Trojan

[nothing2seehere]

Reading through your ticket, it seems that there is a file somewhere within this site that matches the file signature of a php file that executes a trojan.

I 'think' its saying the file is called
'4e13a649131d78dc7cea6ab30c1b176d2e1826ed8d8b684a94eaa07abef478b7
3312404.jpg'

but could be a combination of one or both parts. Best guess is that this is a trojan designed to get a buffer overflow based on either the carriage return in the name of the file.

[HALF]

the first one is the hash of the file, the second one is the filename
it is detected as php, so probably someone uploaded a image file that has php code as part of the metadata, the php interpreter is very stupid and if they manage to somehow trick the interpreter into reading the image file it will execute the code that is in it

so long story short, if this is the real report, just find the file with the given name and delete it, also check who uploaded it.

[badgb21]

Toby please check out this link from Malwarebytes
Something isn’t totally right here

https://forums.malwarebytes.com/topic/2 ... eforumcom/

[Toby]

Just put Malwarebytes on my pc and it’s blocking access access to the forum saying blacked due to a Trojan

Can anyone advise?

We deleted the file.

Not sure if I have to inform them now or if their software keeps checking back automatically?

[badgb21]

Hi
I have informed them.
I assume they will re check and advise.
I’ll let you know if they post anything or if the block is lifted.

Maybe it wouldn’t hurt for you to advise them too.

[badgb21]

Has been cleared - all good now.

[Toby]

Thanks, happy to hear