Mapcore Trojan

[dissonance]

Internet high-five @ Sindwiller

[skdr]

Btw. I'm getting this trojan now aswell.

It's called "HTML/ADODB.Exploit.Gen"

HTML/ADODB.Exploit.Gen

Description:

A generic detection routine designed to detect common family characteristics shared in several variants.

This special detection routine was developed in order to detect unknown variants and will be enhanced continuously.

Version history:

The following engine updates were released in order to enhance detection:

• 7.04.00.44 ( 18/07/2007 )

• 7.06.00.40 ( 07/12/2007 )

[dissonance]

So... it basically bruteforces open exploits?

[skdr]

I have no idea what it does and where this came from this suddenly.

[Thrik]

http://jeroenwijering.com/?thread=7128

Looking at that, it seems embedded Flash with certain code is one thing that can give a false positive for this thing. It could just be that something harmless in the forum code is similar to that in a virus, hence the detection.

Looking at the forum source code though, I have no idea whatsoever what could possibly be causing it. Hopefully just upgrading to phpBB 3 (and thus wiping out our templates) will fix it.

[Cybbe]

I've gotten this each and every time as well, but since noone (believed me, and noone) else were reporting such problems on irc, I just left thte forums for a while and figured it was something on my end. It wasn't, though, which is why I've returned and saw this thread in the first place.

I'm getting it as an activeX thing, though, so I'm guessing it's IE exclusive?

[skdr]

No. I'm on firefox and I'm getting it too.

[dissonance]

No. I'm on firefox and I'm getting it too.

Try running it with the NoScript addon?

[Ginger Lord]

Not getting anything here.

[-Stratesiz-]

It occurs like every 4th time I open mapcore.net/forums or so.

[⌐■_■]

Not getting anything here.

[Cybbe]

Mine disappeared since I switched to firefox, so I'd say it definitely is an IE issue.

[D3ads]

Mine disappeared since I switched to firefox, so I'd say it definitely is an IE issue.

Except that:

No. I'm on firefox and I'm getting it too.

[Cybbe]

Maybe he doesn't block stuff though? *shrugs*

[skdr]

I have adblock and noscript running. Still getting it.