Trojan attached to site

[nick-c]

There appears to be a Trojan hidden in the site somewhere.

30/03/2010 18:40:31 Denied: Trojan-Downloader.JS.Agent.fce Firefox *link removed*

I dont know whether it's a legit part of the site or not either way it's a little unnerving, anyway you are aware of it now should it be dodgey.

[Radius]

go to this site to check if you have got it or any of teh variants. The cleanup scripts are in the download section
http://www.scatlovers.com

[BDS]

http://www.youtube.com/watch?v=VwCaOg39ZCo
...

[nick-c]

I havent got it as Kaspersky blocks it. Just giving a heads up to admin and other users who may not have an AV that detects it.

[Fes Rock]

how can one even embed a trojan into our script?

i found all my answers at www.scatlovers.com

[fisher]

how can one even embed a trojan into our script?

i found all my answers at www.scatlovers.com

fes fes fes

[Fes Rock]

staedy trollin since 07 eh playboy?

[BDS]

staedy trollin since 07 eh playboy?

God I wish there was still a thanks button :oscar:

[Moskit]

People are gonna think i'm playin' but i'm deadly serious.

My work PC got done by a fake Trojan from here today & i'm actually really fucking pissed off by it.

Why the fuck is it here?

It embeds itself in windows security centre as "XP Security Pro" if you use a secondary Virus Protection Program, doesn't matter if your protection is up-to-date or not, it is a "ghost/fake trojan".

I've had to do alot of explaining & fuckeries today due to this bullshit & it still ain't sorted, it deletes all the paths from shortcuts to program files upon remova/deletionl & generally causes fucked havoc.

PLEASE FUCKING SORT THIS OUT IT IS BULLSHIT.

Genuine: :angry:

[sdm]

Hi both, I've had a quick look around the server and the forum software and cannot see any sign of a trojan being embedded within this site or server.

Does it happen on a particular page? If so, which one?
Can you take a screen shot of the message(s) from your spyware/anti-virus software?

Is anyone else having this issue?

I'm more than happy to investigate this but I need some more information and evidence.

[$marty]

No problems over here.

[Moskit]

I tried to take a screenshot, but couln't upload from work due to the bars in place...

Sorry for all the swearing by the way, not called for, just got a grilling cus' I shouldn't really have been on here, so many apologies for that. :(

It happened to me in general section, was just posting as normal & it just jumped in, closed down internet explorer then started with its "pay to update security centre" malarkey.

The filename was: FakeTrojan.av & it infects extension files in user settings folders & spreads into program extension files the more you carry on operating wih it on your system.

The I.T guys here think its when there are multiple users on one server like here, they have closed this loophole it used to get in here, so hopefully won't have the same problem again.

But it wrecked all my settings & paths to files for programmes upon deletion as it actually becomes an extension of a Dorment Standard Windows Security Centre when you're using a Secondary Virus Protection (Norton etc) as your primary Firewall & as previously described, carries on spreading through file extensions.

Clever, but bleak as hell.

Hope this helps.

Cheers,

Amos

[Scythe]

Someone's sig might of been hijacked so an image contains a script. Have a look into the threads for the virus alert and then track it down using the address source the AV gives you.

[Radius]

Moskitt you downloaded the fake trojan from Scatlovers .don't pretend.