: detected: virus 'HEUR:Exploit.Script.Generic' (modification).

KillerSneak	#1 2009-08-21 15:32
Members	You may need to check the files on the host server have not been tampered with because this message has started flashing up today from my antivirus. It happens on the front page and then again if I click through to another page on the site. It blocks the plugin from running but the site carries on working as normal. 20/08/2009 18:09:03 Malicious HTTP object <http://www.donotargue.com/plugins/markitup/js/jqModal.js>: detected: virus 'HEUR:Exploit.Script.Generic' (modification). One of my Site admins reported this to me. Running Cotonti build 0.6.0 .. Do i need to take this serious ?

KillerSneak

#1 2009-08-21 15:32

You may need to check the files on the host server have not been tampered with because this message has started flashing up today from my antivirus. It happens on the front page and then again if I click through to another page on the site. It blocks the plugin from running but the site carries on working as normal.

20/08/2009 18:09:03 Malicious HTTP object <http://www.donotargue.com/plugins/markitup/js/jqModal.js>: detected: virus 'HEUR:Exploit.Script.Generic' (modification).

One of my Site admins reported this to me. Running Cotonti build 0.6.0 .. Do i need to take this serious ?

Kilandor	#2 2009-08-21 22:22
Administrators Thanked: 9 times	Try Re-downloading it and uploading it Here is a link http://trac.cotonti.com/browser/trunk/plugins/markitup/js/jqModal.js There is no reason it should cause it, there is nothing malicious about it, its from markitup as far as I know. And we haven't even modified it in 6 months. But yes maybe it coulda been tampered with for you? though kinda doubt it. As there would be alot more/worse/easier things to probably do

Kilandor

#2 2009-08-21 22:22

Administrators
Thanked: 9 times

Try Re-downloading it and uploading it

Here is a link
http://trac.cotonti.com/browser/trunk/plugins/markitup/js/jqModal.js

There is no reason it should cause it, there is nothing malicious about it, its from markitup as far as I know. And we haven't even modified it in 6 months. But yes maybe it coulda been tampered with for you? though kinda doubt it. As there would be alot more/worse/easier things to probably do

Trustmaster	#3 2009-08-22 00:40
Administrators Thanked: 263 times	Many anti-virus programs do that, no surprise. I have compared your jqModal with the source file and they are identical. You can check it with other anti-virus software too (like I did with ClamAV), but I suppose that was a KAV mistake. May the Source be with you!

KillerSneak	#4 2009-08-26 16:01
Members	Yeah I told my admin that it was probably a false positive, but just in case i posted it here to see if anybody else had seen this msg before.