Spyware Research > Infections > Hidden Files

Hello,

i'm not sure what you mean by "We are still looking forward for answers from the dotnetnuke team what happen with this malware detection." - I'm one of a team of people who monitor the security@dotnetnuke.com alias and we have not received any emails asking about this

I can see a number of problems with what you describe - first of the all the file type is .resx which is a storage format for strings and objects such as images - it is not an executable format (such as exe) or an interpretable one such as (aspx/vbs etc.) that could form a virus. Secondly,the actual file you indicate is simply a bolivian spanish translation of the fck functions, dotnetnuke simply uses entries in it to replace text . Looking at the copy I have (you didn't identify the version that you're seeing that problem with so i checked a few . ) it contains no serialized objects, and consists of 12 translated entries for fields such as the text on an upload button, a message that there is no available space etc.

As to your problem itself, I can see a few possibilites

• the file extension is .res and not .resx - this is different from the version we deploy, but I could conceive of a case where someone renamed it incorrectly. .res files are executable delphi files so this might cause an issue (http://www.fileinfo.net/extension/res)
• the tool you're using has simply shown a "false positive" where it's flagged something in error - much like if you send a joke about viagra to a friend it may be flagged as spam mail
• the tool you're using is faking a result, so you get concerned and buy the tool - doing a quick search http://www.google.co.uk/search?hl=en&q=Spyware+Doctor+scam&meta= , throws up a lot of results that would support this theory

If you're concerned I'd recommend you open the file in notepad and examine it's contents, as well as right click on it and get whatever antivirus program you use to scan it.

Cathal

please tell me what package you are using, both version and type so I can check i.e. 4.9.2_install . We do not have any .res files in our source code repostory and I cannot find any in the 6-7 packages I checked. Did you install any additional modules, or update versions of the fckeditor ie. did you download the beta version from Locopon's site?

Cathal