Mapcore Trojan

    It's not necessarily the case Sindwiller. The trojan has had various variants/updates since then according to McAfee's report.

    Mojo, be sure our host is aware of this ASAP.

    Have you forwarded this thread to the web host Mojo? Going off the link Sindwiller posted, this is only something they can fix as it's a server-level security breach.

    The only .js files I get are these...

    Quote

    <script type="text/javascript" src="./styles/prosilver/template/styleswitcher.js"></script><script type="text/javascript" src="./styles/prosilver/template/forum_fn.js"></script>

    Running latest Firefox with noScript, scripts on Mapcore have been allowed though.

    Sindwiller, I get this:

    <script language='Javascript' type='text/javascript' src='zyzsf.js'>

    however when reloading it's gone... (forum front page btw... I also get the warning at the new posts page but never at the thread pages themselves)

    It's back, but this time my antivirus program detects it. It's called Exploit.Multi.Qtp.f. (virus).

    It attempts to run a quicktime file called H4DbN1ZNzPe717qd.mov from web2.awareindia.com.

    or

    XS9AzX7TbCB80iCs.mov from 216-55-167-32.dedicated.abac.net.

    or

    GFIIh6RxK14TF8ts.mov from 69-64-72-35.dedicated.abac.net

    (seems to be random, infected servers?) God I hate quicktime!

    There is a chance that this is a different version of the same malware than the previous one. The virus was also reported at

    http://www.antiviruslab.com/newentries.php?lang=gb on December 22, 2007 so it seems to be fresh from the oven. This is the 6th version of the same thing:

    http://www.viruslist.com/en/find?search ... .Multi.Qtp.

    Exploit.Multi.Qtp.c, on the other hand was released earlier and displays a number of hits on Google. The description of this particular version is worrying:

    http://research.sunbelt-software.com/th ... tid=157219.

    Quote

    High risks are typically installed without user interaction through security exploits, and can severely compromise system security. Such risks may open illicit network connections, use polymorphic tactics to self-mutate, disable security software, modify system files, and install additional malware. These risks may also collect and transmit personally identifiable information (PII) without your consent and severely degrade the performance and stability of your computer.

    As for the page it appears on, does it really matter if it's a server-side issue? It's everywhere, even on the front page. The threat is real, so fix it please! This is getting really annoying and embarrassing for Mapcore now!

    Quote from Sindwiller

    Running latest Firefox with noScript, scripts on Mapcore have been allowed though.

    Quote from ginger_lord

    Running FF with AdBlock Plus and have never got it.

    All hail!

    Quote from skdr

    I have no idea what it does and where this came from this suddenly.

    I am still looking in to this. A lot of the ones that people seem to be getting seem to have had their detection rules updated in early Dec, so that is why it is suddenly popping up now. We are looking into if its the host or the forums themselves.

    "HTML/ADODB.Exploit.Gen" seems to be a variant of Troj/Psyme-GG but both don't yield many results on Google, which makes tracking down what actually causes this problem some what difficult (especially when the forums themselves consist of many many different parts

    Anyone try what they suggested here? http://forum.avira.com/thread.php?threadid=25966 (More the deletion of files in the temp folder, then the turning off of system restore).

    I am trying my best to figure out what exactly is causing this. If anyone else can look up these issues and see if they can find any consistencies the better. Its INCREDIBLY tough for 1 person to figure this all out, especially when the problem is not occurring to them.

Participate now!

Don’t have an account yet? Register yourself now and be a part of our community!

Register Yourself Login