trojun threat

i was asked to join a faction, when i looked at the profile of the person
it downloaded a file to my pc called "city.php"

i did not click on anything to download that file
and then my computer said it detected a tojun
so i deleted the file, i don't know if thats enough to remove by simply deleting

I thought all pages on torn (or most) had the ".php" after them? I think it relates to the language/scripting of the web pages.

For example, right now my address bar is:
http://www.torn.com/forums.php#/p=threads&f=2&t=15926568&b=0&a=0

I don't think it is a virus or will cause any harm to your computer, but I stand to be corrected as im sure others will be more knowledgeable.

What was the profile I'd?

city.php is the directory for the city page.

http://www.torn.com/city.php

However that's not a file download link, and one could conceivably disguise a file download as anything they wanted. I would suggest contacting staff about the issue so that they can investigate further.

Edit: Please don't link or post any of the profile information as it will only serve to further the spread of the threat, if one exists. Hades, if you really have to know just PM the OP.

as far as i'm aware you can't force a download >.>

Actually, this happens to me sometimes on Torn. Often I'll find I've accidentally tried to save/download the webpage I'm currently on.

You have no idea how many times City.php, item.php, index.php etc has ended up in my download bar at the bottom of the page.

I don't think it's a virus from a forced download, I think you may have fatfingers like me and often click things without meaning to.


You know, I actually don't know what shortcut or what I've clicked to cause this. Just it happens almost daily.

EDIT: This actually happens on some other websites too. I'd love to know how I'm accidentally doing this, but I don't really care enough to find out for myself.

Proof, my download list from yesterday.

[image: i.gyazo.com]

Notice the (5) and (6) on index.php. That's how many times I've saved those accidentally so far. Also I've downloaded a reddit page too.

Every time you even look at something it comes through your browser. Some times just looking at a small thing like a flash image can infect your computer if there is malicious code behind it.

there's a difference between requesting a web request vs a DDL

most AV block JS or any scripts which do anything directly to you as it's normally easy to spot, the idea that simply requesting a webpage would force a browser to download externally isn't something possible, as far as i'm aware

You've clearly never heard of "Stealth Downloads" which is one of the most common ways that major virus packages get on someone's system (aside from clicking the "Speed up my PC now" ads).

It's very possible, and very common. Most AV's detect this and block it immediately, however some wont see it til it's already on your system.

I haven't heard of stealth downloads, link me up so i can read up :)

I think he means drive-bys

NOD32 on my pc flags and blocks some peoples forum pictures.