False alarm or virus in Mootools?

Hi folks,

Just a warning in case this comes up

My antivirus software (AVGFree) just reported a virus (trojan horse js/uniz.b) in the mootools.js file in the Smoothgallery directory and promptly deleted or archived every copy it could find in my localhost test folders.

However, I can find no mention of such a virus anywhere, and when I downloaded a new copy of the maxigallery zip file and scanned it, it couldn’t find any trace of a virus. The file in the new zip and the archived copies were apparently identical. It looks like a false alarm.

I don’t use smoothgallery so it’s not an issue for me, and the other display packages seem unaffected, but you may want to check your installations.

Has anybody else come across this?

Jon

same software and same alert for me..

virus : http://vil.nai.com/vil/content/v_102426.htm

and found in MaxiGallery0.5.1.zip and MaxiGallery0.5.2_beta.zip in : "snippets/maxigallery/smoothgallery/js/mootools.js"

I’ll look into it, but I doubt that there is actually a virus in it.. but if there is, I get the mootools.js replaced by a fresh copy. You can do the same in your environments. Just take the mootools.js from the slimbox folder for example and overwrite the smoothgallery one with that.

I scanned my development environment and the 0.5.2 package from the resource repository with my AVGFree and didn’t get any virus or trojan warnings..

Have someone else got this?

Quote from: doze at Jun 13, 2007, 06:18 AM

Just take the mootools.js from the slimbox folder for example and overwrite the smoothgallery one with that.

Here’s a peculiarity: the mootools.js in my slimbox/js folder is different from the one in smoothgallery/js (36,093 bytes vs 25,329). Is this significant?

Jon

Quote from: Astronut at Jun 13, 2007, 11:19 AM

Quote from: doze at Jun 13, 2007, 06:18 AM

Just take the mootools.js from the slimbox folder for example and overwrite the smoothgallery one with that.

Here’s a peculiarity: the mootools.js in my slimbox/js folder is different from the one in smoothgallery/js (36,093 bytes vs 25,329). Is this significant?

Jon

Not likely. MooTools can come in many shapes and sizes depending on a few factors:

1. What JS depencies are included in the download: e.g. Fx.Styles, Cookie, Window, etc, etc
2. Whether or not compression is enabled/disabled
3. Whether or not source code commenting is removed or not, etc.

http://mootools.net/download

See the download page for a more clear understanding...

Yea, they don’t have the same packages.. If I remember correctly, other one had everything and the other just what it needs..

Quote from: pixelchutes at Jun 13, 2007, 11:25 AM

Not likely. MooTools can come in many shapes and sizes depending on a few factors:

1. What JS depencies are included in the download: e.g. Fx.Styles, Cookie, Window, etc, etc
2. Whether or not compression is enabled/disabled
3. Whether or not source code commenting is removed or not, etc.

http://mootools.net/download

See the download page for a more clear understanding...

Ah, I guess that makes sense. I have little understanding of these js packages (I took a look inside the file and was none the wiser...) and from what I’ve heard of the Mootools forums, I really don’t want to go near them!

I’m beginning to think the whole virus thing is a false alarm, but I’ll know for certain when I run my next update and test.

I’m pretty certain that it was false.. AVG didn’t say anything from the files when I checked it. Do you have the latest updates in AVG?

Mine is (information -> about avg free):

Program version: 7.5.472
Virus base: 269.8.15/848
Release date: 6/13/2007 12:50PM

Hi all, I haven’t had that problem but you could use the service VirusTotal from Hispasec Sistemas just to be "sure" there is no virus in that file.