Mapcore Trojan

[Sentura]

i get a popup every now and then from microsoft access something something. that's about all; however i reckon this means it's not unintentional.

[Sindwiller]

I have adblock and noscript running. Still getting it.

You need to disable scripts for Mapcore.

[JamesL]

Not getting it so far this morning @ work on Firefox or IE (Didn't visit from home PC over the weekend just in case..). Hopefully PHPBB3 has fixed it.

[Deathy]

It seems phpbb3 is online but I still get the warning with Avira Antivir...

If it isn't fixed in the new version, i'll upload it at Antivir so they check if it's bad or not.

[Thrik]

Try going to some other phpBB 3 forums that have similar pages to the one where you get the virus warning.

It seems more likely it's a false positive as I don't see how a genuine virus could possibly be there.

[e-freak]

It seems phpbb3 is online but I still get the warning with Avira Antivir...

If it isn't fixed in the new version, i'll upload it at Antivir so they check if it's bad or not.

same here

and i get it on the now blank index page. that's hilarious...

[skdr]

Still getting it too

[st0lve]

Maybe it's not from Mapcore then?

[Thrik]

The only thing on the index page that I can see causing a false positive is the Javascript that preloads images and such. That's generated by phpBB though and I don't think you can get rid of it without causing problems somewhere.

Is it just one shit virus software reporting this or is it happening with lots of software? And have you tried other phpBB 3 boards (which presumably also have the Javascript) to see what happens?

"I'm getting it again" is honestly 500% unhelpful and doesn't help us track down the problem at all. Unless you want to keep enjoying the detections you must look into it a little.

[Cybbe]

I'm using McAfee SecurityCenter 2007... And I got it. It disappeared when I got firefox instead though.

[Mojo]

lol, gg IE.

I loaded with IE here at work. Nothing.

All that is on the front page is just some php loading the background and the Background image itself. The front page used to grab stuff from the forums which might mimic how that trojan works. The thumbnail images were either submitted by Frie, Klein or myself, so unless one of us made some crazy iamge h4x, I think its safe to assume its not mapcore.

If you get it, take a screenshot and report what software you are using, instead of "omg its back"

[Fergo]

Here it is:

Only using Firefox, MSN, ICQ, ZoneAlarm (firewall), my screencap app and Avira Antivir.

It finds the "trojan" always in the Firefox temporary folder, and it seems to be only triggered when I load the mapcore portal for the first time (of course, after that Avira deny the access to the file, but when I reboot the problem comes back).

Fergo

[-Stratesiz-]

It's real. The site tries to randomly ask me to install a microsoft data remote access something, but my virus program terminates my IE session as soon as I get the message on top of the browser. Doesn't sound too unintentional or unhostile to me.

[Thrik]

Do you get it here?

http://serve.ryanjohnwilliams.com/misc/ ... sting.html

[Sentura]

Do you get it here?

http://serve.ryanjohnwilliams.com/misc/ ... sting.html

no.. nothing.