't be phpbb it self but the apache or something?

    Yes it can, and that's actually really worrying. While server break-ins are extremely rare, poor security management from the web host (I have no idea who hosts us) can lead to such viruses being embedded into the server software itself.

    Mojo, you need to forward this page to our web host's support and ensure they look into it immediately. What Strat helpfully posted (Thanks!) is very indicative of a clever server-side virus, which is kind of disastrous. I also remember when they exposed our MySQL login details, which was another big security flaw. I hope this isn't an ongoing pattern.

    /me holds frie

    Hrm, this does sound kinda serious. But seriously? Why us?

    I mean, we're a good community and all, but we aren't really 'that' big, are we?

    Unless of course this is just something random automated stuff and we got unlucky

Participate now!

Don’t have an account yet? Register yourself now and be a part of our community!

Register Yourself Login