If anyone is using firefox, you may realize that when you visit the boards homepage a prompt comes up requesting that you open a certain php file.

Well for you IE users, you are automatically downloading this everytime you visit the index page.

According to Bryan, who unfortunetly uses IE at Schneider, their virus detecter caught this as a trojan.

I say again, something needs to be done on the homepage. To all of you IE supporters/users, there's a possibility that you are infected. Firefox users, DO NOT OPEN/DOWNLOAD THAT FILE.

Since I or Bryan no longer have any control of this board or site, there's nothing we can do to investigate further.

_________________
2005 Saab Linear 2.0t - DD
1993 Mitsubishi 3000GT VR4 (Sandstone Grey) - SOLD!!
BPU 1993 Dodge Stealth R/T ATX - SOLD!!!

SJ, Matt, and I are aware of this and trying to get it fixed. I hope that it doesn't cause any problems for anyone. In the meantime people can avoid it by going straight to the forum they want to view and skipping the forum index.

A

Or everyone should get rid of the piece of trash that is Internet Explorer and visit

www.getfirefox.com

Let me know if you need any assistance Aaron.

_________________
2005 Saab Linear 2.0t - DD
1993 Mitsubishi 3000GT VR4 (Sandstone Grey) - SOLD!!
BPU 1993 Dodge Stealth R/T ATX - SOLD!!!

Thanks, I'll let you know if there is something you can help us with.

So just for those of us who are fairly computer illiterate, and have IE, and have already been to the main page, how do we get rid of a trojan? k, thanks.

_________________
Bad decisions make good stories.
Look at it! LOOK AT MY @SS AND TELL ME IT'S PRETTY!

Okay, I believe we got it fixed. The phpBB software/db was exploited with some malicious code embedded in. I'll post again a little later with more details. Can you guys who saw the virus warnings confirm that they're no longer showing?

As for what opening the main forum page without virus protection might have done to you computer, I don't think this trojan was a high-risk threat from what I've read so far. But, that's not a guarantee. You may want to run Ad-Aware, Housecall, etc to make sure there's nothing funky going on. I intend to do so on my home computer when I get back there later tonight.

Here's a thread from late last month where it looks like another forum had the exact same problem as us:
http://www.bigbrassblog.com/phpbb/viewtopic.php?p=941& ... the culprit is explained in the sixth post down by "Pam's House Blend".

That thread led to this one: http://www.phpbb.com/phpBB/viewtopic.php?t=298520&highlight=trojan

Basically, in one of our description fields, something embedded some unwanted html code that brought in code from the outside. Sounds like a security hole in phpBB. To prevent this problem, it's recommended to update the phpBB to a newer version.

I noticed the virus last night. My virus scanner (even with IE) picked up 2 or 3 different trojans/viruses every time I tried to view the Forum Index.

There seems to be no issues now.

Brad

_________________
Brad
92&93 RT TT

Mods:
TD04L 13T's | Alamo Side Mount Intercoolers | RC 550 cc injectors | Supra fuel pump | SBC DXD 6-puck | 3SX Poly Motor Mount | TySpeed DP w/ TP | custom Magnaflow exhaust | DSBC | S-AFC | + much more

I have no issues now either.

_________________
~Joe - aka spider gear destroyer
'94 Stealth R/T
-Lightly Modded ;)

I examined the code of a few of them, and they don't seem to be anything really. Just random bits of ascii code charactors with a few protcol lines. Looks like someone is just testing to see what they can get away with...

_________________
06 Blue EVO 9

All is well.

_________________
2005 Saab Linear 2.0t - DD
1993 Mitsubishi 3000GT VR4 (Sandstone Grey) - SOLD!!
BPU 1993 Dodge Stealth R/T ATX - SOLD!!!

It's doing it again.

_________________
2005 Saab Linear 2.0t - DD
1993 Mitsubishi 3000GT VR4 (Sandstone Grey) - SOLD!!
BPU 1993 Dodge Stealth R/T ATX - SOLD!!!

_________________
Bryan Louis
I had a 3kgt...then some douche bag wanted to run into it.

Ran into problems sending Mail. Response: 535 authentication failed

DEBUG MODE

Line : 131
File : D:\webs\w3si.org\forum\includes\smtp.php




I get this error everytime i try to P.M. someone and i dont even know if they are getting my P.M. Is this the issue people are having cause of the virus?

_________________
1992 RT/TT Black.......lots of goodies.

people should still be getting the pm's. I should be resolving the error issue tonight. Are you guys getting the warning on the forum index page like you were before, or is it just the error code Brian posted?

A