10 replies to this topic

[natsumerio]

TROJAN WARNING!
This is VERY important. At http://www.zeldalege...index.php?p=124 there is a TROJAN in one of the text dumps. The one that it is in is the HTML version of LOZ-OOT's American text dump, named "z64dump(usa).html". Luckily, Avast Free Anti-Virus closed the tab instantly & told me about the TROJAN. Anyway, I don't have an account there, so somebody please contact whoever runs that site & tell them about this problem. That is the only part of that site that I checked out, so they should scan the whole site with a anti-trojan program. Since Avast Free Anti-Virus saved me from trouble, they should it or something similar.

[TheAvengerLever]

Gee, thanks. Your product REALLY WORKS!

[natsumerio]

If you mean Avast Free Anti-Virus, I'm not the owner or maker of it. I just happen to use it, but yeah, it is great. Hopefully, whoever runs that site get's the infections taken care of.

[SL the Pyro]

^ I can vouch for him because I also use Avast. In other words, he's not a bot and not malicious and is actually trying to warn us.

You might want to see what the deal is, Khuffie.

Edited by SL the Pyro, 10 August 2010 - 06:17 PM.

[wisp]

Hm. I also use Avast and it told me that the page was infected. Unfortunately I have no way of cleaning anything up on the Zelda Legends website, but I'll tell Khuffie.

[Khuffie]

I've pointed davogones to this thread so he can investigate.

[GuardianNinja]

Wow. Good thing I has abort connection.

Is avast the only one detecting this beast?

[Wolf O'Donnell]

My Kaspersky is also warning me of a Trojan and I only updated my software five minutes ago.

[Showsni]

Huh, odd. I normally just visit the .txt versions... Um, I've added an extra dot to the link so people can't click on it for the time being, until someone with more knowhow can sort it out. The html OoT credits page was making my browser flash warnings at me too.

[davogones]

Hi everyone, thanks for bringing this to our attention. I was skeptical at first (after all, how can a pure HTML file that hasn't been touched since 2002 contain malicious code?) But I looked at the files, and sure enough, some javascript had been inserted at the end of both files. This was probably inserted by hackers in 2008 (judging by the last modification date on the files).

I'm not sure what the javascript does yet, but I will find out. I will also continue investigating to make sure no other files have been infected.

*davogones out*

[davogones]

That was easy... The javascript is obfuscated, but all it does is redirect to a Chinese hacker web site which contains malware. No doubt, browing to that web site would probably infect your computer, if your antivirus software didn't stop you.