Trojan in this website - Guild Wars Guru archive powered by Guild Wars Legacy

Daesu

Furnace Stoker

Join Date: Oct 2008

20 Aug 2011 at 01:21 - 1

Yesterday I noticed that a jucheck.exe was trying to run as elevated credentials in my machine. But everytime I denied it permission, it would keep popping back up.

According to my scanning tool, IE downloaded TrojanDownloader:Win32/Tracur.Y in the background when it is connected to this website.

Please look into that.

Snograt

rattus rattus

Join Date: Jan 2006

London, UK GMT??0 ??1hr DST

[GURU]GW [wiki]GW2

R/

20 Aug 2011 at 15:03 - 2

Jucheck.exe is annoying but not suspicious - it's just checking to see if your Java install is current.

Tracur.Y is a different matter altogether - that is a currently prolific trojan. Your scanner actually said that IE downloaded the trojan when connected to this website?

Daesu

Furnace Stoker

Join Date: Oct 2008

21 Aug 2011 at 16:42 - 3

Quote:

Originally Posted by Snograt

Jucheck.exe is annoying but not suspicious - it's just checking to see if your Java install is current.

Tracur.Y is a different matter altogether - that is a currently prolific trojan. Your scanner actually said that IE downloaded the trojan when connected to this website? jucheck.exe can be a disguised malware. This one is definitely suspicious because it keeps popping up secure desktop dialog immediately even though I tried dismissing it repeatedly as if forcing me to allow it to run as admin.

Suspecting a trojan, I scanned my PC and discovered Tracur.Y. Removing Tracur.Y with my tool, just allows it to be downloaded again after a few minutes as long as my browser was opened and pointing to this site.

By removing it and closing my browser, did it seem to go away, so yes I suspect there was Trojan activity on this site. I had my browser on other websites opened at that time too but it is only by closing the browser instance that was connected to this site, did it stop downloading Tracur.Y.