#4591 - Virus Error

By Guest
Added 10th Feb 2021, 3:44 PM
2 views

Identifier	#4591
Issue type	Feature request or suggestion
Title	Virus Error
Status	Closed (cannot reproduce)
Handling member	Chris Graham
Version	10.0.34
Addon	General / Uncategorised
Description	I'm getting Trojan:Win32/CoinMiner.BB!bit associated with \IIS\mywebsite\sources\hooks\systems\comcode_link_handlers\Photo.scr also here sources\hooks\systems\comcode_preparse\Photo.scr, and here \sources\hooks\systems\comcode\Photo.scr in about 1500 error warnings of a virus. Is this a problem with 10.0.34 or do I have a false positive? This didn't show up until after I upgraded. This is running on a Windows server 2016 under IIS w/PHP 7.3.13
Steps to reproduce	Files have been Quarantinued
Funded?	No

The system will post a comment when this issue is modified (e.g., status changes). To be notified of this, click "Enable comment notifications".

Rating

Unrated

Comments

By Guest posted 10th Feb 2021, 4:36 PM

Photo.scr is not a Composr file, and does not appear in the Git repository, the server, my local checkout, and there's no reference to it in the code itself.

By Guest posted 10th Feb 2021, 4:37 PM

Something external must have infected Composr's directory. Either the upgrade is a coincidence, or somehow something injected itself into the upgrade process on your end.

By Guest, By Guest, posted 10th Feb 2021, 6:05 PM

Thank you I thought it was a weird file name to be in so many directories. Microsoft defender found and removed it. just wanted to check and see if I missed something. now I have to figure out how it got there.