Mapcore Trojan

    Quote from Mazy

    I just got it for the first time, and on Firefox :GHmmm

    It's because it's a new virus with different behavior: Exploit.HTML.IESlice.bz as Wunderboy noticed. The previous one, Exploit.Multi.Qtp.f appears to have left the building. It no longer attempts to run a strange quicktime file from a different server. However, it still relies on the random name.js trick to crash the browser in an attempt to force run some strange and hostile stuff. The magnitude of the problem seems to be far greater than expected I assume.

    What the hell is going on here??!

    Everytime the forums go down a new virus/malware whatever emerges!

    I looked at the source of the page and what stood out was this line:

    Code
    <script language='Javascript' type='text/javascript' src='grbzv.js'></script>

    Which is being inserted (with varying filenames) directly after the body tag. So it's obviously an injection.

    If I had to hazard a guess, I'd say someone is getting into your site via a cpanel exploit and possibly editing you PHPBB template. Check was admin software and version your host gives you then go check the web and see if its the latest version. Chances are that its some 10th peer pyramid host who's never updated their software. The HaJ site gote hacked a while back because of a similar exploit.

    Quote from Wunderboy

    I looked at the source of the page and what stood out was this line:

    Code
    <script language='Javascript' type='text/javascript' src='grbzv.js'></script>

    Which is being inserted (with varying filenames) directly after the body tag. So it's obviously an injection.

    If I had to hazard a guess, I'd say someone is getting into your site via a cpanel exploit and possibly editing you PHPBB template. Check was admin software and version your host gives you then go check the web and see if its the latest version. Chances are that its some 10th peer pyramid host who's never updated their software. The HaJ site gote hacked a while back because of a similar exploit.

    Does it explain the different malwares encountered? So far I've seen three different ones using the same method. The previous malware tried to run a corrupt quicktime file using a Microsoft Data Access - Remote Data Services exploit.

    Quote from -Stratesiz-

    Here is a short snippet of the differences I found in the code:With issues:

    Without issues:

    <body id="phpbb" class="section-index ltr">

    The root of all evil!:

    [Blocked Image: http://koti.mbnet.fi/stratty/mapcore/mapcore_root_of_evil.jpg]

    I have yet to encounter any of these trojans, but it really worries me that they apparantly are here! Could someone provide a risk estimate of how serious this is? With an updated firefox, windows and av I should be pretty safe...right?

    I never used to get this with Firefox/NoScript, but my anti-virus has blocked stuff from this site a few times today. Please sort this out! It's probably better to nuke the forums than have this stuff popping up.

    Mojo's given me some logins so I'm going to try putting a duplicate of the forums on my own hosting and ask some of you to go there to see if the problems occurs. Then we can rule out whether it's something embedded in the forum files itself or a server/host-level issue.

    I'll aim to get that done tomorrow while I'm at work.

    Quote from Thrik

    Mojo's given me some logins so I'm going to try putting a duplicate of the forums on my own hosting and ask some of you to go there to see if the problems occurs. Then we can rule out whether it's something embedded in the forum files itself or a server/host-level issue.I'll aim to get that done tomorrow while I'm at work.

    It's not just the forums. The problem occurs on the main front page as well, and we are talking about multiple trojans here. The source is something more complex and bigger.

    Sure, but I don't think that makes my test any less effective. If it's the files themselves that're infected it'll show up on the other host too; if it doesn't, that's a sign that the server software itself.

    Quote from -Stratesiz-

    It's not just the forums. The problem occurs on the main front page as well, and we are talking about multiple trojans here. The source is something more complex and bigger.

    The only thing on the front page is HTML. There is not Java. There is Java in the source Code but it is all commented out. But since commenting out doesn't do shit in IE maybe its not being really being commented out. All that should show up on the main page is the Mapcore Logo. If somethign else is showing up then Goddamn You IE

    And to Thrik's tests, what he is doing shows that its more than likely the hosts. And if that is the case we will see about switching it over to some other site

    I've just gotten the virus warning the first time using Firefox. BitDefender caught the error;

    Virus Name: Exploit.HTML.IESlice.AH

    I am also now the proud owner of:

    Virus Name: Trojan.Downloader.JS.Agent.ON

    I'm having a browser crash every time I hit the save button (as wel as first load) probem is that I see the save button usually as a ' post' button my record is writing the same message 5 times so far

    I'm getting a "Trojan.Webkit!html blocked" in Norton every time I load any page on the forums Dunno if it's a false positive or what but it's only happening when I browse mapcore and no other sites so I'm guessing maybe the server downtime was a (successful??) hack attempt?

    (Sorry I cross posted this in another forum before I checked here

Participate now!

Don’t have an account yet? Register yourself now and be a part of our community!

Register Yourself Login