Jump to content

mx_starter

Approved members
  • Posts

    4
  • Joined

  • Last visited

Posts posted by mx_starter

  1. The audit table just contains an audit trail of what happened elsewhere in the application, there is no need to clean it. It is not used for ad delivery and is therefore invisible to a malware scanner.

     

    Agree.

    To be honest - i have no idea what this table is used for - just found the code within and that is why i pointed it out.

    But - the need Revive to explain how to resolve the problem still exist.

  2. Hi and HNY to all here!
    If you have problems with AVAST blocking the banner deliveries as described here:

    http://forum.revive-adserver.com/topic/91-javascript-invocation-code-marked-as-a-trojan-by-avast-224/
    and here:
    http://forum.avast.com/index.php?topic=143666.0
     

    you must be aware that simply upgrading to revive 3.0.2 is not enough, because the malicious JS code is probably injected in your database before the upgrade (and the upgrade script obviously does not fix this).

     

    I think revive team should explain how to remove the infection in a clear way!

     

    Until then - that procedure worked for me:

    1. Stop the ad-server
    2. Remove all the files under /var/cache subfolder (some of them will contain the javascript code within)
    3. The affected tables in mysql are named 'audit' and 'zones' (plus prefixes in front if you use them)
    4. Open the admin panel and for each of the zones:
    4.1. Click on the 'Advanced' tab and remove the malicious script from the prepend/append fields, then save the changes
    4.2. For each of the zones, there would be a record in the 'audit' table containing the script in its 'details' field. Delete these records and you should be fine - Avast should stop complaining from now on.

×
×
  • Create New...