0

I`m using the webstatistic bbclone on my server. In the last month my virus scanner sometimes blocks the details page.

it displays the detection of

JS:ScriptIP-INF (TRJ)

on my bblone. But I compared all files bitwise with the original install files from the main page, they are identical.

I figured out, the the virus message disappaers if some more visits are listed in the statistic.

So I think somebody visits my website and sends a user-agent String with something virus like (e.g. javascript code).

I would to modify my bbclone to filter out these virus user-agent.

but I need to know how I can detect a visitor with this JS:ScriptIP-INF (TRJ) - user-agent.

I was searching in google and several forums for a answer, but I find no usefull information how to avoid this virus.

e.g. this: My website is infected with JS:ScriptIP-inf [Trj]

2

I had the same issue. It's not the User Agent, it's the HTTP Referer.

I thought malware bots were visiting my website with a HTTP Referer with some malicious JS code injected in it. So I changed BBClone's configuration not to display the HTTP Referer in the detailed stats, and it worked.

Edit your conf/config.php and make sure $BBC_DETAILED_STAT_FIELDS does not contain the variable referer, e.g.

$BBC_DETAILED_STAT_FIELDS = "id, time, ext, dns, ip, visits, os, browser, page, search";

I still don't know what is the offending referer string, though. I'll dig into the raw logs and when I find something interesting I'll edit this answer. Then we can filter out the string and have the referer data shown back in the detailed stats.

|improve this answer|||||
  • Your tipp sounds good, thank you. I will check this when I get the next "detection" alert. When your tipp solves the problem, I give you the "accepted answer" vote. – Radon8472 Nov 11 '15 at 8:56
  • The alert shows up and then disappears as the old entries (containing the offending string) are deleted in the detailed log file. To keep them for a longer time you can set the history to 500 i.e. the max recommended value. – dr_ Nov 11 '15 at 9:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.