autson slideshow with viruses??

[marcosbh35]

I'm using the slideshow module autson and avast with your updates are accusing that has virus trojan, have passed other antivirus on the server that does not acknowledge this virus.
Anyone know what can be done?

Att..

Marcos

[eduardoescdel]

I once used this module and indeed had a warning regarding to malicious code in my website.

I investigated about autson slideshow and found out there is a backdoor in its core code, however, you can easily remove it.

I don't remember where is this peace of code (actually i belive it's 1-3 lines) exactly located, but try to search for the string http in autson slideshow's php files, you'll find it.

[marcosbh35]

I once used this module and indeed had a warning regarding to malicious code in my website.

I investigated about autson slideshow and found out there is a backdoor in its core code, however, you can easily remove it.

I don't remember where is this peace of code (actually i belive it's 1-3 lines) exactly located, but try to search for the string http in autson slideshow's php files, you'll find it.

Thanks, but I did not find the string you entered.

[brian]

the autson slideshow is VERY nasty as depending on the version it will include nasty code from a remote site dynamically into your web site.

Uninstall it IMMEDIATELY there are many great replacements available.

[marcosbh35]

the autson slideshow is VERY nasty as depending on the version it will include nasty code from a remote site dynamically into your web site.

Uninstall it IMMEDIATELY there are many great replacements available.

which you can show me another module;

[elusenji]

I also had Avast give me a warning about it. The culprit is a piece of code in Autson Slideshow that references dotnetnuke. My good friend John posted this video on [youtube] that should help you remove the malicious code; if at all you do not want to switch to another extension:
http://youtu.be/i1A5AoNSNGI

Hope that helps!

[Zorro82]

Hi, i found the damn piece of code around the line 563 in the default.php file

/modules/mod_AutsonSlideShow/tmpl/default.php

Hope it helps someone.

[badbison]

That helped me VERY MUCH ! Cheers.

It's the script starting on that line. It looks like they wrap the malicious code in charcode in an array and then call it a couple of lines down.

Delete the script and it passes avast test and still functions.

[vixbow]

Thank you for your solution to this! Two years after this post and looks like they *just* activated it on my site! For others with this issue, find: "function dnnViewState()" -- find this script and delete the whole thing. Everything works great again. I deleted lines 567 to 583, in my case. Obviously, my virus protection would not let me edit the file in my computer, but I could edit it using the cPanel's file manager (edit function).

Look for the file in /modules/mod_AutsonSlideShow/tmpl/default.php